« The Road to the Security Cliff is Paved with Optionality |
| Incentives and Decision Making »
January 09, 2013 in Security | Permalink
I've been arguing for nearly 4 years that a security department is unnecessary these days. I disagree with you on the "CYA instead of CIA" quip, though. I think it comes down to organization and optimization. The business should be managing operational risk, and operations should own those remediation and management duties. A separate security department tends to decrease an organization's effectiveness.
One of my first posts on the topic was here in July 2009:
Ben Tomhave |
January 09, 2013 at 01:01 PM
@Ben - Agree and I would go one step further: do you need IT at all? You could say this is what the Cloud is about. But really, we had IT back when few knew how to operate a computer. Not the case today. In my view you are either
a) developing a product
b) operating a product
c) working in customer service
There's no reason to separate "business" from "IT" its just business.
January 09, 2013 at 01:12 PM
The comments to this entry are closed.