The State of Information Security Today

Jeff Man opens with stories from his early career, including government cryptography work in the 1980s and 1990s and one of the first government penetration testing teams. He uses these to set out how the field started, when the job was mostly building firewalls and persuading organisations to take security seriously at all.

He then walks through slides from 1998 that he used when advising companies connecting to the internet. The emphasis was on a holistic program that begins with policy, goals and an understanding of which data is valuable, rather than on buying the best firewall. He argues that many of the same mistakes recur today, such as users clicking links, executives not seeing how security ties to the business, and overreliance on technology. He also questions how the industry uses the terms vulnerability, threat and risk, noting that it concentrates on vulnerabilities while neglecting data classification and the cost trade-offs that risk decisions require.

In closing, he criticises buzzwords and fear-driven marketing, and says compliance often determines what organisations actually do. He names purpose as the missing element alongside people, process and technology. His takeaway for practitioners is to understand why a security measure is needed before buying tools for it, and to keep questioning assumptions.