(Originally posted on LinkedIn on September 30th 2014)
It is a Journey
What is security? How can I be secure? How will I know my systems are secure? I was compliant with the regulations, how was I able to be hacked?
Over the years these questions have come up in one form or another. Now the conversations have been with different people and in different contexts. At first I was a bit dismayed that we are still struggling with the concept of security but the more I thought about it the more I welcomed the opportunity to address this topic.
Let’s face it, most, if not all, of us are results oriented people. We like to have tasks with a clearly defined start, clearly defined milestones, and a clearly defined ending. The problem is that information security doesn’t fit this model of the world. It isn’t so much a state as it is a state of mind.
We are what we repeatedly do. Excellence, then, is not an act, but a habit.~ Aristotle
The only truly secure system is one that is powered off, cast in a block of concrete and sealed in a lead-lined room with armed guards - and even then I have my doubts.
~ Dr. Eugene Spafford
And the second, may be original. I’m not sure if I made this one up or if I heard it somewhere. I’ll claim it for now but if anyone can cite another source please let me know. Either way I think it is an accurate depiction of our goal to seek a totally secure system.
Imagine a line with a point on either end. Point A is a totally insecure system and Point B is the theoretical totally secure system. As we start our journey from Point A to Point B the furthest we can travel is half the distance. That is the best we can do so we travel half way, then half way again, then halfway again. If we keep going half the distance between where we are and Point B we will never actually reach Point B. Granted we are a lot closer than we were when we started but we still never reach our destination. Since we can never really reach our destination we must focus on the journey itself. Information Security is like that.
~ Graydon McKee