The true problem is that the world is addicted to additive security. "What can we add to make our systems more secure?" Since the InfoSec industry sprung from t

The true problem is that the world is addicted to additive security. "What can we add to make our systems more secure?" Since the InfoSec industry sprung from the IT industry, the financial incentives are backwards. At the moment, people pay for security solutions that add complexity. Walk the floor in any commercial security conference and you will find these to be the most prevalent. "Take my tech" is the mantra. If people only paid for security solutions that remove complexity, then it would be a very different story. "Let me do away with your complexity" would be the better mantra. Albeit a gross simplification, the industry must flip the script to subtractive security, asking what can we remove or revise to make our systems more secure. Same thinking afflicts consumer devices. New IoT device? Which known-good security validated and battle tested software stack is the vendor reusing? Oh, your own homebrew stack that phones home? How novel! You mean you slapped on whatever it took to ship? Terrific! There is a bug in ROM with no way to securely remediate? Shocking! /s