,
4 tweets,
1 min read
Read on Twitter
Tweeting an IRL rant from the last week, the biggest reason that many orgs are having trouble keeping up with cybersecurity IMHO is that attack surface scales with software, but their security orgs try to secure it by scaling with human toil. That's the opposite of leverage.
Until we treat securing the org as a problem that we build and maintain custom in-house software to manage, we'll fail to keep up. That means treating security experts as product owners for cross-functional agile software engineering teams that own security management systems.
The problem with toil is that it's addictive. You feel like you are making progress because you are busy fighting fires. But it doesn't scale and when you take a few steps back, you can see that you aren't keeping up. You have to measure and cap toil time to be able to engineer.
The most controversial point is that if your security team is created from people who prefer toil to writing code, you'll never be able to scale with software. The reason there is a cybersecurity skills shortage is because we've been selecting for skills rooted against scaling.
