The spreadsheet of doom
Feb 5th, 2021 by Jesper Kråkhede
There is one moment every security architect fears. You arrive at a new customer, you ask about their requirements and someone proudly opens a spreadsheet.
It has every regulation and standard the company needs to follow mapped against each other. ISO 27001, NIST, GDPR, the industry regulator, a couple of customer contracts. Hundreds of rows, each with a requirement, and a column of rules that everyone must follow so that the company is compliant by default.
It looks great. It is a nightmare.
Here is why. Every row becomes a rule, every rule must be implemented on every system and every exception must be approved. The rules come from different standards with different wording, so half of them overlap and some contradict each other. Nobody can tell you which threat a specific rule is meant to stop. And when a new project wants to build something, it has to go through all of it before it can even start.
So everything takes a very long time, and it rarely ends up right. Teams either give up and ask for exceptions, or implement the rules literally without understanding them.
The fix is to turn it around. Start with a small set of technical security patterns that you know stop real attacks. Then map the requirements to the patterns, not the other way around.
One good pattern can satisfy fifty rows in a spreadsheet.