97 Things Every Information Security Professional Should Know

Chapter 15. It’s Not About the Tools

Chase Pettet

It is demanding feeling responsible for the safety of someone else’s data. Especially when catastrophe is on the near horizon. In order to pursue effective mitigation, we need to communicate to our business the need for response before loss is realized. Arm flailing, chest puffing, and pantomiming are rarely enough to adequately spur the need for proactive resourcing and action. This communication impasse informs a disconnect of purpose that permeates interactions between security professionals and the business. A near miss with the knowledge that our ability to avert the next larger threat is missing can be a dreadful outcome.

In these situations, the practice of information security can feel like a perfunctory corporate mascot of mutually lost faith. This state of ineffectual influence is paved with the perception that the purpose of a security program is to protect the business from itself. This sense is cultivated by feature factory security programs focused primarily on the implementation of technical capabilities and divorced from the ends of the business as a whole. Often the business has imposed this dysfunction by encouraging a security model of last-mile interventions outside of the adopted software development life cycle. While this seemingly allows internal teams to remain naive to the risks their opportunities are ...