Corporate computer security consulting still sucks?

Mon, 19 May 2003 15:21:00 -0400
/technology

Interesting idea from Charlie Stross.

My experience of large consulting companies is that their analysts are more focussed on the appearance of professionalism than on the substance, more interested in looking trustworthy to the occupants of the boardroom — walking the management walk, talking the management talk — than in actually doing the job.

Structures. Human organisations that are fundamentally defective at the job in hand but that are more successful than competent organisations in the market because they’re better at winning contracts. Predictability and security. (Is that an itch in my fingertips? I can feel a story coming on …)

That means that the real problem lies in the companies hiring consultants. If security becomes important enough then companies will be forced to consult the competent or be hacked to death.

“I don’t care how nice those guys are or how many meals they took us out on. If we get robbed by hackers again, I get fired. Hire the guys with the dodgy beards”.