Mike Rowehl says a good computer-security professional eventually realizes that security just is not absolute - you have to assume that, sooner or later, the bad guys will get in and so you have to figure out how to manage your risks:
Before I had a job within a large company doing computer security, I used to think that security professionals spent most of their time updating access control lists, looking at packet logs, auditing application code, and doing all sorts of technical stuff. I thought that computer security within organizations was all about keeping people out of your data and off your systems. It's not. It's about spending as little as possible on issues related to the security of your computers. It's not all about keeping people off your systems. It's about figuring out how much it costs the company if people do make it onto your systems, and then figuring out how much it keeps to keep those people off your systems, and then picking whichever of those two costs less. Like insurance, it's all about risk management. ...Back to Compendium
Post a comment
