Suggestions
Erik Bloch
Super security nerd | Security Tinkerer
Erik Bloch is currently an Advisor at Alpha Level, a stealth startup. His LinkedIn profile indicates a focus on technology and security, reflecting his involvement in discussions related to cybersecurity and operational efficiency. He has been active on LinkedIn, sharing insights and engaging with various topics in the tech industry.
In addition to his advisory role, Erik Bloch has contributed to discussions about the future of IT departments and the importance of security operations. His posts often highlight trends and challenges within the tech landscape, showcasing his expertise and thought leadership in the field.
For further details about his professional background and contributions, you can view his LinkedIn profile here .1
Highlights
Just going to leave this here.
🤡🚗
Spicy 🌶️ view: Most security vendors don't know how to use their own tools
Yes, those same vendors who raised millions of dollars, and are most likely asking for a crazy multiyear, 6 to 7-figure contract from you.
Want to test this out? Ask a vendor, after their tool installed and running, how should your team use it? So when it makes an alert or some noise, what should your team do with it? How would they operationalize that data it's giving you?
From my experience, one of two things will happen:
- You'll simply get a blank look 😐
- You'll get a platitude like: "you just integrate it into your existing processes", or some other non-answer. 🤷♂️
You won't get a straightforward answer, because there aren't any. So how did we get here? Simple, because most vendors do not understand how Security teams do work.
Is it their fault? Absolutely not (So don't @ me bro!)
Hard truth: most Security orgs don't have any standards or real processes in place around how we do work, how we operationalize our tooling, or what a real best practice looks like.
Sure a company may have an Incident Response function, but I can 100% without a doubt, guarantee that how Company A does it is vastly different than how Company B does it. So how can we expect vendors to know what the inner workings of the monkey factory look like, when first, we can't describe it ourselves, and second, it's different from place to place?
This brings me to a conversation I recently had a board member of a large public company. He pointed out to me that CISOs are still at the "kids table" compared to their fellow C-level positions. He went onto share that other C-level roles come armed with the data they need to talk the language of business - and they come to every meeting with reliable, repeatable data that they can action. ⚡️
What do CISOs come with? Assumptions, best guesses and possibilities. 🤷♂️ While this data is informative and interesting, it's simply not actionable.
A CFO will come with financial projections for the rest of the year, and show the current financial state of the company. The Head of Sales/CRO can come with projected sales numbers for this quarter and the next, and show you where every deal is in the pipeline and where the company stands today, etc.
Can a CISO do anything like that?
Do we even understand what constitutes actionable data to a board in the first place? Is is resource allocations, or number of events handled each month? Is it high level risks to the company, or info on the latest incident? Again, it varies board to board, as again each team and company does things differently.
So how do we get better? Does the CISO need to "grow up" into a proper C-level role, or does it need to go away, with parts of it being integrated into other teams, or something in the middle? Do they need new/better tooling that enables this? Or are we barking up the wrong tree?
#tinkertribe #soc #secops #cybersecurity
