Cutting costs: maximizing results

Since the 90s there seems to be a never-ending mystery to the achievement of successful cybersecurity. I have spoken to this numerous times at many different events. The sad reality to putting in place a good cybersecurity program can be easier then most think.

The failure of most organizations is that money translates into security or that the "investment" in "best of breed" software or components is the key to protecting the environment. Once during a review of an organization I was impressed with all the documentation and protections that were in place around the servers, software, and even the facility that housed it. Millions of dollars was proudly spent. Even the help desk that was contracted had tight controls limiting cell phone use and even the paper a technician used was logged and turned in after each shift.

In the end, I gained access quickly, quietly and simply. The software programmers were in another facility that had very little controls on their network, servers, and laptops. A simple message about the upcoming birthday party for the cute front desk lady instantly made all the work, money, and time useless.

In the special operations community there is a saying, "Slow is smooth and smooth is fast". A constant reminder that energy spent quickly to be successful is wasted. Days, weeks, or even months go into the planning, coordination, and rehearsal of an operation that may take hours or minutes. The neutralizing and successful take over of a ship can be as fast as 10 seconds.

When it comes to Cybersecurity knowing your weaknesses and developing your responses means reducing the time to act. Why waste more money on tools when what is really needed is a strategy that your team can practice to be successful as well as give you quantitative results to show the board a "return of investment" (ROI). Something that always seems hard and mysterious in the realm of cybersecurity.

#costefficiency #returns