Security Leadership: A-grades vs. Pass/Fail

guest · Jul 17, 2020

Security Leadership: A-grades vs. Pass/Fail
July 17, 2020
https://www.philvenables.com/post/security-leadership-a-grades-vs-pass-fail

The underlying secret of most great security leaders and teams is one thing: the ability to know what needs to be done really well vs. what needs to be simply ok. In other words knowing when to go for an "A-grade" vs. when to simply "Pass".

Try to do everything brilliantly (attempt to get an A-grade at everything) and then end up failing at that, but worse, failing in unpredictable ways. You may barely Pass (or outright Fail) at something you really did need to get an A-grade on.

Realize your limitations and spread everything so you don’t fail at anything but you averagely pass across the board, leaving some things where you really did need an A-grade but not achieving that.

Actually figure out what needs an A-grade vs. just a Pass (I’m assuming nothing is tolerable of failure for this example, but in some organizations there might be such instances).

Click to expand...

Assuming option 3 is the goal then how do we differentiate between what needs an A-grade vs. just Pass/Fail.

You could do the traditional criticality ordering - protect the “Crown Jewels” kind of approach but you can also, as we talked about in this post, focus on the new as well as the critical - and introduce some impetus / velocity to deprecate the old. You can also find elements in your organization that always need an A-grade irrespective of their notional criticality because they give you massive leverage: [...]

Bottom line: work hard to figure out what you need to get an A-grade on versus simply Passing.
Click to expand...

Log in or Sign up

Security Leadership: A-grades vs. Pass/Fail

guest Guest

Log in or Sign up

Security Leadership: A-grades vs. Pass/Fail

guest Guest

Useful Searches