• 0 Posts
  • 735 Comments
Joined 3 years ago
cake
Cake day: June 18th, 2023

help-circle


  • Hmm, there are some products that should have a defined “end of life”. For instance, computer networking hardware which will eventually be outdated and no longer get security updates. The trick is, the EOL date should be clearly marked on the product at the point of sale so that the buyer can make an informed decision.

    This is built-in obsolescence, but it’s better than the current situation where Cisco will sell you a firewall at full price and then decide 6 months later that they aren’t supporting that model anymore and you have to buy a new one.












  • The folks at NIST know what they’re talking about. The US government directed them to develop security policy for government information systems in 2002 (FISMA) - they’ve been thinking about how to do this properly for 24 years.

    If you happen to work for a US government agency of any kind, you can basically tell your boss “NIST guidance says we should do X” and compliance is technically required by law (within the context of security policies that apply to your agency’s work area). If you work for a company that does business with the US government, there are similar compliance policies also published by NIST that you should be following (and your company could lose its contracts if it is not compliant).