Thread by @jschauma

I kinda feel like there's an #infosec equivalent to Brooks's Law: hiring more infosec people does not make an organization (or project) more secure. Likewise, mirroring complexity, I think we have accidental as well as essential insecurity.

We often measure #infosec team success or impact via navel gazing: how many vulnerabilities we identified, how many open ports we found, how many AWS tokens we found in git.

The remedies? Build more tools to detect more stuff, deploy more agents, create more dashboards, tickets, metrics. All that requires more people, so our headcount requests go up.

Let's leave aside the entire discussion of teams and organizations basing self-value on team size, the competition for headcount within a company, and all the Peter Principle tangents.

Finding more vulns etc. does not make you more secure.

Now imagine that you got N headcount approved for your team. How much will you be able to reduce the overall risk, and in what time frame? Is #infosec headcount the most efficient way for the company to reduce the risks you’ve identified?

Suppose instead of getting headcount for your team to beef up scanning, vulnerability management & remediation you had the infrastructure folks invest into fully automated, frequent OS & software updates - which investment would pay off more in both the short and the long run?

More generally speaking, I believe that all too often the security teams are mostly addressing accidental insecurity, while fixing essential insecurity requires cross-company efforts and possibly changes in business strategy:

Accidental insecurity: an old CVE pwns you hard.
Essential insecurity: your systems don't auto-update.

Instead of focussing on detecting vulnerable systems (often run under #infosec), add resources to auto-updating (usually run under infrastructure/product).

Accidental insecurity: your developers access tokens are compromised.
Essential insecurity: you still require interactive login capabilities and privileged accounts.

Instead of spending money on hardening your auth flows, consider working towards not requiring logins?

Accidental insecurity: your users' PII is stolen.
Essential insecurity: you have a need to collect and retain users’ PII.

Instead of spending ever increasing amounts of money on failing to protect it, can you work to reduce the amount you have?

I'm not saying the answers are obvious, the solutions trivial, but I do think the questions are worth asking. Unfortunately, that requires putting the larger org above your immediate team; that's often unpopular. But you didn't get into #infosec for popularity, now, did you? :-)