Scaling Security - The 7 Pillars of Elite Cybersecurity Programs

I had a decades-long career as a CISO defending some of the world’s largest and most targeted organizations in times of immense change, including the early stages of what we are dealing with now. In and out of those roles, including what I do now, I’ve also been able to observe the very best of other organization's security programs across multiple sectors, geographies, at all sizes and maturity. What I’ve taken away from all of this is that we do, in fact, know how to secure systems. 

We do know how to secure systems.

This is not the preamble to the standard joke that you just unplug them and bury them in concrete. No, we actually do know how to secure systems. We can take a connected and functional system that meets some goal, and, with a sufficient number of experts, we can lock it down, harden it, and keep it maintained and up-to-date. We can monitor it; adopt multiparty controls; segment it and its components; ensure encryption; enable trusted boot; impose firmware and software validation; ensure that the application it runs is assured, shielded, and continuously updated in light of new threats and vulnerabilities; and ensure that access is strongly authenticated and privileges are minimized. Now, it might take dozens of complementary experts across many domains to do this, our own little army of security artisans at considerable expense and effort, but such a system can be secured. It can be secured against the most sophisticated attackers, even if it means relying on detection to quickly contain attacks and evolve new defenses. 

The problem is that no real-world situation is like this, for five reasons:

1. Complexity compounds exponentially. Systems are rarely self-contained. Most environments are large collections of systems with interdependencies, creating a large surface area to defend. This complexity not only increases what needs to be done but also limits what can be done. A change to one part of one system or component might require an update to multiple other systems. Our modern environments are not aggregations of multiple simple systems, where the complexity is n times that of a single simple system. In reality, these n simple systems are intricately connected into an exponentially growing mesh of interdependencies. In extreme cases, some updates might require everything else to be changed.

2. There are never enough experts. I don’t agree with the supposed cybersecurity workforce crisis that there are millions of unfilled cybersecurity jobs. But I am certain that there are pockets of critical expertise in specialized security roles like application security, AI control, operating systems hardening, and many more, where real expertise is truly scarce and expensive. So, the number of specific security artisans needed can exceed most organizations’ capacity to afford or attract them.

3. Security often has to be bolted on. Many products or services lack sufficient intrinsic security capabilities, such as logs or other sensory outputs, software integrity measures, segmentation, and fine-grained access controls, to name a few. Even when they do, they might not have the right settings by default. Organizations have to add additional controls or quickly enable the provided controls within the window between deployment and possible exploitation. Security settings may be incompatible with other parts of the system, so it’s hard to “flick the security switch” without creating reliability headaches. Worse, there are often inconsistencies at different layers of technology stacks, where a policy setting at one level still requires deeper engineering at other levels to make that effective. It’s like switching your car into sports mode on the dashboard but still having to pull over to open up the hood and tweak the engine.

4. Simplicity is not the only answer. If complexity is the problem, then simplicity cannot be the only answer. Any environment with sufficient utility and scale is, by definition, complex. To wish that complexity away with calls for simplicity ignores reality. Rather, complexity needs to be managed by abstracting the complexity behind simple interfaces and within services. 

5. Risks are interdependent. Security cannot be considered alone. A poorly designed security control may negatively affect reliability, resilience, privacy, and many other risks. Similarly, mitigating those risks in isolation may affect security.

Dealing with all this and delivering a security program in any type of organization is about increasing predictability and reliability at scale as much as it is about implementing specific control improvements. The key factor in doing this is to move from "artisanal" ways of working to be more "industrial". To move beyond only individual team member craftsmanship and toward relentlessly consistent, organization-wide outcomes. To deliver the structural and architectural invariants that let you rise above a cycle of patch and pray. 

Looking at how to deliver this, over many years, I’ve experienced and observed 7 common themes, or pillars, that distinguishes the elite teams from those simply making it through the day. These elite teams exist in large and small organizations, in different sectors and geographies and are led by CISOs and other people that actively shape their environment to set the conditions for success, not simply deal with what they are given. 

Elite cybersecurity teams shape the environment they are in, to set the conditions for success, not just respond to what they’ve been given.

I wrote this book, Scaling Security, to bring more of these ideas to more people. It came from my frustration over the years that while we have great books on how to implement controls and to run the mechanics of security programs we were missing a book on the best leadership practices for CISOs and other security executives. We needed a book about the "operating system" to deliver security at scale. 

The 7 Pillars, shown below, form a flywheel that relentlessly build on each other. When you get going with this you almost can’t help but get better security. 

These pillars are the constants in creating and sustaining an elite security program, no matter what business, technology, or societal challenges we face. They remain constant in the face of even the most widespread of disruptions.

• Pillar 1 - Set Broad Goals: Shift from Lagging to Leading Indicators of Performance. A lagging indicator tells you if you have succeeded or failed. They are easy to measure but hard to influence directly in the moment. A leading indicator, instead, measures an activity that you believe has a direct, causal effect on your desired outcome. These are the levers you can actually pull. Get the leading indicators right, and you can’t help but get great results in your lagging indicators. 

• Pillar 2: Modernize for Defensibility: Security Built In, Not Bolted On. Make the secure path the easier path, demystify secure-by-design and secure-by-default principles and show how defense in depth strategies can distribute security pressure across multiple interlocking controls. This also includes the concept of ambient control to reduce human vulnerability as part of making security more agile and cost effective.

• Pillar 3: Prioritize the High-Impact 20%: The Pareto Principle in Action. Continuous iterative improvements are vital, but the best security programs actually come from a small number of transformational programs or "big bets". This pillar is all about how to find those 20% bets that deliver the 80% impact across privilege management, software security, operational resilience, and more. 

• Pillar 4: Amplify Your People: Organizing for Scale. The organizational blueprint for high-performing security teams, including the "rule of thirds", which balances technical specialists, risk managers, and operational experts. Beat burnout and discover how leading security organizations become CISO "factories" that systematically develop versatile security leaders.

• Pillar 5: Architect for Resilience: The Resilient Enterprise. Resilience is about capabilities, not just plans. Pillar 5 shifts conventional continuity planning by reframing resilience as a set of dynamic capabilities centered on the organization’s minimum viable delivery objectives. This includes stress-testing methodologies that deliberately push systems to breaking point and examine ways where small interventions yield significant improvements in resilience.

• Pillar 6: Harness Economics: Run Security Like a Business. Rigorous business principles that can create sustainable security programs even with constrained resources. Reducing the cost of control to increase your baseline level of security, and applying supply and demand management to address resource constraints beyond the traditional "give me more budget" requests. Reshape business perceptions of security by focusing on adjacent benefits, where security initiatives simultaneously deliver operational improvements, customer experience enhancements, and cost savings.

• Pillar 7: Speed as Strategy: Closing the OODA Gap. Organizations that can observe, orient, decide, and act (OODA) faster than their adversaries are more successful. Such speed is vital at all levels, from executive decision-making to responding to tactical threat signals. This all includes how elite teams distinguish strategy from mere planning and establish sustainable flywheels that make their success inevitable.

In the next blog posts I will go through each of the 7 Pillars of Elite Cybersecurity Teams in more detail, to give you a flavor of this. But, of course, none of this is a substitute for reading the book when it’s released on February 23rd. 

Bottom line: the best teams and the best organizations I’ve seen over the years got there by adopting these pillars, or their versions of them. A single CISO, or a sequence of CISOs building on each other’s hard-won battles, made them successful. This was not handed to them. The best part of implementing these pillars is that they form a flywheel so compelling that you almost can’t help but get great security. It’s within all leaders, their teams, and wider organizations to be elite. The seven pillars work.