Comments on: Security is about outcomes, not about process

By: hox0a rflepa

hox0a rflepa — Thu, 15 Oct 2009 07:32:44 +0000

04O6F, I really like your site! j4qeu

By: hox0a rflepa

hox0a rflepa — Thu, 15 Oct 2009 07:31:47 +0000

04O6F, I really like your site! j4qeu

By: hox0a rflepa

hox0a rflepa — Thu, 15 Oct 2009 07:31:12 +0000

04O6F, I really like your site! j4qeu

By: hox0a rflepa

hox0a rflepa — Thu, 15 Oct 2009 07:30:10 +0000

04O6F, I really like your site! j4qeu

By: hox0a rflepa

hox0a rflepa — Thu, 15 Oct 2009 07:29:47 +0000

04O6F, I really like your site! j4qeu

By: hox0a rflepa

hox0a rflepa — Thu, 15 Oct 2009 07:29:22 +0000

04O6F, I really like your site! j4qeu

By: Anonymous

Anonymous — Wed, 10 Jun 2009 02:16:19 +0000

Well-mannered place! Add to favorite

By: ChrisNeal

ChrisNeal — Tue, 21 Apr 2009 22:13:29 +0000

I’m not sure you aren’t making a false distinction. Aren’t outcomes just the measure of the process?
I would maintain that security is still a process (and certainly not a product), but that we as an industry need to put real development effort into appropriate measurement of those processes to ensure we can articulate the outputs/outcomes of the process.

By: Mr. X

Mr. X — Tue, 14 Apr 2009 20:56:01 +0000

Having thought about this some more, what activity of any substance _isn’t_ about outcomes? I understand what you’re saying of course, and I understand the importance of branding, but I wonder whether “security is about outcomes” is as vapid as “security is a process”.
Sorry, in a contrarian mood.

By: Davi Ottenheimer

Davi Ottenheimer — Tue, 14 Apr 2009 16:12:26 +0000

You might also want to credit Shewart (1930s) and Deming (1950s) when discussing theories of security process versus outcomes. Or if you believe Wikipedia, Francis Bacon also gets a nod: http://en.wikipedia.org/wiki/PDCA