Security strategy means not protecting everything equally
A strategy that protects everything equally is a budget allocation, not a strategy.
Strategy is choosing what to do badly. Deciding that certain systems get a lower standard, deliberately and with somebody accountable, is what makes it possible to do a genuinely good job on the ones that matter. Refusing to choose produces uniform mediocrity and calls it coverage.
More on Security leadership and economics
- Security competes for finite organisational attentionEverything else is on the same bench
- Security spend should follow risk concentrationThe same trickle everywhere
- Security creates option value during incidentsThe siding was laid years ago
- The cheapest control can be removing the featureUnbolt it and the rest goes too
- Security debt is borrowed future effortStill tied on
- Executive decisions need ranges, not false precisionMeasure the width