Never Say Always
Throughout our lives we are taught, beginning from when we are children, to never say never. A good philosophy since nothing in the universe is absolute, just a matter of probabilities. The reverse – never say always – is equally as true, since again, nothing is absolute.
As security professionals, we’re told to do completely the opposite. We’re encouraged to say ‘never’ and ‘always’ with the knowledge that sometimes those 2 words just don’t apply.
The logic behind such wording is sound – you don’t want the people you’re protecting to get the wrong idea about a certain setting, firewall configuration, or password policy. Let your customers deal in absolutes without losing sight of everything in between.
That’s what security professionals bring to the table – a specialized
mindset that can see all of the shades of gray. Everything in between ‘never’ and ‘always’ is where security professionals live. They know when ‘never’ is really never, and always is 99.9% always.
Most people, when it comes to security, see the black and white making it seem like once you get the dos and don’ts, anyone can take over. That’s slowly changing and companies and governments are learning to appreciate the shades of gray. Perhaps it’s because they’re increasingly employing the expertise of security professionals or they see when ‘never’ and ‘always’ fail.
That’s the art of security, to paint black and white using only red, yellow, blue, and purple. If you’re in the security field, the more experience you gain, the more gray you see; if you’re on the other end you get pretty good at seeing black and white.
Security is a series of trade-offs based on ever changing probabilities. The better versed you are in the probabilities, possibilities, and perceptions the better you’ll be able to help a client with a given security problem.
Security is about being flexible, not rigid — how you perceive that line says alot about how you view the world of never, always, and everything in between. Let us know in the comments.