It's natural to become angry and indignant when we see a major breach story in the news. Many of these potentially affect us and those we know, and often some concern about a potential vulnerability remains left unaddressed by the company in question.
However, as cybersecurity professionals, we also understand (but sometimes lose sight of) a few key facts that the general populace may not know.
We know, for example, that it is virtually impossible to plug every gap, address every vulnerability, and enforce every security procedure. We know that companies must determine the right amount of cyber spending against their other business priorities. While cybersecurity may be our primary focus, core business functions consume the majority of an organization's resources.
We also understand that organizations that deploy strategic security programs do so by willingly assuming an agreed-on level of risk. The goal, of course, is to only accept lower-level risks to the business while mitigating higher-level, core-business-impacting cyber-risks.
Yet even this equation is getting harder to achieve — and we get that. The enterprise attack surface is skyrocketing alongside exponentially growing IT complexity. Organizations are struggling with an ever-expanding security perimeter — it is now every employee with a device — as well as hybrid and multicloud environments, legacy assets, migration initiatives, third-party risk, a patchwork regulatory environment, and IT complexity brought by rapid expansion and M&As. The cloud security challenge alone is compounded by an increasingly complex shared-responsibility model. And the human factor will always be a frailty in the enterprise armor that can never be fully mitigated.
Finally, we realize that despite cybersecurity industry victim blame
