This is wonderful - we throw our hands up and say, "If only 'management'............." and it's no answer at all.

For decades (literally) I've listened to so-called information security professionals sketch 'solutions' to the problems of the electronic information age and then step back with a ruefull shake of the head and say, "Ah but management will never..........."

Creating a tool to reduce a risk is an admirable skill - but it's a skill and not a profession. 'Management' (whoever they are) need education and lucid cost/benefit arguments to be able to make decisions - particularly the decisions we favor. Until we become adept at providing that education and those arguments then let us not pretend that we're skilled at our jobs and, please, let us stop throwing up our hands and muttering, "Ah, if only management.........."

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/11228/32051#32051