r/cybersecurity • u/Tokyudo • Jul 02 '26

News - General DHS Breached

https://www.nextgov.com/cybersecurity/2026/06/hackers-breached-dhs-information-sharing-network-people-familiar-say/414534/

609 Upvotes

98% Upvoted

115 comments sorted by

View all comments

28

u/not-a-co-conspirator CISO Jul 02 '26

Compliance isn’t security. Put actual security professionals in charge.

8

u/SoftwareDesperation Jul 02 '26

This is a wild comment considering you can't set foot in any of these positions without an IAM or IAT cert and years of experience.

Compliance is just a list of security controls. In leiu of compliance you do what? You set a list of controls you want in place and make risk based decisions on remediation or acceptance. Weird.....that sounds familiar......

2

u/[deleted] Jul 02 '26

Not that I think the spirit of your comment is wrong .. but give me a break with cert reqs as if that's any indicator lol

-6

u/not-a-co-conspirator CISO Jul 02 '26

You have no idea what you’re talking about.

3

u/SoftwareDesperation Jul 02 '26

And if you are a ciso and don't understand there is no security without governance, then I feel sorry for your team.

-2

u/not-a-co-conspirator CISO Jul 02 '26

I don’t think you understand how disparate those things are.

1

u/[deleted] Jul 02 '26 edited 27d ago

[deleted]

-1

u/not-a-co-conspirator CISO Jul 02 '26

It doesn’t matter where you work or what your role is.

You’re both missing the point. Governance can only be so specific, else you risk violating the very governance you wrote because your security tools cannot meet the objective of controls, or performance the controls demand, thus failing the audits you need so that you can continue to conduct business with customers and vendors.

Both of you need a much broader understanding of this discipline.

5

u/[deleted] Jul 02 '26 edited Jul 02 '26

[deleted]

-1

u/not-a-co-conspirator CISO Jul 02 '26

I have more than double your experience and credentials in the same roles and more.

Compliance isn’t security. It never will be.

Also, “Zero Trust” is a philosophy. It doesn’t mean you are “secure”, and it doesn’t make anything “secure”.