I have just spent a week in Rome at a Microsoft training on security architecture. Good food, good company and, believe it or not, a lot of good discussions on the difference between architecture and engineering.<\/p>\n
One discussion stuck with me. A colleague asked why so many customers have excellent engineers but still end up with a fragmented security setup. We agreed that the answer is almost always the same: nobody owns the big picture. Each team does a good job in its own area, the network team, the identity team, the endpoint team, but nobody is responsible for how it all fits together.<\/p>\n
That is what a security architect is for. Not to know every product in detail but to make sure that the pieces support each other, that the money goes where the risk is and that the decisions made today don\u00b4t block the ones we need to make in three years.<\/p>\n
For management the lesson is simple. If you don\u00b4t have someone with that role, get one. It doesn\u00b4t have to be a big team. One person with the mandate to say no, and the backing of management when they do, can save you a lot more than they cost.<\/p>\n
And send them on training once in a while. Preferably somewhere with good pasta.<\/p>\n
Architecture is the cheapest security you will ever buy.<\/p>\n","protected":false},"excerpt":{"rendered":"
I have just spent a week in Rome at a Microsoft training on security architecture. Good food, good company and, believe it or not, a lot of good discussions on the difference between architecture and engineering. One discussion stuck with me. A colleague asked why so many customers have excellent engineers but still end up […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[11,10,13],"tags":[38,61,26],"class_list":["post-1205","post","type-post","status-publish","format-standard","hentry","category-business","category-speaker","category-technology","tag-business","tag-competence","tag-security-architecture"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1205","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1205"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1205\/revisions"}],"predecessor-version":[{"id":1233,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1205\/revisions\/1233"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1205"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1205"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1205"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}