Old rules, old decisions, old mistakes, new costs
Nov 20th, 2022 by Jesper Kråkhede
Something I see in almost every organisation I work with: security rules and decisions that made sense once and nobody has questioned since.
Passwords that must be changed every 60 days, which only makes people choose weaker passwords with a number at the end. A firewall rule opened for a project that ended in 2015. An exception for an old system that was supposed to be replaced ‘next year’ for the last eight years. A policy that requires all admin work to be done on-premises, written before half the environment moved to the cloud.
Each of these was a decision someone made for good reasons. The problem is that the world changed and the decisions didn´t. And every one of them costs something today. In security, because old rules leave gaps that modern attackers exploit. In money, because old exceptions and old systems are expensive to maintain and protect. And in productivity, because outdated rules make life harder for everyone without making anyone safer.
So for management: Put an expiry date on security decisions. Every policy, exception and accepted risk should be reviewed at least every few years. Ask what has changed since the decision was made, and if it still makes sense.
You don´t pay for old mistakes once. You keep paying until you fix them.