Can’t see the forest for the trees

One reason taking action on security is hard, is that there are basically unlimited things to do. Wherever you look there is a potential action to be taken.

My personal approach was always to apply my security judgment judiciously at whatever task I was just working on and not feel like the rest was my issue particularly. Which means an application could end up with a proper secret store and very tight least privilege cloud credentials but completely out of date dependencies because that was not in scope of the current project. What was lacking was a process outliving the task at hand.

Imagine planes or operating rooms were run this way. I am sure every doctor also knows that amputating the correct leg is paramount, but hospitals have found out in quite macabre ways that you still need to make them follow a checklist if you want to avoid people ending up without any legs.

The trees - what you focus on

In my experience everyone first focuses on the thing most related to their immediate job responsibilities. Developers add a security update, operations will add a password policy to the Google workspace and everything in between will fall through the cracks.

Even in security minded organizations there is no guarantee that you will cover the whole landscape because each of the areas has basically unlimited depth.

Reasonable people can disagree on update frequencies, review policies and dependency cooldowns. Passwords can be augmented by two factor auth or password managers, each coming in many flavors.

The forest - what you ignore

Unfortunately security does not reward specialization.

It doesn’t matter how tight you password handling is, if your developers install a package from a poisoned source willingly and vice versa even manual review of every dependency update will not save you if someone added a database account with a weak password and exposed it to the internet.

Just like your doctor will not be impressed with you recently adding chia seed pudding to your diet if you are still smoking.

You need to get to goodenough security in all areas, not world class1 security in one.

The map - what you need

Additionally security is a process, vigilance needs to be eternal. This means we cannot model security as a point in time problem that we allocate funds to solve to once.

It is a continues process that needs to be kept running. Most security issues arise not because of initially stupid choices but because following best practices are optional and things are forgotten the third time someone should do it.

This is why you need a good enoughsecurity process - a map of the forest to tell you what to do