Four Truths

There are four basic truths in security, infosec, cyber, or whichever buzz word you wish to use today. Understanding these truths and how to balance them is key to success. Balancing them may mean planning your own time or the size and structure of your team, depending on where you work.

Firstly, security is fun. It's fun because you get to learn about and sometimes play with the methods that attackers use. You might even start to feel like someone from Mr Robot, or Wargames at times. Some might call this ethical hacking, some penetrating testing, and some may think it's just an excuse to have fun. In any case it is valuable. The key is to not spend too much time or resource on the fun stuff otherwise other areas may suffer.

Secondly, security is easy. By that, I mean it is much easier to look at a system or process and find fault with it than it is to do it right yourself. This is a basic truth in life and recognising it is a differentiating factor when dealing with others. They will feel threatened because you are criticising they way they work or pointing out mistakes that they have made in the past. The key is to make sure they understand that in this respect, their job is harder than yours and they deserve some credit for that.

Thirdly, security is hard. The main reasons for this are twofold. Firstly, related to the second truth, you will often have to overcome the inertia of cultural and behavioural change. This is one of the hardest things to accomplish unless your organisation is prepared to take harsh action against offenders (which in itself can be morally difficult). You will likely make more adversaries than allies. Secondly, when it comes to protecting your organisation from attackers, they have the upper hand. In this setting you have the same challenge that your non-security colleagues have, in that it is easier for someone else to find fault in your security measures than it is for you to get them right. You could easily blame this on your internal challenges, but this is part of your job so you need to suck it up and get on with it. Dealing with these challenges will take constant readjustment of your strategy as you discover more about the organisation's technology, processes, structure, and culture. The key is to not become disheartened when a particular strategy fails. You must be objective and analytical and find out why it failed. Sometimes you are best off to take a step back or some time out to relax and think about something else. Get some exercise and fresh air, or spend some time on your favourite pastime. Sometimes new potential solutions come to me while I'm walking the dog, climbing, or playing the guitar. Of course not all challenges will afford you this luxury of time for problem solving, but some certainly will.

Finally, security is rewarding. By that I mean the harder you have to work at something, the more satisfaction you get when you achieve even small successes. Would it be more fun if security was easy and you had more time to experiment and learn new and exciting techniques? Maybe... But the rewards from winning small battles in this ongoing conflict make it extremely worthwhile and satisfying. The key is to have patience and enjoy the smaller successes that you achieve along the way, because if you want to achieve too much too quickly, you will become frustrated, disheartened, and doubtful. Trust me, I've been there and got the scars to prove it.

I hope this gives some insight into what it is like to be a security officer at a medium-sized international enterprise. Maybe your own experience is different to mine, in which case I would love to hear from you!

Soft Security is Hard

When I was first asked if I wanted to do security as my main job, I was warned that it would be highly policy based and governance focused; very different to my hands on technical background. I was also told that it would be a great challenge. Having done this for a (little) while now, I can firmly say that those initial warnings were a huge understatement.

Further to this, I noted at pretty much every security seminar or conference that I go to that the recurring theme was that people were the biggest risk. Or more precisely, people are the biggest challenge.

All of this has started to sink into place. You can have the best technology in the world but if the people who use it want to circumvent technical security controls then they will find a way, whether it be to steal data, or just out of pure laziness. Does any of the below ring any bells?

"We've always done it this way...", "...we're not a bank...", "...it's the only password I can remember...", "...we're too busy..." "... we've never had a breach before...", "...yada, yada, yada...".

Setting policy to match the risk profile and appetite of a business is one thing. Overcoming cultural and organisational change in order to implement policy is something else altogether. It requires complete buy in and sponsorship from the top. Even with this advantage, it takes phenomenal time, effort, patience, and resilience. Amongst the success and progress there are many setbacks and obstacles to overcome whether they be due to competing for resources with commercial projects, or general politics, egos, and bullshit.

Apart from a good technical understanding of threats, vulnerabilities, risk, and treatment options, I would say that the most important attribute for a full time security manager is a healthy balance between resilience and patience. To paraphrase the quote: you must have the courage to change the things that you can, grace to accept the things that you can't, and wisdom to know the difference.

I would add to this "...and the resilience and patience to recognise those things that must be changed but have to wait".

Of course, if you are lucky enough to have a great mentor and an energetic and enthusiastic team, then the odds are more in your favour!

It also helps, in more ways than one, to keep that hands on time whenever possible. In developing defences it is essential to have an understanding of the attacks. This means getting involved with incident responses, finding out what malware is doing in safe environments, simulating your own MITM attacks in a variety of situations, running your own phishing campaigns against your organisation, and cracking passwords, for example.

Understanding the technical and social engineering methods in use by external attackers and insiders allows you to prioritise treatments in your mitigation strategy, and understand where your vulnerabilities are when organisations push back on recommendations due to time, budget, or politics.

The saying is that security is a journey and not a destination. This is true because of two factors: the ever evolving threat landscape, and users' defiant urge to do things their own way and ignore policy and process.

So, good luck on this journey because we are all going to need it! This isn't intended to sound as pessimistic or defeatist as it may. If you enjoy a challenge then you are in the right place! And there will always be a job to do.

I'll be posting some of the tips, tricks, and strategies that have resulted in success in this space in the future, so keep yourself posted.