Compliance as a strategy has been one of my bugbears in information security for as long as I can remember. Even when I was a junior professional in the field, I understood the limitations of what we juniors lovingly called the "tick-and-bash" approach - the practice of ticking boxes to confirm that the organization followed [...]