Building Sustainable Security Programs

This talk explains how security leaders can make information security programs more sustainable by addressing burnout, organizational culture, risk prioritization, strategic investment, and stakeholder alignment. It emphasizes customer-focused security teams, threat modeling, risk appetite, and shared guiding principles.

Syllabus

Intro
INFORMATION SECURITY BURNOUT
CONSTANT FIREFIGHTING
PERSONAL RESPONSIBILITY
ONGOING CONFLICT WITH STAKEHOLDERS
CHANGING THREAT LANDSCAPE
Disrupt Security Cynicism
Discourage Heroics and Celebrate Long-term Wins
Build Additive Teams
Environment of Empathy and Collaboration
Business Enablement and Customer Service
Help Security Engineers think about Risk
Understand your Threat model and why Security matters
Be rigorous about Risk Outcomes
Strategic vs Operational Investments
Leverage Points and Efficiency
Minimize Impact to Critical Data Assets
Overall Security Assurance Balance of Proactive and Reactive Security Controls
Risk Appetite for Senior Leadership
Shared Guiding Principles