Tag Info

New answers tagged

1

I'm guessing here that you're referring to software supply chains rather than physical ones as they've been in the news a bit lately. The answer is that all companies which use software have some kind of supply chain. For example any IT devices you use constitue part of your sofware supply chain as the security of those devices and the software they run ...


2

I think the most accurate way is to carry out a risk assessment. For example, work out the value of each asset you want to protect within your company. Value is the value to your company, not just the price to purchase it in the first place. For example, cost of implementation, cost of the data, the value to owners and users, and the value it has to ...


2

Security is about loss prevention, not profit. There are plenty of reports about how to calculate the ROI (Return On Investment) for a company (I even saw a PhD on that) but this usually ends up with some wild hand waving and I am still waiting, after running budgets of $MM, for some magical formula which would tell management that the investment is worth ...


0

I would consider it to be both operational(or biz) as well as a security risk. Biz: Businesses run on reputation and if the reputation goes for a toss as a result of a DDOS attack; if the C-level executives fails in the damage control area. The situation is especially grave when you are running a B2B service. Security: Crackers can use the DDOS attacks ...


1

From a technical, 1s and 0s stand point, he is correct but the "accepted scope" of security threats include availability. However all companies are free to assign responsibilities as they see fit so your CSO may be simply stating a point that it's not his responsibility to mitigate that particular risk.


17

While I generally disagree with the CSO, I can see a reason why he drew this line. The question can come down to the delineation of who needs to lead mitigation and remediation efforts. DDoS does, of course, impact availability but is typically handled by the Operations team. If a DDoS event happens, your CSO might feel that there is nothing that he can do ...


2

DDoS attacks fall into both operational and security categories because of the triad mentioned above. However security personnel tend to be more knowledgeable of attacks so like AviD said there should be communication between the security and IT teams to solve the problem rather than losing hours covering research that could be solved by a 10 minute phone ...


38

I think that is a false dichotomy, and your CSO is being plain silly. Though I am fond of the silliness, the security department should be driving risk mitigation. Squabbling over areas of "responsibility" are obviously not productive, though it might fit into the general corporate culture. While there are various ways of qualifying the realm of ...



Top 50 recent answers are included