Auditors

Squinting at Security Drivers and Perspective-based Biases

28 October 2011 ~10 min By Dominic White
Auditors Metrics Risk Management Threat Modelling Vendors
While doing some thinking on threat modelling I started examining what the usual drivers of security spend and controls are in an organisation. I’ve spent some time on multiple fronts, security management (been audited, had CIOs push for priorities), security auditing (followed workpapers and audit plans), pentesting (broke in however we could) and security consulting (tried to help people fix stuff) and even dabbled with trying to sell some security…