CrankySec

Still Shit!

Centuries ago, in January of 2024, I wrote that your security program was shit. It's probably the most popular post in this little blog's history. I say probably because I don't really know. I get a "Number of Unique Visitors" metric and nothing else. We don't even know the referer, so, when something blows up, I can't tell where it's been posted so I can go there and talk shit to haters. It's a bummer, because I do like to talk shit.

Your security program is still shit because the people in charge of it don't know what they're doing. That's it. CISOs who prefer to spend half of their working hours going to conferences. Directors who got promoted into cybersecurity leadership without having worked in cybersecurity a single day in their lives. Managers who just want to be promoted into cybersecurity leadership so they don't have to actually work in cybersecurity because they are busy trying to become a CISO and spend half their working hours going to conferences. The other half is dedicated to happy hours and dinners with Microsoft salespeople.

That's the disconnect. The poor saps (a.k.a. us) doing the work are too busy doing the work to find time to play the office politics games needed to change things. If you can't influence people who run the show, the people running the show will run the show as they see fit. And what they see fit is extremely dumb.

But not all programs!

Yeah. Not all programs. You have programs out there that are excellent because the people in charge know what they are doing, and because cybersecurity is critical for the success of the business. You don't put your money in a bank that keeps getting robbed. When a lack of cybersecurity, and I am using the term very loosely, impacts the bottom line materially, the cybersecurity program tends to be better. When getting popped and ransomware'd just mean sending out a few letters and offering identity theft monitoring no one cares about, the program will be shit. In other words: the program is shit because it doesn't have to be good.

If, you know, the cost of running a functional cybersecurity program is greater than the cost of not doing so, the answer is obvious: don't do it. A lot of people will still run a program, but that's almost exclusively theater, and you need someone to throw under the bus when things inevitably go wrong. The number of cybersecurity professionals who are asked to perform the theatrics is way bigger than the number of professionals who are asked to do proper cybersecurity. That's why you are frustrated. You are frustrated because you were told that this matters, that investing your time and money building and developing your skills would pay off in the end. A lot of times, it doesn't.

That's why your work laptop has 8 endpoint protection agents running, but no one can tell you where the critical data lives. That's why your employer pays Microsoft millions of dollars a year so people can automate the boring parts of the theater with Copilot. As long as it looks like you are running a tight ship, you don't have to actually do it. Companies will measure the success of their programs by how much they spend. By how many alerts were triaged. By how many tabletop exercised were conducted. And you know what they say about metrics and targets.

Doing cybersecurity is hard. Leadership must know what good looks like, and, if they don't know what they are doing because they were yanked from the project management office to run cybersecurity, they won't know what good looks like. No matter how much business you speak. They don't care because they don't have to care: if no one here is in a position to hold me accountable for my incompetence, I won't be held accountable for my incompetence, and I'll still enjoy a steady paycheck and the benefits of being an executive. I can go on LinkedIn all day and vomit some platitudes Copilot wrote for me. That's what we pay Microsoft the big bucks, no?

Cybersecurity boils down to risk management. Pure and simple. You need a lot of other things to have good risk management, but risk management is cybersecurity. It isn't "we spent a trillion dollars on Crowdstrike". Risk management lets the decision makers make informed decisions. The problem is that they are too dumb to make the correct ones.

If you find yourself in this situation, know that 1) it's not your fault, and 2) you won't change jack shit. Do your job the best you can, hone your skills, obtain experience, and bail for greener pastures the first opportunity you get. You don't owe shit to anyone who's using you as a puppet to look good. Don't try to play a game you're not invited to. Come hang out with us.