News for hackers. Stuff that matters.
Re:Third High Severity CVE in Log4j Is Published by cutemonster on Sunday December 19, 2021 @11:09AM (#29614973)
I suspect that a manager that suggested / insisted on such properly staffed teams, would get fired or no longer promoted, at most big companies. Since it'd cost a lot, and not show any results the nearest time / years. And also, they might hire the wrong people, and just burn money for nothing

> Simple, if brutal solution ... properly staffed teams

The recruitment part is not simple, maybe bordering to impossible? for some larger companies. I say, based on my past experiences in how clueless big companies can be concerning what technical people they hire.

Re:Third High Severity CVE in Log4j Is Published by to11mtm on Tuesday December 21, 2021 @10:12PM (#29645192)
> and not show any results the nearest time / years.

Depends on how you game OKRs. Implement auditing Q1. Contact all teams Q2. Have 75% of teams Q3. 90% of teams Q4. Just an example but its all in how you sell it. Big IT understands icebergs, you just have to give a good/accurate roadmap and execute if they agree on it.

You might be correct that a lack of insight on this sort of thing is an organizational problem. My experience indicates that if you can't get a list of dependencies based on a series of e-mails down an org chart, something is wrong. Either someone is managing too many services for the level of tooling you have, or there's a complete breakdown in org comms (which happens more in larger enterprises.)

Re:Third High Severity CVE in Log4j Is Published by cutemonster on Thursday December 23, 2021 @02:52AM (#29659630)
Sounds interesting, but what does "Have 75% of teams Q3" mean?