What's the inverse? Which companies actually have good internal security practices?
One of the banks I recently worked at flipped the model from heavily restricting what users and systems can do to allowing them to do anything (including admin access for developers) and aggressively monitoring them.
In comparison my current bank needed 4 weeks and manager approvals to get a mouse driver installed.
I have yet to work for a company that has IT security and IT management in the same org.
Which is insane.
Why are companies empowering someone to say "No" (CISO), without requiring that same individual to justify not saying "Yes"?
If a user requests a tool, IT sec/management should be leaning in and asking "What can we provide you will that will satisfy this need?"
Instead, and I assume my experience generalizes to everyone who's worked in regulated tech, the response is "No, that's not approved" and ends the conversation.
The job that the security org is doing for the board/owners/etc is controlling risk because they don't trust if their IT org says "everything is totally fine", and consider it likely that if the decision about whether to implement some activity or not is left purely to the IT org, then the convenience of implementation will override the level of risk control that the board/owners desire, so they choose to put these controls in a separate organization, empowering someone to say "Not until you do all this unwelcome work to implement it to the standards the company has chosen", preventing all the many mid-managers to save their effort or their costs by cutting corners at the expense of risks to "someone else's" money.
Of course, having these functions together is much more efficient in many ways! But the principal-agent problem is very real, especially so in large organizations, so that's why these choices get made this way, designing organizational structures that act as checks and balances on each other, not expecting everyone to magically cooperate for the greater good.
It has not been my experience that this is what most IT security orgs say in practice.
It's usually "No, unless we do it" followed by "And we don't have time to do it."
Which is fundamentally because they're a cost center, and typically staffed like one.
That's bogus. Having the policies be in the same org as the provider just makes sense. You can run a separate security auditing department if you're keen to do that, nothing is stopping you. You can have independent oversight while you don't totally hamstring your organization.
Those auditors aren't also the ones approving expenditures, are they?
This is just my rambling thoughts, not sure if I have a main point, but realizing this pattern has certainly contributed to my personal sense of disillusionment.
I once worked a very short stint as an external dev at a private bank (6 weeks).
The side entrance we used had a revolving door-style airlock with enough space for a single person to stand, protected by a card reader using unlabelled RFID-style cards.
This was obviously to ensure that for every person entering, there was exactly 1 card swipe, no one could hold the door for anyone else, etc.. Real claustrophobic in there, to the point where it was impossible to step through the revolving door, you had to do stutter steps while the door revolved around you.
So obviously this airlock was broken at least 60% of the time. Its replacement was a normal door next to it, which was left completely open instead.
If by good you mean: the company would have no problems putting in their advertising the number the CISO knows about how much it would cost to completely invalidate their security and their customers and investors would be happy, or at least non-livid, if they were told; then none in the Fortune 500.
If by good you mean: somewhere where that number is more than $1M, the smallest unit that appears on their 10-Ks which usually use millions as their smallest unit, then probably none in the Fortune 500. If you raise it to $10M, then without a doubt there are none.
If by good you mean: "better" than other companies, but still trapped in a valley with the horde of hungry bears faster than them, then who cares, the bears are still going to eat them soon.
Generally they do.
Because during an exposure incident they often have to deal with regulators who punish them much more than the market will.
Experian leaked basically every American's SSN and credit history, and they got off with a $22m settlement.