Slashdot Mirror
CIOs Spend a Third of Their Time On Security (enterprisersproject.com)
StewBeans writes: Much has been discussed about the potential security risks of an Internet of Things future in which billions of devices and machines are all talking to each other automatically. But the IoT market is exploding at a breakneck pace, leaving all companies scrambling to figure out the security piece of the puzzle now, before it's too late. In fact, some experts believe this issue will be what separates the winners from the losers, as security concerns either stop companies from getting into the IoT market, or delay existing IoT projects and leave the door open to swifter competition. That's likely why, according to CIO Magazine's annual survey, CIOs are spending a third of their time on security. Adam Dennison from CIO said, "If IT leaders want to embrace the sexy, new technologies they are hearing about today—the SMAC stack, third platform, Internet of Things, etc—security is going to be upfront and at the center of the discussion."
Is that more or less than the percentage spend on porn?
This issue is a bit more complicated than you think.
I'm already using the most robust security model for the Internet of Things. I call it Things. My fridge doens't need an internet connection, nor does my light switch. My Smart TV thinks it does, but based on recent information I am in the process of removing that privelege.
I think the difference between the winners and losers will be the CIO's that don't feel the urge to jump onto flavour of the month hype and connect everything to the Internet.
The entire concept breaks the first rule of Engineering. Keep it fucking simple you fucking fucktards.
It seems CIOs spend 10% of their time actually working, the rest of the time they're shmoozing with all the other entitled execs.
2/3 on anything else except security.
Where Im at they solved the problem by
1) Outsourcing security to a 3rd party vendor.
2) Giving everyone in security full admin rights on all the servers and network equipment.
When he was asked Why? He responded that by doing so, if anything happens, it is the 3rd party vendor who is to blame and not him.
So we have security through "It's not may fault"
And we really, really mean it this time! Security all the way!
No. It won't be different. And they do NOT spend 1/3 of their time on security.
Most of them don't even know what security is. Or why you cannot buy it. It's just another item on a checklist for them.
If the CIO of an Internet of Things company is spending 1/3 of their time thinking about security, yet is still so incompetent... maybe they would be better off paying 1/3 of a CIO's salary to a random slashdotter for 5 minutes of their time.
Of course, no matter how long they take thinking about security, they're still going to sacrifice security for usability every time, so I don't know what purpose thinking about it has.
Don't waste your vote! Vote for whoever you want, unless you live in a swing state it won't matter anyways
If I was surveyed (and I have been), I'll report what I worry about the most. That may or may not be what I actually get to spend time on. If I was a politician (and I'm not), I'd strictly answer what the questioner wants me to worry about the most.
davecb@spamcop.net
Many CIOs will dive head-first into IoT, get a lot of good PR, stock prices will rise and they'll be rewarded. Then their companies will discover the IoT security nightmare, get lots of bad PR, stock prices will sink and the CIOs will blame it on someone else. Result: happy CIOs and IoT vendors and an absolute disaster for everybody else.
I believe in better security by cutting back on extra, unnecessary features; all they do is provide more surfaces for finding vulnerabilities. I recently bought an IoT washing machine and have stripped back the extra features, like wash, rinse, and spin cycles, so that all it does is send SPAM messages and participate in DDoS attacks.
If CIO's are only spending one third of the time, it's obvious why things are so insecure in general. Pffft.
Oh CIO - as the inexorable IoT takes over the intertoobz - you will fondly look back on the days when only 1/3rd of your time was spent on security. Just wait until the CEO calls because his Android penis pump won't shut off because a rival company hacked it.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
And particularly those who said Windows is unsecurable. I remember the days when UNIX ruled the business landscape, was on the Internet, and generally a medium sized shop could use a large UNIX box and run all services with 99.9???% uptime. Was stunned people believed Microsoft and tried replacing the UNIX boxes with a single or a few Windows NT boxes. Laughed when I heard how NT apps would crash the whole OS and so all the other services/apps so they started putting one service/app on a Windows NT server. ROFLMAO hearing how they then doubled those numbers to try and get close to 99% reliability with these redundant servers. There is a _great_ snake oil salesman out there going by the initials Bill Gates.
Shmoozing with other execs, both within their company and outside it, is a very large part of the job description.
"...leaving all companies scrambling to figure out the security piece of the puzzle now, before it's too late."
This statement is made as if companies themselves do not control the design and development of their own damn products. The simple fact is they do, and they'll either choose to do the right thing and prioritize security, or they'll choose to do the greedy thing and rush to market.
Of course, we all already know what they will choose. Otherwise we wouldn't be having this discussion.
"...security is going to be upfront and at the center of the discussion."
Might as well stop throwing this kind of bullshit around until you look back through consumer-throwaway-product history and try and find where the hell they ever brought security to the center of the discussion.
As I said before, we already know what greedy capitalists and their investors will choose.
Sure, CIOs (should) spend a lot of time on security. But it has almost nothing to do with the "Internet of Things." The refrigerators at the office may be a security risk, but it has more to do with food security, than network security!
A third if their time coming up with new corporate password rules, a third of their time architecting the Citrix solution that is going to propel the company into the brave future of 1998 and a third of their time requiring their employees to get training on whatever the bandwagon buzzword of the month is (This quarter it's Rally/Agile/Scrum.) You know, honestly, the company would be a lot better off if a freak software error caused that guy to fall down an elevator shaft.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
As much as it's proven orgs are overall lax on security, security concerns do complicate IT greatly. It used to be a lot easier to "hook things up": different servers and boxes all talking to each other doing a different part of the job.
Now it requires diddling with black boxes because nothing exposes helpful info about what it is in the name of security.
Perhaps if "they" designed systems right, things would be easier, but humans are imperfect and build imperfect things. An appeal to idealism falls flat.
These extra layers and precautions are "job security" such that perhaps I shouldn't complain, but I miss the days where it was easy to connect different things in an almost Lego and Tinkertoy way to get results fast. Now the Tinkertoys always ask, "Hark, who goes there?" I don't like red tape.
Kids even need a password to get OFF my lawn.
Table-ized A.I.
do you work at Apple?
lucm, indeed.
Shmoozing with other execs, both within their company and outside it, is a very large part of the job description.
Yes. From a sane viewpoint this is called cronyism, but in the current business environment this is called "networking".
Companies don't controll other companies development, and therein lies the problem.
You speak as if security and time to market are mutually exclusive polar opposites, but they aren't. You furthermore speak in terms of a single company, rather than a hierarchical array of companies interacting, which is what we really have. The fact is that every company will make a trade off - time to market vs. security out the door (and how much will be added/improved with updates later.) Some will make better choices than others, and each companies choice may have an impact on other companies in the same market. The first to market will likely not be the one that wins in the long run if history is any guide. It will be something like the first (or second, or third) company to make the right choices with regard to trade-offs and learn from the mistakes made by the trailblazers.
In the case of IoT security I have no doubt that many, many will try and very few will succeed. This is basically the pattern for all software products in my experience, but it will be on a grander scale as security will be a much more real issue than it has been in the past once things are involved.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
At least considering all the security breeches over the last couple of decades. Trust breeds trust.
Time is what keeps everything from happening all at once.
If you could provide a rest api for the host file, many would appreciate it. The same many of us don't have the time to download a Windows package (which we don't use) and extract it.
The effort to curate a hosts file is extraordinate. Thank you for your generous time, but it doesn't help us.
Remember, in security, Access Denied is success.
If they did, they would quit outsourcing. Seriously, when you outsource the code to another nation in which you are paying software engineers 8-10,000 / year, what do you think will happen which China or Russia offers one of them 100,000 to leave a back door in the code? Then once the black hats get on the system, they put in a new back door and remove the one that was put in the system so as to not point back to the original person.
If the CIOs at places like Target and Home Depot REALLY cared about Security, they would quit outsourcing to weak coders that make horrible money and are then easy targets for this.
I prefer the "u" in honour as it seems to be missing these days.
Correction: "An ol'..."
Table-ized A.I.
A totally pointless article full of content-less quasi-technical sounding waffle ..
I've been there. The CIO golfs with the CEO. They fired everyone in the IT department except the CIO, and he repeated the mistake, but it hadn't blown up on him again by the time I'd left.
Learn to love Alaska
Where I work the CIO spends no time at all on IT Security.
Makes sense. That's why there is the CISO. .. Or is there?
Seriously, it's not even an afterthought. I have worked on a publicly funded research project covering smart home and living crap. While some of it may be interesting from a tinkering with stuff point of view, most of it is creepy surveillance type of shit, like smart metering. When I raised the question of security people stared blankly at me for a second or two and suggested that it wasn't a problem at all and if ever will be fixed later, maybe.
My point is, CIOs do not make relevant security decisions when it comes to product design. No one does. It's all about marketability and cost efficiency, security is neither because it is complex and costs a lot of money. And who care? Honestly, who cares about security? It's not the vendors and it's definitely not the consumers who constantly carry their rarely-if-ever-security-updated-listening-in-and-tracking-devices and provide the world with current information about the vacancy of their homes. So again, who cares? Eventually the insurance companies might care, when some cracker remotely burned down a kitchen or flooded a bathroom or two or ten thousand.
I feel so sig.
The CISO is a much more recent office and typically reports to the CIO. By default the duties of the CISO have fallen to the CIO and only more recently in relative terms been parted out to the CISO.
I never get used to these constant resurrections
The motto of IT seems to be "Ironclad security is what we strive to deliver. If that reduces productivity to zero, it is not our problem."
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
I think they spend that much time on their job security.
Nae king! Nae laird! Nae yurrupiean pressedent! We willna be fooled again!
Shmoozing with other execs, both within their company and outside it, is a very large part of the job description.
Yes. From a sane viewpoint this is called cronyism, but in the current business environment this is called "networking".
I remember the moment in my 30's when I matured from someone who thought he was above politics to someone who realized no one is. I had been in the corporate world long enough to know that being capable of creating the best technical solution to a problem is not nearly as important as being able to persuade a company to enact those solutions. Not even close to as important.
Since then I have made sure that my career growth is as much on the business side as it is on the technical side of my industry. If I really felt my goal was to provide the most positive impact on companies I worked for, I needed to stop stubbornly thinking that being technically competent was my primary skill set. It is perfectly fine for an employee to decide they just don't want to venture from the technical aspect of their career, but that is a conscious decision to not be a significant decision maker.
Technically competent people do not enact change (or at least very rarely do). Those with the business acumen to shape policy within their organization enact change. Those people may or may not also be technically competent, but that is of secondary importance.
-- All that is necessary for the triumph of evil is that good men do nothing. -- Edmund Burke
The problem seems to be that too many people make that career decision too early and (here it comes) endeavor to drive the car without knowing what the wheel and pedals do, and what the rules of the road are.
Strange things are afoot at the Circle-K.
At least they stop paying
lucm, indeed.
Where I work the CIO spends no time at all on IT Security.
Makes sense. That's why there is the CISO. .. Or is there?
I first read that as "CISCO". And it made perfect sense.