I had touched on this in an OWASP talk. In short, ...

2010-05-22T23:23:14.860+10:00

I had touched on this in an OWASP talk. In short, developer training works, user training doesn't. Not that it shouldn't be done but I wouldn't invest a huge chunk of time.

There's a lot of stuff out there in terms of scoring visible impressions on the board - I defer to stuff like the Pragmatic EA ( see here). EAs have been at this for longer, or at least better experience than most security architects IMHO.

Long term, these will add value but in essence, good architects and managers need to chalk up runs on the board and quickly to establish credibility and value otherwise they risk being seen as ineffectual and running things from their "ivory towers".

Taking your example, why not take a few of your suggestions that can be done quickly and generate rapid results within the first 30 days? There was an article in CIO magazine ages back that suggested that effective leaders at that level need to have an action plan for generating results fast. Security leaders likewise need to do the same.

Is there evidence that we could use to compare the...

2010-05-20T22:14:34.882+10:00

Is there evidence that we could use to compare the effectiveness of security awareness training to other mitigations? Is security awareness training objectively the "best bang for the buck"?

Comments on Infamous Agenda: Best bang for buck security initiatives

I had touched on this in an OWASP talk. In short, ...

Is there evidence that we could use to compare the...