Thread by @laraghavan

1/6 A thread 🧵on the intersection of #Cybernetics #SystemsThinking #Leadership and #CyberSecurity:

For context, first read this blog by @harish_josev: harishsnotebook.wordpress.com/2021/10/03/tow…

It is AMAZINGLY well-articulated and a MUST read for security practitioners & leaders in general!

2/6 Quote: "... we should stop setting targets and instead, provide a direction to move towards."

Wait, don't manage by goals?

Is a goal-less company/org possible? Yes 🙂
E.g. @basecamp led by @jasonfried

3/6 If you focus on the goals, you'll compromise your means. E.g.: Today's education #system makes kids focus on grades, not on learning .

Basically what is being advocated for is "Management by Means":

https://twitter.com/laraghavan/status/1362782758964129799?s=20

4/6 Related Quote: "... we should see safety in terms of resilience and not as absence of something (accidents, missed days etc.) but rather as the presence of something."

Here is a proposal to operationalize this for #cybersecurity (in an Amazonian fashion 🙂):
cc: @jeffawilke

5/6 Focus on *input variables* (E.g.: Do we have automated XSS & CSRF prevention controls in all of our WebApp Frameworks so that developers don’t have to worry about those vulnerabilities?) instead of *output variables* (E.g.: Zero XSS & CSRF findings in a PenTest or Scan).

6/6 And move the terminology from security controls to control *mechanisms*. A mechanism is a tool or process where you achieve adoption and more importantly is periodically reviewed to see if it is doing its intended job given what's changed over time & if it can be improved.

@threadreaderapp unroll