The effect of investing in security depends on the actual level of security achieved in the system. It also depends on the degree of trust from my stakeholders.
Imagine a system with perfect security which - for whatever reason - isn't trusted by those who should depend on it. Their distrust might appear totally irrational to us. That doesn't matter. It's not our call. Our effort is a failure.
Putting all our money into "actual" security and ignoring the need for assurance is a recipe for failure.
(some of) my events
- 2018-10-03--05 Operativ informationssäkerhet (teaching course, Stockholm)
- 2018-09-05--07 Strategisk informationssäkerhet (teaching course, Stockholm)
- 2018-05-23--25 Teknisk informationssäkerhet (teaching course, Stockholm)
- 2018-05-17 Three Capabilities in a Crisis (guest lecturing at Mid Sweden University, Östersund)
- 2018-05-16 Info.säkerhet är inte "någon annans problem" (lunch seminar at Mid Sweden University, Östersund)