The patient’s dilemma: Balancing triage with diagnosis in the cyber emergency room

A patient arrives in the emergency room, bleeding out from obvious wounds. The wounds are treated, and the patient is discharged – only to return the following week in an identical state. And the next week. And the week after.

It is patently absurd we would do this to a human being … so why do many organisations do this to their security program?

The answer of course is that many organisations face a dilemma – tackle the hard, systemic issues that will grind the security program down over years (e.g., inadequate workforce planning), or focus on putting out the fires that risk a major incident in the short-term (e.g., vulnerability management)?

Much like our unwell patient, a careful balance must be struck between tending to symptoms and diagnosing and treating the underlying illness – but unlike a human, our security programs can rarely tell us how effective our medicine actually is.

The irony is one issue invariably feeds another; an inability to manage BAU operational security issues make justifying more expansive budgets challenging, while fixating on assessment and planning over remediation and action invariably results in security inertia.

This presentation, through the extended metaphor of an unwell patient, will teach security leaders how to contextualise their cyber security problem set, pick the right medicine (and dosage!) for the ailment, and offer practical strategies to start getting their security program back on the mend.