Controls Are Not the Solution to Our Problem
[IMG ]If you recognize the inspiration for this post title and graphic, you’ll understand my ultimate goal. If not, let me start by saying this post is an expansion of ideas presented in a previous post with the succinct and catchy title Control-Compliant vs Field-Assessed Security. In brief, too many organizations, regulators, and government agencies waste precious time and resources devising and auditing “controls,” regardless of the effect these controls have or do not have on security. The
