Adrian put up an insightful (as opposed to inciteful) column on Dark Reading, pointing out that that Simple Security Is A Better Bet. Though I quibble a bit with the subhead: “Complex security programs are little better than no security”. Of course any subhead taken out of context creates opportunity for misinterpretation. I would reword to say, “Complex security programs done poorly are little better than no security”. But that’s just me.

The fact is that any set of security controls chosen needs to be achievable by the organization. Even if that means attack surface remains unaddressed. What choice do you have? Even if it’s the low bar that most compliance mandates prescribe. Adrian does make that point effectively.

…it was going to address most of the issues the company had – it was not even fully aware of the issues it needed to address – and it was within its capability to implement. I hate to do this because sometimes it feels like compliance for the sake of compliance.

Obviously that’s suboptimal. Just like anyone else, I like to actually solve the problem, rather than just putting band-aid after band-aid on the wound. But pragmatism needs to win the day. Any organization pushing beyond its capabilities (and budget) will have problems because it won’t be able to execute – even worse, it might get a false sense of security.

Photo credit: “failure-to-comply” originally uploaded by Brendan Riley