Thread by @webjedi

It still boggles my mind that we will have people flock to conferences about the latest and greatest thing, and then come back to their org wanting to do that latest and greatest, but not be willing to invest in the basic work required to share up and mature the org to fix stuff.

"I want to do $buzzword_tech" while not even taking a moment to possibly get all their systems to a maintainable standard, reliable inventory and maintenance cycle, and repeatable and reliable processes. Again, like building the Burj Khalifa on quicksand. gizmodo.com/without-trucks…

...you're doubling down on resources, and creating exponentially larger piles of tech and process debt that, given the tenure or most tech execs, will not be their problem, as they will be gone by the time the shit tankers run out of places to dump... fix this, then modernize

...I had been thinking last week, positing that we do, in fact, have a finite set of vulns and security issues, bounded only by the number of ways people stick code and system together to solve a problem. It's mathematically solvable... but nobody has the resources to solve it...

...but each new company with a security solution finds a new rube to sell something to, hoping it's the giant beanstalk to riches and the easy life... but rarely is good at solving or helping with the basic triage and response to address that finite set of vulns.

This is the vicious cycle until somebody says enough. Again, sort of that "building an airplane while it's taxiing down the runway"... but nobody is often willing to say it's not flight worthy for the sake of being agile or be ahead of a competitor or meeting an unrealistic goal

Metrics and goals set by folks who do not have a grounding in the inertia required to overcome getting things rolling are doing more harm to an org than those who are rapidly trying to rivet on the wings for flight. Because they are the pilot thinking they can get to SFO by 3pm

as @sawaba said, "do the basics" isn't sexy or has no marketing budget, but possibly it's on the vendors to put some prerequisites down to be an actual partner in their client's success... "wins" tend to stay in the memory longer, sort of a "security endorphin rush"...

@sawaba When doing IR/IH, the memory of those incidents usually only last as long as the folks involved are around, and the same lack of investment, process, and strategy exit with them as does momentum. The capitalizing on how to move your security strategy forward needs this accounting

@sawaba How many news stories of note, that are "ZOMG this thing happened" die in the public conscious unless they are localized moments after their reporting. What have we done with Equifax? Those reports were great, but what has actually changed other than staff and stock prices?

@sawaba .So, when do we stop falling into the slick marketing escapades - and actually have tracks that get people to actually fix stuff? Are there tracks and talks on how to responsibly argue for your budget, develop a maturity model that adapts, carry the post-incident advocacy forward

@sawaba These are central questions I ponder about my future in this career... having been toe deep in essentially all three major senior tech leadership roles... and wonder where my influence and techniques resulted in the most positive change... where is the leverage best applied?

@sawaba CIO - budget and resources
CTO - implementation and operations
CISO - validation and authorization

Each need each other and need to be peers and supportive to a core goal and strategy, w/o that, you will ultimately fail. Nobody is the sole owner of the strategy, TBH

@sawaba ...if you're not getting this, or your org isn't and is out of balance (with one exerting too much sway over another) you will fail miserably in these pursuits. Governance helps with some guardrails, but not to limit the work, but to keep you from boiling the ocean too fast.

@sawaba ...many see it as handcuffs... but it can be the best control valve to have your tech org from doing the "ooh, squirrel" on every new request and whim and actually get stuff done. Or as from "The Right Stuff" - "No bucks, no Buck Rogers" (I have a deck on this)

@sawaba ah, found my deck...this was based on some approaches I did at @WaltDisneyCo as well as at @USTreasury and finally put it in a deck for my current employer when I first got there in 2017 (says FOUO, but it was not that, this was my template and my content)
drive.google.com/file/d/1LzIlvj…

@sawaba @WaltDisneyCo @USTreasury ...incomplete deck, but it was brainstorming (which I do a lot)... about what you really need to do to support innovation in any facet of tech... in some cases, remove tech out of it and focus on resources, capabilities, outcomes and processes in use to optimize & deliver on.

@sawaba @WaltDisneyCo @USTreasury Sorry for the rant... had an off-putting day, but needed to brain dump to do a temp check with you all.

Also: "Friends don't let friends say or use AI or ML without a firm grounding in math and potentially computational linguistics, otherwise it's fantasyland of buzzwords"