Well, time to be honest with ourselves dear security community. Even if we have firewalls, IDSs, IPSs, antiviruses, SIEMs etc our systems are not secure and will not be secure since there is no such thing as security.
I know some of you are now became angry and thinking cross arguments but seriously think about it. Your work place for example. You have all kinds of good stuff to protect it, motion detectors, glass-break detectors, wired windows, doors etc… But what if a crime organization just break one of the door with a truck at night and now they are inside, can you still think you are secure? There is a level of insecurity. You can decrease that with what you have however when you think about your system you need to think they are insecure for some level.
One of the thing I recently (!) realized is there is balance in the life and most of the time we forget about it. Yes, nothing is secure about this doesn’t mean we need to freak out. This is what risk management for.
If you have two systems and one doesn’t have sensitive data and you have other systems that have data such that if you lose them you will go out of business then take care of the second systems. Don’t get so obsess about the first team so that you forget the important one. You need to protect what you need. I know it sounds sad that you will not pay enough attention for the first system for some cases, but that’s ok.
Security is very hot subject and lots of individuals are coming this area. Most of them are bright, smart people. They want to do their best but we need to give them right expectations of security. We need to secure every single asset as much as we can, as harder as we can. However we should classify those assets and focus on the more important ones. We also should not forget that there is no such things as security…