There’s a cultural issue with most security organizations I’ve run into over the past 10 years. Security has never been more important. Vulnerabilities have never been easier to find. And security plays a vital role within an organization. However, the culture of security is consistently opposing the business goals of the organization. I’ve seen this at multiple companies now.
The goal of security should be to safely get the business to its stated objectives. More often than not, security instead puts the onus on the business to prove that what it wants to do is secure. This inhibits growth, unnecessarily slows down development within the business, and creates adversarial relationships that erode morale and culture. Perhaps most importantly, it creates the conditions that, ironically, security is trying to prevent, because people view the security posture as onerous and seek to work around those processes when they can.
Businesses with security postures that say, “If you want to do X with Y and Z tooling, we’ll figure out the way to make it secure,” will be the best positioned in this new era of rapid development potential.