It's a good list, but like most (all?) of these lists it doesn't offer too much advice on organizational best practices.
IMO a security program which cannot justify its own worth to others in the organization is incomplete.
Most security professionals I've met (and I've been one of them, too) assume that security is or should be everyone's top priority. They struggle to deal with people for whom security is just one of many competing concerns.
IMO a security program which cannot justify its own worth to others in the organization is incomplete.
Most security professionals I've met (and I've been one of them, too) assume that security is or should be everyone's top priority. They struggle to deal with people for whom security is just one of many competing concerns.