2 ms·

I just read the book The Phoenix Project. It's over a decade old so some of the principles are obvious/quaint at this point, or perhaps not quite as applicable.

I just read the book The Phoenix Project. It's over a decade old so some of the principles are obvious/quaint at this point, or perhaps not quite as applicable. That said, one of the things that caught me off guard is the dressing down of the head of security by a member of the board. More or less, they were told what they did was clog the flow of useful work. The message conveyed is similar to this post.

alsetmusic 2y ago
> More or less, they were told what they did was clog the flow of useful work. Similar to seeing IT as a cost rather than a benefit.
TeMPOraL 2y ago
> More or less, they were told what they did was clog the flow of useful work. That sounds like a very valid complaint, too rarely heard these days. People seem to forget that security always comes at a cost, so security decisions are always trade-offs. The only perfectly secure system is the one that does absolutely nothing at all. Does forcing everyone's machine to run real-time scans on all file I/O improves our security more than it costs us in crippling all software devs? Maybe. Being on the receiving end of such policies, including this particular one, I sometimes doubt this question was even asked, much less that someone bothered to estimate the expected loss on both sides of the equation. Ignoring the risks doesn't make them go away, but neither do costs go away when you pretend they don't exist.
- deleted 2y ago
  [deleted]
too_pricey 2y ago
The Phoenix Project has been very influential on me in my security career, at least partially because I share the name of the ineffectual CISO and want so desperately to avoid the link. I think the book is still very applicable, and every security practitioner needs to be hit over the head with it (or at least The DevOps Handbook or Accelerate). Security generally is decades behind engineering operations, even though security is basically just a more paranoid lens for doing engineering ops; the ideas from Phoenix are still depressingly revolutionary in my field.
eYrKEC2 2y ago
Security is always an economic activity too. The crash engrs at Ford could demand 30 mph speed governers, quarter inch steel plates, 5 point harnesses, and helmets, but people need a car that costs less than $200k and gets more than 2 miles per gallon. Sometimes security requirements _are_ too onerous.

alsetmusic 2y ago

> More or less, they were told what they did was clog the flow of useful work. Similar to seeing IT as a cost rather than a benefit.

TeMPOraL 2y ago

> More or less, they were told what they did was clog the flow of useful work. That sounds like a very valid complaint, too rarely heard these days. People seem to forget that security always comes at a cost, so security decisions are always trade-offs. The only perfectly secure system is the one that does absolutely nothing at all. Does forcing everyone's machine to run real-time scans on all file I/O improves our security more than it costs us in crippling all software devs? Maybe. Being on the receiving end of such policies, including this particular one, I sometimes doubt this question was even asked, much less that someone bothered to estimate the expected loss on both sides of the equation. Ignoring the risks doesn't make them go away, but neither do costs go away when you pretend they don't exist.

deleted 2y ago
[deleted]

too_pricey 2y ago

The Phoenix Project has been very influential on me in my security career, at least partially because I share the name of the ineffectual CISO and want so desperately to avoid the link. I think the book is still very applicable, and every security practitioner needs to be hit over the head with it (or at least The DevOps Handbook or Accelerate). Security generally is decades behind engineering operations, even though security is basically just a more paranoid lens for doing engineering ops; the ideas from Phoenix are still depressingly revolutionary in my field.

eYrKEC2 2y ago

Security is always an economic activity too. The crash engrs at Ford could demand 30 mph speed governers, quarter inch steel plates, 5 point harnesses, and helmets, but people need a car that costs less than $200k and gets more than 2 miles per gallon. Sometimes security requirements _are_ too onerous.