Importance Of Awareness, Automation And Relationship For Security Assurance

Recently we were interviewing for an entry level Information security analyst position and a candidate asked me, “With the really long time you’ve been in security, what changes have you seen over the last 22 years?” After getting past the feeling of being old, I told her that back in the daysecurity was all about blocking and preventing. It made relationships difficult and prohibited the business from performing to its maximum. As a security community we realized that stopping the business was not ideal for the success of the company or our careers, so we began loosening controls and improving monitoring. This moved the focus of the five elements of the NIST framework from Prevent to Detect. We still tried to prevent where we could but attackers were too far ahead of securityprograms so weagain moved the focus from Detect to Quickly Detect to limit the amount of time an adversary was in the environment. The concern is that controls will continue to loosen to allow the business to prevail but staying on this path could lead to a security program that is meaningless or non-existent. In the end, teams may revert back to the days of blocking everything to stop the bleeding and reassess their effectiveness, which nobody wants.