Almost as a corollary to the previous post, we have this one…

Yoran and Spaf’s Law
In his book “Practical Unix and Internet Security,” Professor Gene Spafford of Purdue University spells out Spaf’s first principle of security administration: “If you have responsibility for security but have no authority to set rules or punish violators, your own role in the organization is to take the blame when something big goes wrong.”

Amen! I’ll be presenting this to the appropriate people that (currently) think security is irrelevant

Security Sounds Good, But Does It Make Me Money? (Business)
From time to time, I find myself sucked into discussions about the return on investment of security. The discussion goes something like this: from a business perspective, if security is an expense and I can choose to incur it or not, why should I? I seem to have done just fine until today. Then, a more enlightened issue comes up: if I understand the risk and I am willing to take it, that means I have the choice of spending money on prevention or remediation. Why not wait until something happens and then%u2026 we%u2019ll call you.

That just about describes the biggest misconception in business today.