The cheapest control can be removing the feature
Sometimes the answer is not to protect the thing but to stop having it.
The export nobody uses, the legacy integration, the field collected in case it became useful. Removal costs nothing to run, cannot be misconfigured and needs no monitoring. It is rarely proposed because building is rewarded and deleting is not, and it is frequently the best available option.
More on Security leadership and economics
- Security competes for finite organisational attentionEverything else is on the same bench
- Security spend should follow risk concentrationThe same trickle everywhere
- Security creates option value during incidentsThe siding was laid years ago
- Security debt is borrowed future effortStill tied on
- Executive decisions need ranges, not false precisionMeasure the width
- Security strategy means not protecting everything equallyYou only have so much fence