Communications of the ACM
Securing the Company Jewels
Credit: Shutterstock
Dear KV,
I am dealing with someone you would call an idiot (a word I cannot use in my work setting) from our IT security department. This "person" has singularly decided to secure our corporate GitHub with many repos and many years of history. Securing something as important as the company's code is a task I would applaud, if only the person assigned to it had ever used GitHub, or written and deployed software, but, amazingly, the person doing this has done none of those things. Like many of the employees (I hesitate to use the word engineers) in our IT department, this person seems to have arrived with a sort of generic checklist to work from. Whenever our development team asks a question about something this person wants to secure the system, they return a blank look, like a deer in the headlights, or perhaps someone watching an oncoming train. I keep thinking this cannot be how modern security is done, but maybe I am missing something.
No entries found