Re: Going meta (was RE: Ok, so now we have a firewall...)

[Bennett Todd <bet () rahul net>]

In the financial services biz, there's a nice way to get out of this
bind: engage the risk analysis team. They hold the reins, nobody is
allowed to ignore them, and their job is analyzing risk tradeoffs.

Get them involved, teach them enough so they can make informed
judgements about computer security risk/cost tradeoffs, and things
get better. Not instantly, of course, but the the direction of
change switches:-).

In other business segments, I think the root problem --- not just
for computer security, but for any number of other corporate ills
--- is a failure to realistically account for risk in management
accounting.

The banking and investment folks have a leg up here since their
product is buying and selling risk.

-Bennett

Attachment: _bin
Description: