3 ms·

> These hypothetical scenarios are not anchored with the language that most businesses will understand: cost. I've argued this to well-placed people in two For

> These hypothetical scenarios are not anchored with the language that most businesses will understand: cost. I've argued this to well-placed people in two Fortune 250 companies. At the first place, the conversation led to a cleanup up the IT policies, so that they were more consistent and reasonable, but they still weren't grounded in reality. The reaction at the second place has caused me to realize that IT security -- like everything else at a company -- is just another political game of thrones. Aggressive people are trying to work their way up the ladder, and increase the size of their internal kingdoms. They use scary language to leverage fear in upper management to drive ever-larger budgets and ever-more inconvenience in the name of "security" which winds up being little more than security theater. If there's a Fortune-sized company out there which actually makes IT security decisions based on practical consideration of risk vs. cost, I'd love to know. My current belief is that, by the time you get this big, there's too much disconnection between the IT department(s) and everyone else to align the incentives.

indymike 6y ago
The hardest thing to come to grips with in security is that you are dealing with large(ish) groups of people.
freeone3000 6y ago
Microsoft seems to do pretty well, at least in the sense their security is effective and still allows people to get work done. Lots of effort put into policy automation so it's easier to comply with policy than not.
- ethbr0 6y ago
  The problem with IT security orgs is that they get to estimate the costs of not following their own recommendations. Which trend towards infinity, because... well, they want the thing they're advocating for to happen. This tends to attract toxic, political people who thrive in this sort of environment, and push out more reasonable, technical people who don't want to deal with that. At some point, you get a critical mass of toxic IT security managers covering each other... and then everyone starts ignoring and/or hating security. The real loss is that most IT security orgs I've seen are extremely deficient in developers. The kind of person you actually need to automate things, so that they're quicker, so that people use them, so that the organization is more secure. :(
  - staticassertion 6y ago
    I don't really see it that way. From my perspective it isn't toxicity as the driver, but a strong sense of user preservation. Many people I know in security value the customers more than they value the company itself. They're the antithesis of political - their inability to understand higher order company-level or product-level issues often hamstrings them because their goals aren't aligned with the company goals. Though I have a limited view - I'm sure there are many companies that are operating as you've said. The teams I really strongly respect, for example at Square/Microsoft, manage to align user interest and company interest very well - that's a very hard thing to do and requires top to bottom investment. Microsoft's approach has been to monetize security, which makes that easier. Both organizations also have resisted the mistake that you and I both agree most orgs make - they've invested heavily into hiring engineers to solve security problems, and you generally have to pass a coding interview even for security roles. edit: Reflecting more, I suspect that the described behavior of hyper-political teams that have a self-preserving structure is probably something prevalent, but that I haven't had the misfortune of being involved in. I would imagine companies like that are generally toxic across orgs, and not just in IT, but probably any area where investment is forced and it isn't revenue-generating.
    - ethbr0 6y ago
      Clarification, in my context I'm typically talking about the IT Security and employee relationship. But the dynamics you outline still hold, although my experience has been reverse (they value what they perceive as "the company" over employees). > I would imagine companies like that are generally toxic across orgs, and not just in IT, but probably any area where investment is forced and it isn't revenue-generating I'd agree this is probably a key contributing factor. It's been my fortune / misfortune to work for a number of companies that qualify (healthcare, financial, insurance). But it has also been true (in my much more limited experience) with healthier, IT-as-profit-center companies. I'd hazard better framing (than profit/cost center) might be "incentivized to improve" vs "penalized for mistakes." Unless it's the former, it's in no one's personal interest to go above and beyond or suggest change. So you get glacial, incremental processes, and lose people who are impatient with working that way. As you note, I think monetizing security is a key step to establishing a healthier balance.

indymike 6y ago

The hardest thing to come to grips with in security is that you are dealing with large(ish) groups of people.

freeone3000 6y ago

Microsoft seems to do pretty well, at least in the sense their security is effective and still allows people to get work done. Lots of effort put into policy automation so it's easier to comply with policy than not.

ethbr0 6y ago
The problem with IT security orgs is that they get to estimate the costs of not following their own recommendations. Which trend towards infinity, because... well, they want the thing they're advocating for to happen. This tends to attract toxic, political people who thrive in this sort of environment, and push out more reasonable, technical people who don't want to deal with that. At some point, you get a critical mass of toxic IT security managers covering each other... and then everyone starts ignoring and/or hating security. The real loss is that most IT security orgs I've seen are extremely deficient in developers. The kind of person you actually need to automate things, so that they're quicker, so that people use them, so that the organization is more secure. :(
- staticassertion 6y ago
  I don't really see it that way. From my perspective it isn't toxicity as the driver, but a strong sense of user preservation. Many people I know in security value the customers more than they value the company itself. They're the antithesis of political - their inability to understand higher order company-level or product-level issues often hamstrings them because their goals aren't aligned with the company goals. Though I have a limited view - I'm sure there are many companies that are operating as you've said. The teams I really strongly respect, for example at Square/Microsoft, manage to align user interest and company interest very well - that's a very hard thing to do and requires top to bottom investment. Microsoft's approach has been to monetize security, which makes that easier. Both organizations also have resisted the mistake that you and I both agree most orgs make - they've invested heavily into hiring engineers to solve security problems, and you generally have to pass a coding interview even for security roles. edit: Reflecting more, I suspect that the described behavior of hyper-political teams that have a self-preserving structure is probably something prevalent, but that I haven't had the misfortune of being involved in. I would imagine companies like that are generally toxic across orgs, and not just in IT, but probably any area where investment is forced and it isn't revenue-generating.
  - ethbr0 6y ago
    Clarification, in my context I'm typically talking about the IT Security and employee relationship. But the dynamics you outline still hold, although my experience has been reverse (they value what they perceive as "the company" over employees). > I would imagine companies like that are generally toxic across orgs, and not just in IT, but probably any area where investment is forced and it isn't revenue-generating I'd agree this is probably a key contributing factor. It's been my fortune / misfortune to work for a number of companies that qualify (healthcare, financial, insurance). But it has also been true (in my much more limited experience) with healthier, IT-as-profit-center companies. I'd hazard better framing (than profit/cost center) might be "incentivized to improve" vs "penalized for mistakes." Unless it's the former, it's in no one's personal interest to go above and beyond or suggest change. So you get glacial, incremental processes, and lose people who are impatient with working that way. As you note, I think monetizing security is a key step to establishing a healthier balance.