robterrin

The challenge with this EO and all aspirational security pronouncements is their focus on outcomes while avoiding implementation details, trade offs and resources.

It’s as if nobody asked WHY zero trust and MFA are not already pervasive in the Federal Government. Legacy systems are going to be incredibly difficult and expensive to rearchitect for ZTA. Despite HSPD-12 (CAC and PIV authentication and access) being over a decade old, some parts of government refuse to use a smart card plus password for MFA. I wonder why? It is not simply because “government doesn’t understand computers.” The core issue is leadership. There is no benefit for executives to point out the constraints, like usability, cost or talent, that ensure that good ideas in principle will be adopted incorrectly and incompletely.

That said, there is some stuff worth cheering. The CSRB is much overdue and the elevation in status of cybersecurity as a critical function is directionally correct.

Much of whether these aspirations will be possible hinges on legislative budget decisions and ultimately sweeping reform of the government hiring system.

First, congrats on making it this far! That's amazing and a huge feat.

Second, no you're not crazy. It is risky, but not crazy. Are there a few things you can do to derisk your decision? Identify what you would need to know to feel comfortable and work back from that to form testable hypotheses. Then figure out how much time/money/effort it would cost to test those hypotheses.

If that seems like too much work, or you still won't have the certainty, I wouldn't go all in, but there's one other option before shutting it down. Can you sell the business? Maybe to a search fund or a small investor? I'd get in touch with Arvid Kahl, here or on Twitter if I were you.

Best of luck!

Logged in just to upvote your comment.

An actual land value tax would be even better!

SEEKING FREELANCER | NYC | Full or part time

Cybersecurity engineers proficient in application security, cloud security, identity and access management, and operations. Fintech experience preferable, with a minimum of a few years focused on security.

Email address in profile.