I always love it when people review the past and find out new things.

But then they cheapen the experience by something like this:  “If the SCADA system would have been 800-53-compliant, then these two deaths wouldn’t have happened”.

Well, where I come from, SSG Smith has a saying:  “If ‘if’ was a ‘fifth’, we would all be drunk”.  Now this colorful phrase basically means in polite-people-speak that you can “what-if” a past situation to death, but it doesn’t really change what happened.

Credit card breach companies, I feel your pain because you deal with this every single time:  “If they would have been PCI-compliant, this wouldn’t have happened”.    =)

• Life in a Zero Defects World
• Preliminary Findings on Cybersecurity Review Now Out
• Thought-Terminating Cliches and Infosec
• Layers Upon Layers of Oversight
• Always Behind