So this call comes in from Customer XYZ with Credentials BR-549 or whatever and the question is about what our policy/position is on the latest discovered vulnerability in CLI tool ABC or something. I reply for the 5th time today that we are not a security organization, but we have heard that the policy of the Frapdoodle Application's maintenance organization is that patch 4524232566655 will be available on the first of the month, at yadayadayada.it or some other place that I just Googled. Call ended.
Then I almost plotzed as I thought about what had just happened. See, I glanced again at the customer credential screen and the organization title sank in. The caller had been with a nationally recognized computer security consultant. A really big name. And he'd just asked about a vulnerability currently in the news, even outside the industry. And I'd gotten the answer from a freaking search engine.
This consultancy doubtless pays the guy that called our outfit two to three times the money I make - in order that he get the answer from somebody else who thought to go to the interwebs and get it for nothing. The guy that called (plus hordes of his co-workers) quite possibly hit the cocktail party circuit advertising themselves as smarter than you or me, yet they may not be able to Google. They possibly have degrees, certifications, years of experience... or something. And got hired. And are morons.
Reminds me of the guy sometime back that took a security class in which the teacher put onto the big screen the activities of somebody in the class logging into their bank account from a school machine, with the snooping app's window up in the corner with the grabbed account and password [OOPS I'VE TOLD THIS STORY BEFORE].
I'd better just stop here, lest we all feel a bit more unsafe, what with all these professionals protecting us...
