97 Things Every Information Security Professional Should Know

Chapter 42. Failing Spectacularly

Kelly Shortridge

We all would love to eradicate failure in our systems, but it is impossible. We will never eliminate all vulnerabilities in software, remove the potential for abuse in all intended functionality, nor ensure humans do not make mistakes that jeopardize security in the course of their work. Any security program built on those quixotic assumptions will inevitably fail. Instead, we must prioritize our capacity to be resilient to failure.

When the mission is to stop any failure from happening, there is no room for innovation. This mission is why we see too many security practitioners pretending that revenue, profit, and other business concerns are irrelevant to their work. When security views itself as a separate, noble entity from the rest of the business, colleagues are transformed from potential collaborators into potential bad apples or rivals. It means that security strategies, tools, architectures, and policies ignore business concerns, resulting in the self-fulfilling prophecy of other teams “not caring” about this intrusive, inefficient security.

Security practitioners are not exempt from propelling business success. A successful long-term business is one that can weather failure gracefully and come out stronger for it. A business that avoids failure at all costs inevitably stagnates, as there is no room for risk to pursue growth ...