• @agent_flounder@lemmy.one
    link
    fedilink
    English
    36
    edit-2
    1 year ago

    Sounds like the company doesn’t have a clue about cyber security then. Tens of thousands is a piddling infosec budget for anything but a tiny company. Also, Insider threats, malicious or otherwise, should always be on an infosec professional’s radar.

    Companies not giving a shit about cyber security is probably not a secret but it is still pretty common, I think, so nobody should be surprised when there are major breaches.

    Infosec is usually seen as an expense that cuts into profits. Assuming top level management and the board give a shit about security that’s great but often the risk isn’t fully appreciated at the top or is managed poorly.

    Adequate infosec requires a company to have very mature processes across the board in IT (and likely beyond). C-level “buy in” isn’t enough. If the C level management and board doesn’t actively demand it, infosec will lose out to myriad other priorities every time.

    The big tell is the org structure. If the CISO reports to the CEO, great. If they’re reporting to the CIO, CFO, etc., that can cause conflicts of interest. It can still work. If there is no CISO or they are the same person as the CIO, or if infosec reports several levels down in the org–beware!

    • @limelight79@lemm.ee
      link
      fedilink
      121 year ago

      Yeah, if I did what he did, I’d be in jail. I would be caught quickly.

      There are only a few ways to get immediately fired from my employer, and that’s one of them.

      • @agent_flounder@lemmy.one
        link
        fedilink
        English
        21 year ago

        This exact scenario is in our annual training. Also I wouldn’t be able to in the first place because we block those kinds of sites. Even if we didn’t they would likely detect it and come a-knocking lol.