Originally cyber security was just an afterthought. Something to be added on later to networks, protocols, software, and hardware. No matter what happens, security is always secondary. It creates limits, slows down both deployment and development, and yet it is so critical. Yes, there is a call to be proactive, but the reality is that will likely never be possible.
Don’t get me wrong, we have gotten better. SDLC, secure initiatives, micro segmentation and more have brought us a long way. Security is thought about in many instances, but it is still all reactionary. You design, develop and deploy in a more secure manor, but that was a reaction, due to past issues. Patches still happen, flaws still found, and cost(hardware, software or personnel) prohibits better security. We do what we can.
Then there is the realization that security is a journey not a destination, which is not what the executives and board want to hear. The journey costs more, and there is no way to truly stay a step ahead. It is all mitigation of some sort, and everything can be gotten around. There is no magic button. Attackers have the advantage, not because you have to secure everything, but because they have no rules. The world of AI is starting to realize this. In fact, if some countries regulate AI, it doesn’t mean it is any safer, as countries that don’t have those regulations will have no rules. Just look at what Hugging Face had to use when thy had gotten breached by an AI.
All security is a best effort. Figure out where you are weak and strengthen it or find a way to mitigate it. We get tested and repeat. All reactionary to the idea that we might get breached. Even if back when the internet was created, when the protocols written, if security was “baked in” we still wouldn’t be secure, because there is always a way around. It is a matter of time and patience.
So, when your executives want to be more proactive about security, nod and say sure. Do what you can, but understand it is all a reaction, and in this case a reaction to the executive’s desire to not wind up having to talk about a breach. You can always be more secure, and fight the good fight, and win battles, and wars, but in the end, it is all reactionary.
Does it mean that it is not worth it? Of course not. In fact, ask any law enforcement officer if they think stopping criminals is not worth it. It is the same thing. We have been trying to be secure since the dawn of time. The digital world is no different. So are you in, or out?