In well-run companies, the corporate finance organisation does far more than merely controlling costs. Instead, they focus on ensuring that financial resources are put to the best possible use to grow the business. I try to apply that same mindset in my security work by building solutions that help to connect companies with their customers while protecting everyone's best interests. Security should be about building bridges, not raising walls.
Every company and organisation has an unique set of security needs, but size and stage of growth are significant influencers on how they respond to the threats they face. I have had the privilege of working with and advising a wide variety of companies, from startups to multi-national enterprises, and even cloud providers themselves. While there is naturally a great deal of variation between their approaches to security, one thing remains true for all; incorporating security in the earliest phases of designing products and services drastically improves the most precious feature of all: customer trust.
Early in my career, Amy Wendland, my long-time mentor, showed me that leadership is not about having all the answers or being the smartest person in the room. The best leaders create a safe environment for their teams to innovate, challenge them to share ideas for improvement, and distill those ideas into a clear vision. In short, leadership is about communication - a skill that I have spent years developing and will forever try to improve.
Security has become a board-level concern for nearly every modern company, which makes it essential that the security organisation embeds itself in every part of every business unit. Security-related features are some of the first and most important selling points asked about during the sales cycle. Much of my role at Amazon Web Services (AWS) involved direct customer interaction both pre- and post-sales. My biggest take-away from that experience is that nearly every customer question about security features comes with an implicit request for ideas on how best to use those features to build trust with their own customers. Vendors who deliver security strategies along with features have a significant advantage in the marketplace.
I am a technologist at heart, and most of my career has involved some amount of designing infrastructure critical to my company's or customers' business. Specific languages, products, and methodologies change with time, but fundamental design concepts for successful systems remain the same:
- Designing for flexibility has little up-front cost and tremendous future benefit
- Features are not features if they are unreliable
- "Security" is a set of design requirements and should be built in, not bolted onto the outside of a system
I have made it my mission to advance the state of the art of security as a practice and to help anyone who wants to enter the field achieve their goals. The security field faces two major challenges:
- a shocking and unacceptable lack of diversity
- a dangerous shortage of skilled workers
The world's public sector education systems continue to address inadequately the skills gap. Private companies have a twisted idea of what entry level means for security jobs.