tag:blogger.com,1999:blog-4088979.post115764810291148924..comments2023-10-16T06:06:25.012-04:00Comments on TaoSecurity Blog: Mike Rothman Is RightRichard Bejtlichhttp://www.blogger.com/profile/13512184196416665417noreply@blogger.comBlogger5125tag:blogger.com,1999:blog-4088979.post-1157793666163752812006-09-09T05:21:00.000-04:002006-09-09T05:21:00.000-04:00Hi Rob,You are describing the Road House effect.Hi Rob,<BR/><BR/>You are describing the <A HREF="http://taosecurity.blogspot.com/2006/04/return-on-security-investment-just.html" REL="nofollow">Road House effect</A>.Richard Bejtlichhttps://www.blogger.com/profile/13512184196416665417noreply@blogger.comtag:blogger.com,1999:blog-4088979.post-1157773942252756192006-09-08T23:52:00.000-04:002006-09-08T23:52:00.000-04:00Since surveys have shown a high incidence of peopl...Since surveys have shown a high incidence of people now reluctanct to use the internet for e-commerce and even e-banking now, could it not be said that proof of secure transactions and public confidence, could lead to increased e-commerce activity? <BR/><BR/>In this case, security would be a business enabler, and the lack of it currently, and the resulting lack of public confidence, is a barrier.Anonymousnoreply@blogger.comtag:blogger.com,1999:blog-4088979.post-1157728784510364792006-09-08T11:19:00.000-04:002006-09-08T11:19:00.000-04:00Where is that half full glass that I have around h...Where is that half full glass that I have around here? I wonder how much of this position is a reaction to the marketing machines gathered at these conferences and how much is "real"? <BR/><BR/>I'm on the fence. I think that many, many people still don't trust the Internet. They they don't do any form of electronic banking or commerce. They don't want their personal information on the network. <BR/><BR/>The problem with that is that we can help a lot of people using networks and the Internet. And many folks are missing out because we can't reach them. We can help them do much more than manage their finances through the wider disemination tools such as specialized portals and medical telematics. <BR/><BR/>Can we have security and functionality and stilll generate revenue? Sure. But it won't be easy.Brianhttps://www.blogger.com/profile/04646124564497456836noreply@blogger.comtag:blogger.com,1999:blog-4088979.post-1157659476047133002006-09-07T16:04:00.000-04:002006-09-07T16:04:00.000-04:00I also think security is not a business enabler. A...I also think security is not a business enabler. And it is that same reason why coding is not necessarily secure by default. Security is a cost (unless your industry is in providing security, I guess). Think of the security guard for the building. Does his presence generate any revenue? Not for your typical business.<BR/><BR/>It is a tough distinction to make. Security can (will) prevent loss of business, but it, in and of itself, does not raise revenues. Marketing will always say otherwise, that someone chose the company because they meet a security standard they require, but really, security just prevented their lack of choosing you (i.e. going elsewhere).<BR/><BR/>Back to my coding example, it costs money in time and energy to code security into most apps. When push comes to shove, every IT person grudgingly knows that functionality will beat out security. Lack of security at deadline time won't necessarily trump just getting the product out. Security is a cost there, too, not an enabler. Lack of it may reduce revenues, but having it won't increase revenues, by itself.Unknownhttps://www.blogger.com/profile/15357840241031190415noreply@blogger.comtag:blogger.com,1999:blog-4088979.post-1157654910314427092006-09-07T14:48:00.000-04:002006-09-07T14:48:00.000-04:00Mr. Sam Dekay and I published a paper on security ...Mr. Sam Dekay and I published a paper on security enablement in late August.<BR/><BR/>http://www.securityfocus.com/archive/1/444735/30/0/threaded<BR/><BR/>http://www.ftusecurity.com/pub/VT-belva-dekay-final.pdf<BR/><BR/>Sincerely,<BR/>Kenneth F. Belva, CISSPAnonymousnoreply@blogger.com