Slashdot Mirror
CIOs Spend a Third of Their Time On Security (enterprisersproject.com)
StewBeans writes: Much has been discussed about the potential security risks of an Internet of Things future in which billions of devices and machines are all talking to each other automatically. But the IoT market is exploding at a breakneck pace, leaving all companies scrambling to figure out the security piece of the puzzle now, before it's too late. In fact, some experts believe this issue will be what separates the winners from the losers, as security concerns either stop companies from getting into the IoT market, or delay existing IoT projects and leave the door open to swifter competition. That's likely why, according to CIO Magazine's annual survey, CIOs are spending a third of their time on security. Adam Dennison from CIO said, "If IT leaders want to embrace the sexy, new technologies they are hearing about today—the SMAC stack, third platform, Internet of Things, etc—security is going to be upfront and at the center of the discussion."
I'm already using the most robust security model for the Internet of Things. I call it Things. My fridge doens't need an internet connection, nor does my light switch. My Smart TV thinks it does, but based on recent information I am in the process of removing that privelege.
I think the difference between the winners and losers will be the CIO's that don't feel the urge to jump onto flavour of the month hype and connect everything to the Internet.
The entire concept breaks the first rule of Engineering. Keep it fucking simple you fucking fucktards.
It seems CIOs spend 10% of their time actually working, the rest of the time they're shmoozing with all the other entitled execs.
Where Im at they solved the problem by
1) Outsourcing security to a 3rd party vendor.
2) Giving everyone in security full admin rights on all the servers and network equipment.
When he was asked Why? He responded that by doing so, if anything happens, it is the 3rd party vendor who is to blame and not him.
So we have security through "It's not may fault"
And we really, really mean it this time! Security all the way!
No. It won't be different. And they do NOT spend 1/3 of their time on security.
Most of them don't even know what security is. Or why you cannot buy it. It's just another item on a checklist for them.
If the CIO of an Internet of Things company is spending 1/3 of their time thinking about security, yet is still so incompetent... maybe they would be better off paying 1/3 of a CIO's salary to a random slashdotter for 5 minutes of their time.
Of course, no matter how long they take thinking about security, they're still going to sacrifice security for usability every time, so I don't know what purpose thinking about it has.
Don't waste your vote! Vote for whoever you want, unless you live in a swing state it won't matter anyways
Many CIOs will dive head-first into IoT, get a lot of good PR, stock prices will rise and they'll be rewarded. Then their companies will discover the IoT security nightmare, get lots of bad PR, stock prices will sink and the CIOs will blame it on someone else. Result: happy CIOs and IoT vendors and an absolute disaster for everybody else.
I believe in better security by cutting back on extra, unnecessary features; all they do is provide more surfaces for finding vulnerabilities. I recently bought an IoT washing machine and have stripped back the extra features, like wash, rinse, and spin cycles, so that all it does is send SPAM messages and participate in DDoS attacks.
And particularly those who said Windows is unsecurable. I remember the days when UNIX ruled the business landscape, was on the Internet, and generally a medium sized shop could use a large UNIX box and run all services with 99.9???% uptime. Was stunned people believed Microsoft and tried replacing the UNIX boxes with a single or a few Windows NT boxes. Laughed when I heard how NT apps would crash the whole OS and so all the other services/apps so they started putting one service/app on a Windows NT server. ROFLMAO hearing how they then doubled those numbers to try and get close to 99% reliability with these redundant servers. There is a _great_ snake oil salesman out there going by the initials Bill Gates.
How much time do you expect them to spend. I would say 1/3 is pretty damn good, and if you don't then you probably have little experience with executives and their responsibilities. I don't actually believe they are spending that much time on it, but if they are it is a pretty damn good number.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Shmoozing with other execs, both within their company and outside it, is a very large part of the job description.
Yes. From a sane viewpoint this is called cronyism, but in the current business environment this is called "networking".
Don't knock it, many software developers haven't made it to where they should have been in 1998. We're still knee deep in 32bit single threaded applications. Fortunately most applications no longer need admin rights to run so at least they've made it to 1992.
I've been there. The CIO golfs with the CEO. They fired everyone in the IT department except the CIO, and he repeated the mistake, but it hadn't blown up on him again by the time I'd left.
Learn to love Alaska
Seriously, it's not even an afterthought. I have worked on a publicly funded research project covering smart home and living crap. While some of it may be interesting from a tinkering with stuff point of view, most of it is creepy surveillance type of shit, like smart metering. When I raised the question of security people stared blankly at me for a second or two and suggested that it wasn't a problem at all and if ever will be fixed later, maybe.
My point is, CIOs do not make relevant security decisions when it comes to product design. No one does. It's all about marketability and cost efficiency, security is neither because it is complex and costs a lot of money. And who care? Honestly, who cares about security? It's not the vendors and it's definitely not the consumers who constantly carry their rarely-if-ever-security-updated-listening-in-and-tracking-devices and provide the world with current information about the vacancy of their homes. So again, who cares? Eventually the insurance companies might care, when some cracker remotely burned down a kitchen or flooded a bathroom or two or ten thousand.
I feel so sig.
I think they spend that much time on their job security.
Nae king! Nae laird! Nae yurrupiean pressedent! We willna be fooled again!