I left the world of cybersecurity.
Not because I no longer believed in it.
But because it had changed in nature.
I created my first computer security company, Digital Network, in 1999.
At the time, we did not yet speak of "cybersecurity" but of computer security, of infosec, then a little later, of information security.
That security was measured by one thing only: reality.
Not by standards. Not by boxes ticked in an audit.
But by the ability of the information system and a security team to hold up, resist, detect, compartmentalise and respond.
When you did the job well, either there was neither intrusion nor leak, or it was detected quickly, contained and fixed.
When an incident happened, we analysed it and found out how and why it happened. We fixed it. Everything was crystal clear.
And above all, it was a field of constant innovation. We were not trapped in straitjackets or imprisoned by an ISO manual, nor held back by "best practices" imposed by an administration.
We experimented, we iterated, we innovated. We invented methods, tools, protocols.
And sometimes, yes, we messed up. But we moved forward. Each on their own path, sometimes alone, sometimes together.
Today, that world has become frozen in place.
It has organised itself around appearances.
Labels, frameworks, compliance matrices and certifications. A lot of certifications…
But what about the effectiveness of all that? Sometimes, often, none.
The number of massive leaks is multiplying, often because of trivial human errors that had nevertheless disappeared a long time ago.
But as long as standard X.Y.Z is respected, everything is fine.
And conversely, you can have an information system that is solid, proven, airtight.
But if it is not "compliant", if it does not tick every box of the standard, you will have fingers pointed at you.
I come from a time when security was an applied art. Not a checklist.
And above all not a dogma.
The day the frameworks started to dictate not what had to be achieved, but how we had to get there, I understood that this world was no longer mine.
In security as elsewhere, dogma kills innovation.
And I refuse to work in a cage.
So yes, I continue to take an interest in it. Out of interest, out of passion, out of habit, out of instinct.
But in my own way.
Have a good weekend!
—
Christophe Casalegno
You can follow me on: Telegram | Facebook | LinkedIn | X | YouTube | Twitch
4 comments