Security Vignettes

(Illustrative scenario, not a real incident)

Writing this far, I realize the seven pieces before thiswere really about one thing:

awareness.

Not a cleverer tool,not a more expensive system,but a little more sensitivity to anomalies,and a little more honesty with ourselves.

The great way is simple.None of the five things below is hard;the hard part is being willing to do them once a month.

First, every key should have an owner you can name.Whose it is, what it does, when it should be rotated.

Second, to kill a chicken, use a chicken knife.Grant just enough permission, and if it's lost, only a little is lost.

Third, places you've never been should hold nothing.Turn off services you don't use; void keys you don't use.

Fourth, make anomalies ring.Budget alerts, administrator changes, new keys:each should send a notification.

Fifth, when something goes wrong, slow down.Preserve evidence first, then act;cut off the entry point first, then delete things.

I used to think security was the engineers' job.Later I learnedsecurity is a way of living.

Like sleeping early, exercising, and regular checkups,doing it once won't make you healthy,but because you keep doing it,you notice sooner when something is wrong.

You don't have to get hurt before you start being careful.You don't have to lose something before you learn to cherish it.