Re:U.S. Election Agency Breached by Hackers After November Vote
by closeparen on Saturday December 24, 2016 @11:15PM
(#13252878)
Because no part of "securing an enterprise network" includes any meaningful filter on the shitty software the organization is going to buy and run.
If something "needs to be secure" then IT is likely up to its ears in reams of policies and reports, Cisco firewalls, VLANs, Group Policies, Symantec antivirus products, Websense, and password complexity regimes. It seems only elite tech companies and the military/intelligence community are making serious steps towards "How can I choose and commission software that is not so likely to contain serious vulnerabilities?" Even obvious ones.
Mainstream IT security practices can, at best, put up a perimeter around the steaming pile of garbage fresh from the lowest bidder so that it can't infect anything else, and only insiders can exploit it, and maybe there will even be a record of them doing things that look like exploit attempts.
If something "needs to be secure" then IT is likely up to its ears in reams of policies and reports, Cisco firewalls, VLANs, Group Policies, Symantec antivirus products, Websense, and password complexity regimes. It seems only elite tech companies and the military/intelligence community are making serious steps towards "How can I choose and commission software that is not so likely to contain serious vulnerabilities?" Even obvious ones.
Mainstream IT security practices can, at best, put up a perimeter around the steaming pile of garbage fresh from the lowest bidder so that it can't infect anything else, and only insiders can exploit it, and maybe there will even be a record of them doing things that look like exploit attempts.