alt Hacker NewsIt’s easy to criticise large legacy orgs having bad security, but what should you actually do as a C suite leader to fix it in these orgs?
It’s easy to list the various code scanning and monitoring solutions, but what do you do if teams continue to fail to fix issues on time? And realistically there’s a shadow IT of shell scripts and macros you don’t have much visibility on.
You can’t fire everyone, so I think it’d be better to link compensation of engineers (especially leads/managers) to scan reports, incidents, and audits, even if these are imperfect. But even then you’ll have business complaints about taking away engineering capacity from feature delivery.
The obvious first step is to outsource all IT infrastructure to one of the large service providers. While it's possible that they'll be breached, at least they have the resources and expertise to stand a fighting chance against the new wave of advanced persistent threats. Smaller companies outside the tech sector will never be able to keep up and secure their own systems. Like can you imagine some random manufacturing company hiring enough real security experts to keep up on their own? Even if they were willing to pay there around enough of those employees to go around. (I mean real security domain experts, not compliance process box checkers.)
It's unfortunate that every business now has to pay what effectively amounts to an IT security tax which will further enrich a small set of large tech companies. But that is our reality and there's no point in pretending otherwise.