When I look back at the incidents I have worked on, very few of them were caused by a lack of money. Most of them were caused by money spent on the wrong things.<\/p>\n
The next generation firewall that nobody configured. The expensive SIEM that collected everything except the logs that mattered. The awareness training for all employees while the domain admins read their mail with the same account they used to manage the domain. The penetration test that found the same issues as last year, which were not fixed because the budget went to the penetration test.<\/p>\n
Why does this happen? Partly because security is hard to understand for the people who decide on the budget, and the vendors are very good at selling. Partly because it is easier to buy a product than to change the way people work. A new box is a project with a start and an end. Making the admins use a separate workstation is a fight.<\/p>\n
So for management: Before you approve the next security investment, ask which known attack it stops, and if there is something cheaper we haven\u00b4t done yet that would stop the same attack. Prioritise the boring things first: patching, admin accounts, backups and identity.<\/p>\n
Do the right things first. Then buy the shiny ones.<\/p>\n","protected":false},"excerpt":{"rendered":"
When I look back at the incidents I have worked on, very few of them were caused by a lack of money. Most of them were caused by money spent on the wrong things. The next generation firewall that nobody configured. The expensive SIEM that collected everything except the logs that mattered. The awareness training […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[11,4],"tags":[38,40,51],"class_list":["post-1222","post","type-post","status-publish","format-standard","hentry","category-business","category-security-architecture","tag-business","tag-risk-management","tag-security-strategy"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1222","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1222"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1222\/revisions"}],"predecessor-version":[{"id":1250,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1222\/revisions\/1250"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1222"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1222"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1222"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}