Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror

Comment depends on IT criticality (Score 1) 47

Of the firms I've worked for, only the large ones (>$20B/yr) that depend heavily on IT had a dedicated in-house incident response team. Smaller shops ($5-20B) or those that rely less on IT would outsource it. Small enterprises with a 1-5 man security team probably have just a written plan that's never tested. Anything under $1B/yr in revenue probably doesn't have a security team at all unless they are an Internet-based company.

Comment Re:Printable instant tickets? (Score 1) 44

But the foolish design thing here was having the machine know the outcome of the ticket before it prints (or even at all).

By law, individual machines generally need to maintain a guaranteed payout rate. As a result, they need to know whether the player will win or not. When the numbers are computer-generated, then it can be exploited via software. If it's a roll of tickets it is distributing, then the roll is already configured with a specific payback rate.

Comment the real deal about compensation (Score 1) 59

In large companies ($1B+), you can expect that a Director's salary averages between $150-200K/yr. Officers will be between $200-300K/yr. But the real money is in the performance-based incentives. Directors generally get a 30% bonus and officers are 50% or more. Long-term incentives like restricted stock units (for public companies) are also straight up cash unless the stock is declining in value over the vesting period. All in all, total comp starts around $300K/yr and can hit $1M for companies whose stock is doing really well.

Comment Re:Interesting CTo cheerleader piece (Score 2) 123

The thing I don't like about the public cloud is the real possibility for permanent vendor lock-in, IBM mainframe style.

What many people don't realize is that this is why OpenStack is so popular. As cloud providers "standardize" on the OpenStack platform and APIs (except for AWS, which doesn't do it because they are the 900 lb gorilla in the market), they become interchangeable by nature. The common denominator for compatibility is how your provisioning and migration engine interfaces with the cloud provider. And if you're based on the OpenStack API, then you can basically migrate or provision your workloads on any provider that supports that API - no lock-in. All you need to do is update DNS to point to your new hosting provider and you're in business.

Comment Re:There aren't infinite bugs (Score 1) 235

Counterpoint: Even the best teams are not capable of making secure software.

Case in point, the NASA shuttle avionics system. CMMI level 5 certified software development program, track record of 2 Sev-1 defects per year during development.

Timeline Analysis and Lessons Learned (see page 7/slide 6) You'll find that there were hundreds of unknown latent Sev-1 defects (potentially causing loss of payload and human life) and even ~150 defects 15 years after the program started.

The question isn't whether your team is capable or willing to fix the issue, you must acknowledge that there is nearly 100% certainty that there are unknown vulnerabilities in any software you write. The question goes back to whether a bug bounty program will ever cross the inflection point of a ROI chart.

Comment Re:Federal Judges Need to Go Back to School (Score 1) 584

The constitution simply defines the scope and authority of the federal government, and relationships between states as well as between state and federal government.. All powers not explicitly defined in the constitution as being federal are resigned to state jurisdiction. Constitutional amendments have added specific rights to address state and federal abuses.

Comment No one has a "low priority" project (Score 5, Insightful) 304

The answer lies in quantifying the project impact, not in calling it low/medium/high (which is a subjective, relative term). Also, as business grows (or shrinks), the measurement of impact should be weighted as well. For example, a project that generates $1M/yr in revenue is a big deal when you're making $2M/yr, but not as much when you're making $20M/yr.

In the end, limited resources need to be focused on the area where it makes the most impact rather than trying to solve everyone's problems. That is exactly what IT management's job is.

The other answer is that no group/team/company does this really well, it comes down to individual manager's or IC's style and how you dismiss the trivial requests.

Slashdot Top Deals

Each honest calling, each walk of life, has its own elite, its own aristocracy based on excellence of performance. -- James Bryant Conant

Working...