Two things (or more?) come to mind after these latest news! After (thousands of) years of problems in security, the institutions still don't think the security as a vital business function? And, we only see large security problems - if large institutions have problems, how many smaller must(!) have even more, or do they? Might be interesting to know, is it just statistics (large incidents) or a tragedy (one person mishap)?

Anyway, with todays technology and capabilities, how it even can happen? At least I haven't seen any studies if it is executive branch laziness or incompetence, is it a middle management problem or what is the reason? After 30+ years dealing with IT (and other) security - it isn't technology (it never is!), it isn't skills to use technology (anyone can use the current tools and toys!), it definitely is not the cost (security saves and, done right, makes even other IT business less costly), so ?? And it can't be the lack of rules, regulations, laws, policies or standards - none of those are really needed to do the "right thing"! Besides we have a lot of those already.

This just before my morning coffee and lately talking / listening one (huge) company which tries to dance around the security issues with marketing and technology instead really having plans, architecture and designs!

Click to read the article this is in response to.