Timeline for Defense in depth vs low complexity - Balancing point?
Current License: CC BY-SA 3.0
4 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 17, 2013 at 22:10 | comment | added | David Stratton | Just in case it was misinterpreted, I wasn't arguing anything you said, just commenting that I wish I'd run into some senior management that made security a priority. ;-) | |
| Jan 17, 2013 at 22:03 | comment | added | Thomas Pornin | Well, I have encountered the paranoiac type. People who would rant for hours on how dangerous it can be to put a Web server on a Windows server which is protected by only a specific DMZ and two layers of firewalls (and that server contained only public data, not even a list of user names or whatever). | |
| Jan 17, 2013 at 21:53 | comment | added | David Stratton | I don't disagree with what you're saying, but that first paragraph is funny to me, simply because it's at odds with my personal experience. I'd like to run into one person in upper management that actually gives a hoot about security or even knows what "Defense-in-depth" means. Most of the times, they figure it's "an I.T. job" to worry about security - they just want to know how to get tasks done/make a profit. Educating them to care and make decisions that don't increase risk is usually the challenge I face. But +1 because I agree with the conclusion 100%. | |
| Jan 17, 2013 at 20:43 | history | answered | Thomas Pornin | CC BY-SA 3.0 |