This post was originally published in French only. We translated it in 2026 so the archive reads the same in both languages. Read the original →
Note: The idea for this post and the text come from an anonymous colleague, with a little collaboration on my part.
Every day we face security problems, some simple, some complex. Unfortunately, most of the time those problems stem from poor information security management, which results in the plaster effect.
When a problem has to be fixed, most of the time "a plaster" (a band-aid) gets slapped on it: a plaster if the costs are too high, a plaster if it must not get out, a plaster if, etc. In short, and generalizing a bit, security today is little more than an infirmary full of temporary patches and compensating controls.
Most of the security budget goes to governance, meaning setting up standards and rules. And since the budget is spent at a high level, the budget and resources needed to actually fix problems are very limited (at the operational level). That is the reality security analysts and technicians face more and more. Governance has its place, of course, but it should look like an organization's structure: the bottom of the hierarchy (operational) is where you find the most employees and where the most person-days and effort are spent, so it should get the biggest budget and the most resources. Governance and senior management, by comparison, should be fewer in number and therefore be allotted fewer person-days. So, setting up a large technical team to implement security measures and, conversely, a small team to decide on the direction of security and how to implement it (governance and analysis) would be smarter and more effective against the countless attacks/information thefts/technical errors/etc. we face every day... if not every second.
That way, our companies and governments will be able to prevent both internal and external attacks thanks to concrete, complete security measures, rather than just ticking 100% of the boxes on standards and documents to satisfy a law, actually applying and truly meeting those laws, for the good of users like you and me whose confidential data sits with these companies.