« The Road to the Security Cliff is Paved with Optionality | Main | Incentives and Decision Making »


Ben Tomhave

I've been arguing for nearly 4 years that a security department is unnecessary these days. I disagree with you on the "CYA instead of CIA" quip, though. I think it comes down to organization and optimization. The business should be managing operational risk, and operations should own those remediation and management duties. A separate security department tends to decrease an organization's effectiveness.

One of my first posts on the topic was here in July 2009:

More recently:




@Ben - Agree and I would go one step further: do you need IT at all? You could say this is what the Cloud is about. But really, we had IT back when few knew how to operate a computer. Not the case today. In my view you are either

a) developing a product
b) operating a product
c) working in customer service

There's no reason to separate "business" from "IT" its just business.


The comments to this entry are closed.