Maintenance of Everything : A Review

I haven’t done a book review for a while and there’s no better way to get back to this than a look at Stewart Brand’s Maintenance of Everything. Stewart developed a lot of this book in an open editing process and so the final delivery of what is Part 1 of a forthcoming series was all the more anticipated. 

I’ve long been obsessed with the need for maintenance in the context of technology risk management, security and reliability. A big part of technical debt build up and the security consequences of that is driven in part by a lack of preventative maintenance. 

The same issues are often said to be in legacy systems. However, I generally dislike the term legacy systems. There are “legacy” systems in the literal meaning of the word all over the place and in some cases they are well maintained and supported despite being of an older generation of technology. They are often the foundational or core systems of many major enterprises. Instead, the real problems are with what might be called “stagnant” systems. These are the systems, possibly not even old, that are not kept up to date, not tended to, and so accumulate latent risk. These are the ones that have not had any preventative maintenance. 

Focusing on whether you have sufficient preventative maintenance is comparable to how organizations think about their business and manufacturing processes, especially in heavy industry, energy, transportation and manufacturing. The same lessons can apply to technology. I’ve seen many organizations explicitly budget for such maintenance, which also includes funding to implement unplanned control improvements in response to security vulnerabilities or even regulatory changes. 

Brand’s book is basically a grand tour of various case studies from sailing around the world, battlefield equipment maintenance through to the Statue of Liberty. Every case study is brilliantly told in wonderful detail with great illustrations. It was a joy to read, even in the heavier going parts, of which there are a few. 

Rather than review the whole book, here’s a few of the parts that I liked the most and in some cases the security lessons we might take away from that. 

Sustainment vs. Maintenance 

Brand tries to soften the paradox that maintenance is both absolutely necessary and incredibly easy to defer. He does this by expanding our vocabulary, drawing a vital distinction between traditional "maintenance" and the military concept of "sustainment."

For Brand, maintenance is the tactical, localized act of keeping a specific thing running, the often tiresome, hands-on chores like changing the oil, fighting rust, or fixing a broken component. Sustainment, on the other hand, is an overarching strategic umbrella borrowed from U.S. Army doctrine. It encompasses the entire ecosystem of logistics, financial management, personnel services, and cultural support required to keep an operation going until the mission is complete. 

In short, maintenance is the fundamental ownership and care of the “machine” itself, while sustainment is the broader, systemic commitment that ensures the maintainers have everything they need to succeed.

This transition from a maintenance mindset to a sustainment strategy is highly applicable to cybersecurity. When viewed purely as maintenance, security becomes a localized chore that is easy to defer until a catastrophic breach forces a panicked response. Applying the concept of sustainment means elevating cybersecurity from a technical checklist to a core operational pillar. Cyber sustainment requires aligning budgets, continuous personnel training, cross-departmental communication, and leadership intent to support the security mission. 

AK-47 vs. M-16

His exploration of the AK-47 versus the M-16 serves as a definitive case study in the tension between optimized performance and rugged maintainability. The M-16 was designed as a precision instrument. It was lightweight, highly accurate, and lethal, but notoriously finicky and prone to jamming if not meticulously cleaned. In contrast, the AK-47 was engineered with loose tolerances that allowed it to function while caked in mud or rusted by humidity. Brand emphasizes that the AK-47’s success isn't due to superior specifications in a vacuum, but rather how forgiving it is. 

In cybersecurity we might be accused of building "M-16" architectures: fragile, highly integrated, and dependent on perfect hygiene (constant patching and flawless configuration) to function. Applying Brand’s maintenance philosophy to digital defense would mean building systems that are easy to inspect, simple to update, and designed to fail gracefully. In other words, they are rugged. 

Tesla

Tesla’s manufacturing evolution was a profound exercise in what could be called "pre-maintenance." Rather than engineering better ways to repair a complex vehicle, Tesla focuses on ruthlessly eliminating the components that might eventually fail. Brand highlights this through the company's heavy reliance on gigacasting, replacing dozens of welded, glued, and bolted sub-assemblies with single, massive pieces of die-cast aluminum. Guided by the design ethos that "the best part is no part," this simplification fundamentally shrinks a vehicle's structural vulnerability. By stripping away redundant connections and complex mating surfaces, Tesla is effectively engineering the eventual need for much maintenance entirely out of the equation.

If we apply Tesla’s "deletion" algorithm to cyber defense, the focus shifts from endlessly maintaining a fragile stack to aggressively reducing the attack surface. True digital maintenance must involve the systematic deprecation of unnecessary services, access rights, and code. In the digital realm, just as on the assembly line, the vulnerability you never have to manage is the one you already deleted.

Arab and Israeli Conflicts 

Brand draws a fascinating distinction between the maintenance mindsets of the Arab and Israeli militaries during the 1973 Yom Kippur War. He observes that Syrian and Egyptian forces generally treated battlefield damage as final, that is when a tank broke down or took a hit, it was largely abandoned as a permanent loss. The Israeli military, conversely, viewed a disabled vehicle as a temporary setback rather than a definitive casualty. They embedded mechanics near the front lines, creating a relentless triage and recovery system. Damaged armor was dragged back under fire, rapidly repaired, and shoved straight back into the fight. Brand uses this historical clash to illustrate a powerful thesis that the victor isn't always the one with the most pristine equipment, but the one whose culture institutionalizes swift, decentralized repair to keep the operational engine running.

This battlefield dynamic translates seamlessly into the modern arena of cybersecurity, where a team's reaction to damage often dictates the outcome of a breach. 

Around the World Sailing 

Brand’s exploration of the 1968 solo non-stop yacht race around the world is a great story of high stakes maintenance. The race wasn't just a test of speed or skill, it was a relentless battle against the elements. Brand illustrates this by contrasting the competitors' radically different relationships with their vessels. For instance, some sailors treated maintenance as an agonizing afterthought, subscribing to a "hope for the best" or "deal with it when it breaks" mentality that often led to failure. Some sailors, like Bernard Moitessier, adopted a philosophy of simplicity and rigorous daily preventative upkeep, treating his vessel as if it were "a new boat every day." Brand uses this high-stakes drama to argue that survival and success comes from the quiet, unglamorous and continuous discipline of sustainment.

The Statue of Liberty

When Gustave Eiffel designed the statue's iron armature to support its copper skin, he recognized the risk of galvanic corrosion between the two metals and separated them with shellac-soaked asbestos. However, over time, that protection trapped salty moisture, like a sponge, and vastly accelerated the very corrosion it was meant to stop. This failure caused the rivets to pop, but as Brand notes, the true root of the crisis was bureaucratic. The issue was passed between the US Lighthouse Board to the War Department, and eventually to the National Park Service. Without continuity of custody, there was no continuity of maintenance, and the slow, invisible rot of neglect became the baseline norm.

Brand’s observation about administrative neglect is the exact story of many organizational cybersecurity challenges unless security teams address that. The “galvanic corrosion” in our world is when we fail to address brittle dependencies that hold our overall environment back. 

Bottom line: Studying how other fields think about maintenance and sustainment is extremely useful. These areas are rich in lessons to apply to cybersecurity. Stewart Brand’s Maintenance of Everything is a brilliant review of many of these fields. It’s one of those books that every page gets you thinking about all the ways it can improve your security programs.