Rejoice, Security is Finally a Feature. Now Let’s Automate It.

Stuff you used to see as point solutions have become features within firewalls and IDSes, said David Mortman (@mortman), Chief Security Architect for Dell, in our conversation at the 2015 Security B-Sides conference in San Francisco.

Security has become a standard feature on hardware and software. It’s becoming less of a dedicated role, being handled by operational folks, continued Mortman. This has freed up security people to take on two extreme roles. They’re either generalists working as liaisons with the business and security, or they’re deep dive specialists who have extreme skills in certain areas, such as forensics.

It’s a nice change of pace. Security is become part of everyone’s job description. Everyone in the organization can ask themselves, “How does security fit into my daily life?” That’s contrary to the old way of handling security. People would just hand off a security concern by saying, “Oh, that's security's problem.”

While Mortman is glad that security is finally a feature, he would like to see it operational in automation, like in security testing. As excited as Mortman is about automation, he does realize he needs to be careful when automating things. If a mistake is made, then it hits everyone all at once.

That’s not necessarily a bad thing, said Mortman, "If you're not breaking things occasionally, you're not trying hard enough. If you're breaking things you're finding the limits of the system."

You have to do this because software becomes fragile over time. Mortman is okay with screwing things up, just as long as it happens in a way that he understands.