Information Security 101: Uncommon Sense

The only thing constant in this world is change and common sense is actually not common.

Have you ever wondered how information or cyber security professionals figure out what to do despite the rapid changes in information technology and attach surface? It's through the use of (un)common sense.

How many times in your life have you had to solve a problem? How many times were you able to properly identify your problem or the source of your problem? What immediate action can be done to lessen the effects of the problem? What action can you do to temporarily solve the problem? What action can you do to concretely or definitely solve the problem? Did the action taken solve the problem?

And that pretty much sounds like problem solving 101, or better yet, a customized implementation of the Scientific Method.

As you can see there is no secret sauce. It's a matter of training oneself to identify the problem and assess which or what is the immediate, temporary, and long-term solution about the problem, rinse and repeat. In Information Security, identifying the problem may also referred to as Threat Profiling and/or identifying Threat Actors.

A blog post at Rapid7 information security community section has this to end the post Addressing the issue of misguided security spending:

The bottom line, don’t spend that hard-fought $64,000 on security just for the sake of security. Step back. Know what you’ve got, understand how it’s truly at risk, and then, and only then, should you do something about it. Look at the bigger picture of security – what it means for your organization and how it can best be addressed based on your specific needs rather than what someone else is eager to sell you.

And we completely agree! Uncommon sense right? if we are not able to properly identify the problem, how are we supposed to solve it?

First things first, identify the problem. There is no silver bullet, no fairy godmother, and no one size fits all solution. https://t.co/21yuXl88tu

— Net Safety PH (@NetSafetyPH) March 29, 2017