Paying for security that doesn´t work
Apr 20th, 2023 by Jesper Kråkhede
Following my post on PAM without PAW, a broader point for management.
Few organisations have unlimited security budgets. Most have far less than they need, in money, people and time. That makes every investment that doesn´t actually reduce risk doubly expensive. You pay for the solution, and you lose the protection you could have bought instead.
I see it often. A PAM bought before the admin devices were secured. An advanced threat intelligence feed for a SOC that doesn´t have time to read its alerts. A new firewall while the domain admins still read their mail with their admin accounts. Each of them made sense on a slide. None of them stopped the attack that came.
Zero Trust is a good tool to prioritise. Ask three questions about every investment. Does it help us verify explicitly, so a stolen password isn´t enough? Does it reduce privilege, so one compromised account can´t reach everything? Does it help us assume breach, so we detect and contain an attacker fast? Then ask which of the three is weakest today, and spend there first.
And be strict about the order. Foundations before advanced features. Devices before vaults. Basic hygiene before exotic detections.
With a small budget, the hardest thing is saying no. Do it anyway.