most security solutions are like traditional painkillers, we certainly feel better after talking them, but the root cause of pain remains intact and unresolved!
as long as we do not address root cause of security incidents and vulnerabilities, we will be feeling better from short-term pain relief of “Security Solutions” and then suffering again soon from a new incident.
one of the reason these “solutions” are not effective is carrying the mindset of “let’s get rid of pain now by a painkiller” rather than spending time doing surgery on root cause. we can technically live our entire life by taking oxycodone and never feel pain again, be addicted and actually never remedy the main cause of our pain, and that to me is really what we are doing similarly in security community: we bring a new solution/acronym every once in a while to table and we call it solution for xyz problem, but it’s just a new brand name for same old paracetamol.
addressing root cause of security incidents and where vulnerabilities are being exploited must be the main objective of any security solution. for example, there are many aspects of a ransomware attack we can consider as “pain” and address: unavailability of resources including file and backup, perhaps the most obvious symptom of first generation of ransomware. now, for sure having a solid backup strategy is anyway expected but is that going to fix the way bad actors got into our network? obviously not. I am also not talking about prevention of ransomware and blah blah blah. the presence of ransomware is relying one most important factor which drives the whole idea of ransom and extortion, but I have never seen even one security solution pointing to that pillar. as soon as we eliminate the root cause, there will be no ransomware at all. it is actually not hard at all and you will be surprise by that.
I am only bringing this important fact to your attention that identifying root cause has to be prior to shopping for a solution, and that has to be also considered by solution developers too, but again, unfortunately most of solutions out there are just to relief the pain (actually they are not even able to relief the pain).
