GrrCON 2018: Stop boiling the ocean!
1 like233 views
The document discusses the concept of 'boiling the ocean' in the context of information security, emphasizing the importance of focusing on incremental improvements rather than overwhelming data demands. It highlights strategies such as adopting a system-based approach instead of strict goal-setting, utilizing feedback loops, and seeking 1% improvements in various areas, as showcased by Team Sky's success in cycling. The author, Joel Cardella, shares his experience in establishing robust product security processes at Thermo Fisher, demonstrating that consistency and small wins can lead to significant advancements over time.
GrrCON 2018: Stop boiling the ocean!
- 1. The world leader in serving science Joel Cardella Director, Product & Software Security & Privacy Stop Boiling The Ocean!
- 2. 2 • Joel Cardella, Director, Product Software Security and Privacy • 25+ years in IT in various roles: CISO, Consultant, network ops, data centers, service operations, etc • Twitter: @JoelConverses • www.jscardella.com • I love the theatre, have a strong fine arts background, and am interested in anything that makes me a better decision maker Who am I?
- 3. 3 Boiling The Ocean Effective image, but can be cliché Examples of boiling oceans: • Managers who require mountains of data for reports or presentations which are then unused • Trying to plan for every contingency possible • Constantly revising forecasts • Inspecting or assessing everything in hopes of catching something
- 4. 4 Boiling The Ocean in Infosec Infosec is an ocean, and all of these are oceans within infosec!
- 5. 5 James Clear Author, entrepreneur, world photographer and gym rat Motivational writer about habits and human potential Jamesclear.com The rest of this presentation is going to reference material directly from James Clear
- 6. 6 Goals versus Systems Plan for failure “Planning to fail doesn’t mean that you expect to fail, but rather than you know what you will do and how you will get back on track when things don’t work out. If you’re focused on being perfect, then you’re caught in an all-or-nothing trap.”
- 7. 7 Goals versus Systems Being Consistent Is Not the Same as Being Perfect Individual failures have little impact on your long-term success
- 8. 8 Goals versus Systems All or Nothing is a trap!
- 9. 9 Goals versus Systems If you completely ignored your goals and focused only on your system, would you still get results?
- 10. 10 Goals versus Systems FORGET ABOUT SETTING GOALS Goals are all or nothing. They are deadlines, not schedules. So if we don’t meet them, we automatically fail…even if we were better off than we were at the start!
- 11. 11 •Commit to a process, not a goal. •Release the need for immediate results. •Build feedback loops. Systems versus Goals
- 12. 12 Narrow margins The margin between good and great is narrower than it seems. What begins as a slight edge over the competition compounds with each additional contest.
- 13. 13 The Story of Team Sky Sir Dave Brailsford, Manager of Team Sky Britain had never won a Tour De France Aggregation of marginal gains - “the 1 percent margin for improvement in everything you do.” They searched for 1 percent improvements in tiny areas that were overlooked by almost everyone else: discovering the pillow that offered the best sleep and taking it with them to hotels, testing for the most effective type of massage gel, and teaching riders the best way to wash their hands to avoid infection. They searched for small improvements everywhere. Brailsford believed that if they could successfully execute this strategy, then Team Sky would be in a position to win the Tour de France in five years time. He was wrong. They won it in three years.
- 14. 14 The 1% rule In the beginning, there is basically no difference between making a choice that is 1 percent better or 1 percent worse. But over time…the difference is significant!
- 15. 15 How I would Apply This Learning Process rigor, for robust and repeatable, ongoing processes Precise documentation, internal and external Controls and ongoing validation for both privacy and security Product Security requires three essential components
- 16. 16 1.Decide the type of person you want to be. 2. Prove it to yourself with small wins. Identity-Based Habits
- 17. 17 •I want to be the person that puts Thermo Fisher Product Security on the map •I want people to talk about us as a leader in the space, and with constructs to be emulated •I want to expand my own knowledge and understanding of the space, because of its importance to the future, and the fact that my work directly impacts people’s lives My Identity
- 18. 18 • 3 months ago • No one in charge of product security • No direction for application developers • Bug bounty programs in place with little to no feedback • No defined processes for reporting vulnerabilities • No presence in the community • Today • Me, and a team of 4 people, with 9 open positions in progress or planned • A developer pipeline that includes automatic code scanning for 1 team • Action on bug reports, with a 22% fix rate for reported vulns • A process to report vulns outside the bug bounty, with tracking and follow up • H-ISAC participation in working groups • A successful debut at DEF CON with IoT devices My Feedback Loop
- 19. 19 •My commitment: • At the end of each work day, my team will scrum for 5-10 minutes and discuss what we did that day that improved us 1% • Capture this information, keep the list publicly available, and report on it regularly My Feedback Loop
- 20. 20 The 1% Rule and the 80/20 Rule The 1 Percent Rule states that over time the majority of the rewards in a given field will accumulate to the people, teams, and organizations that maintain a 1 percent advantage over the alternatives. “The 1 Percent Rule is not merely a reference to the fact that small differences accumulate into significant advantages, but also to the idea that those who are 1 percent better rule their respective fields and industries. Thus, the process of accumulative advantage is the hidden engine that drives the 80/20 Rule.”
- 21. 21 The 1% rule You don't need to be twice as good to get twice the results. You just need to be slightly better. Consistently.
- 22. 22 Speed of average Average speed yields above average results
- 23. 23 •Keep moving – you don’t need to dash, and in fact may trip and fall if you do •Keep improving just 1% each day – be consistent in your approach Keep In Mind
- 24. 24 Average Speed for Above Average Results Don’t boil these oceans! Small, consistent steps yield great results over time