I have a statement that defines the real overall purpose of an organisational security function. I'm not sharing it with you here. I charge for my insight.
One of my old clients adopted it. When their employer sought to define their security function, the person in charge wrote the usual stream of uninformed bullshit. My old client shared my statement with them. Their criticism?
'It sounds too corporate.'
And that's seen as a problem? Most security people struggle because they cannot speak the language of the business. They cannot get attention, cannot get support and cannot get approval because they are refusing to learn more than their discipline.
This, folks, is why I do not share my insight for free. Morons don't understand it or value it. This person (in charge, no less) had received (albeit 2nd hand) deep insight from a world authority, and they think they knew better. I read their purpose statement, and they don't. If they'd paid for it, they'd value it.
If you work in security rather than in IT configuration, your insight is your product. Stop giving it away for free, or you'll devalue it and yourself.
