Slashdot Mirror
Security's Shaky State
Ant writes "According to InformationWeek, Information Technology (I.T.) security professionals say when it comes to security, most I.T. departments are underfunded, understaffed, and underrepresented.
Resourceful I.T. security professionals are getting the job done, but their efforts have been hampered by undersized staffs and underfunded budgets that limit choices ranging from what products they buy to the vendors they work with."
... the Engineers and engineers; we doers, designers and other coal face bunnies have to eat some of the blame for under-funding and under-recognition.
If we could accurately quantify the benefits of what we want to do; and there MUST be a simple investment/payback model that any managoid can understand for anything you want to do. We are smarter than them, yet more often than not we bitch about how dumb the senior management is rather than use our smarts to convince them.
Trust me; do your research, present in simple terms the cost of the investment in (insert program here) vs. the cost of not doing it. Remember to quantify the risks in FINANCIAL terms. Lost productive hours; Loss of commercial advantage.
Take an active role in developing Key Performance Indicators for the organisation if it has such programs.
At the end of the day, baby boomers are, by and large, idiots as well as our bosses; they dont get the modern world. We have to present it to them in simple cost accounting terms. The more successful we are at communicating in these terms, the bigger our budgets will be.
Remember, businesses dont/shouldnt SPEND money... they should INVEST it; this is the way to convince and influence PHBs and managoids.
Anyway, just my $0.02AUD
err!
jak.
I was with you until the start-up comment. Generally speaking, it sounds right, but at least in my practice hasn't been so. From the day I started out as an intern up until now, when I have become a crucial team member and the go-to Linux guy, well... I get the same mediocre pay. I sure learned my lesson though - never become sold on empty promises (where's my 33% promised raise?), or start working without a contract you have read over, understood and signed.
Otherwise you end up in a position like me - overworked, overstressed, unappreciated, underpaid, the guy everyone dumps little shit on because they don't know *nix, scapegoat, on mediocre pay with no benefits, and getting screwed out of taxes (being a consultant blows). I also somehow ended up with three layers of management. That's uh... great.
SOX only applies to publicly held companies. Private companies are not bound by SOX.