3 ms·

I've worked in a shop where InfoSec tried to be the Department of Yes. They were very effective at that - they basically never said "No" to anything. The downsi

by Kalium 7y ago

I've worked in a shop where InfoSec tried to be the Department of Yes. They were very effective at that - they basically never said "No" to anything. The downside was that they weren't actually able to say "No" to the things that they really needed to be able to change. A lack of accountability for decisions meant that people could ignore InfoSec consequence-free. All told, I've learned that security needs to have the ability to say "No" and the organizational backing to make it stick. It's the implicit threat that makes other groups play ball. I've had at best mixed results with covering people with positivity and admiration in an effort to get them to fix things. It's often easy enough when it's something really small that looks easy and understandable. When you've got a whole architecture predicated on everything accessing everything unchecked, suggesting that maybe this absolutely amazing architecture could be even better with a tiny bit of TLS and authentication is unlikely to get you anywhere.

dogman144 7y ago
That's my fault for not clarifying, good point. Not being Dept No != Being Dept Yes. It's really not about fluffing them up with admiration (they'll see through that soon enough). It's more about figuring out what the overarching mission of the enterprise is, that in turn dev, ops, sales, hr/accounting, biz dev, and sec all have to work towards (and largely want to, under the frame of doing a good job, and assuming it's not a toxic, failing workplace), and explaining for security under that premise. This gets you a (1) way to couch sec in the 'doing a good job' language, and (2) gives you firepower with mgmt if you're told to fuck off by XYZ dev, as ultimately: business mission wins. So make your sec = business mission. Avoiding 'No' is about approaching how you sell, implement and get buy-in for lasting behavior/process change. It takes a tremendous amount of work that goes beyond a hacker news comment box, but leadership + organizational awareness are pretty key in that regard.

by Kalium 7y ago

dogman144 7y ago

That's my fault for not clarifying, good point. Not being Dept No != Being Dept Yes. It's really not about fluffing them up with admiration (they'll see through that soon enough). It's more about figuring out what the overarching mission of the enterprise is, that in turn dev, ops, sales, hr/accounting, biz dev, and sec all have to work towards (and largely want to, under the frame of doing a good job, and assuming it's not a toxic, failing workplace), and explaining for security under that premise. This gets you a (1) way to couch sec in the 'doing a good job' language, and (2) gives you firepower with mgmt if you're told to fuck off by XYZ dev, as ultimately: business mission wins. So make your sec = business mission. Avoiding 'No' is about approaching how you sell, implement and get buy-in for lasting behavior/process change. It takes a tremendous amount of work that goes beyond a hacker news comment box, but leadership + organizational awareness are pretty key in that regard.