I have some extra time in the coming months and I'd like to use it to start a small research project: I want to make a catalog of the security / privacy clauses that large enterprises often require in their contracts.
@anton_chuvakin@waitbutwhy I'm very interested in a bit more detail @anton_chuvakin. It's probably my fault, but I find I don't really trust chatgpt too much anymore, because it has given me (very subtly) wrong answers. For creative writing or argument refinement, I often get bland, uninteresting results
@dannypostma The whole structure of this house (and its structural integrity) rests on a single, well placed 1 euro coin. So far, no defects. It does it’s job well! ;-) This is in Belgium.
If you don’t like working with people, managing relationships, brokering deals, and finding ways to build influence outside of your direct area of authority, you aren’t going to like being a CISO.
Infosec has a short memory forgetting all the marketing around ML stuff that was pushed years ago. It was the magic fix to stop malware. Fast forward, ML is in every product and works extremely well, but it didn’t reach the claims marketing teams told you it would.
You’d be surprised of how much of management, consulting, teaching, senior ICing, etc is:
“I want to X.”
“Have you written down a plausible plan to get to X with steps listed in order?”
“No.”
“Alright let’s sketch it. OK step one: are you going to do it?”
“Why would I do that?”
@jfslowik@cudeso Now I'm not really sure what you're concluding. Are you saying that as an industry, we need to educate SMB stakeholders to look at something like the Verizon DBIR?
Or do you propose some kind of "light CTI" process specific to the SMB (sector)?
@jfslowik@cudeso Interesting take, thanks @jfslowik. I had to dig a bit for your definition of a SMB (school district, hospital, local government). I'd make that a bit more explicit, because that context is important in the discussion.
@jesslivingston I love reading! I'd say: find the joy in it for you. I started as a kid as a way to (unconsciously) learn more about the world.
There are compounding advantages to reading, but that's besides the point. You can immerse yourself in whatever book. Do it for you. You're not behind.
here's a hot take: I think false positives (in infosec) are overrated as an issue. Instead, what's more important is the time spent to chase down and confirm no-issue. If that was instantaneous, we wouldn't care much about potential false positives. *ducks*
@tibo_maker Was there any info on the next iteration of ChatGPT/competitors? What would they likely look like, is there enough data. That kind of stuff?
I always admire it when someone puts his thoughts into words, it takes much more thought and courage than a throwaway tweet storm. Here is @txs with his view on the next years in cybersecurity: https://t.co/NqvzHIaofk Worth a read!
But it seems a bit depressing from the founder point of view: bigco seems to have an insurmountable advantage when the idea is to integrate with (or assimilate) other tooling.
Whereas small teams can often create an advantage where they are "the best" in a niche thing.