Following my post on PAM without PAW, a broader point for management.<\/p>\n
Few organisations have unlimited security budgets. Most have far less than they need, in money, people and time. That makes every investment that doesn\u00b4t actually reduce risk doubly expensive. You pay for the solution, and you lose the protection you could have bought instead.<\/p>\n
I see it often. A PAM bought before the admin devices were secured. An advanced threat intelligence feed for a SOC that doesn\u00b4t have time to read its alerts. A new firewall while the domain admins still read their mail with their admin accounts. Each of them made sense on a slide. None of them stopped the attack that came.<\/p>\n
Zero Trust is a good tool to prioritise. Ask three questions about every investment. Does it help us verify explicitly, so a stolen password isn\u00b4t enough? Does it reduce privilege, so one compromised account can\u00b4t reach everything? Does it help us assume breach, so we detect and contain an attacker fast? Then ask which of the three is weakest today, and spend there first.<\/p>\n
And be strict about the order. Foundations before advanced features. Devices before vaults. Basic hygiene before exotic detections.<\/p>\n
With a small budget, the hardest thing is saying no. Do it anyway.<\/p>\n","protected":false},"excerpt":{"rendered":"
Following my post on PAM without PAW, a broader point for management. Few organisations have unlimited security budgets. Most have far less than they need, in money, people and time. That makes every investment that doesn\u00b4t actually reduce risk doubly expensive. You pay for the solution, and you lose the protection you could have bought […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[11,4],"tags":[38,95,23],"class_list":["post-1370","post","type-post","status-publish","format-standard","hentry","category-business","category-security-architecture","tag-business","tag-prioritisation","tag-zero-trust"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1370","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1370"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1370\/revisions"}],"predecessor-version":[{"id":1396,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1370\/revisions\/1396"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1370"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1370"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1370"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}