Microsoft seems to do pretty well, at least in the sense their security is effective and still allows people to get work done. Lots of effort put into policy automation so it's easier to comply with policy than not.

The problem with IT security orgs is that they get to estimate the costs of not following their own recommendations.

Which trend towards infinity, because... well, they want the thing they're advocating for to happen.

This tends to attract toxic, political people who thrive in this sort of environment, and push out more reasonable, technical people who don't want to deal with that.

At some point, you get a critical mass of toxic IT security managers covering each other... and then everyone starts ignoring and/or hating security.

The real loss is that most IT security orgs I've seen are extremely deficient in developers. The kind of person you actually need to automate things, so that they're quicker, so that people use them, so that the organization is more secure. :(

I don't really see it that way. From my perspective it isn't toxicity as the driver, but a strong sense of user preservation. Many people I know in security value the customers more than they value the company itself. They're the antithesis of political - their inability to understand higher order company-level or product-level issues often hamstrings them because their goals aren't aligned with the company goals. Though I have a limited view - I'm sure there are many companies that are operating as you've said.

The teams I really strongly respect, for example at Square/Microsoft, manage to align user interest and company interest very well - that's a very hard thing to do and requires top to bottom investment. Microsoft's approach has been to monetize security, which makes that easier.

Both organizations also have resisted the mistake that you and I both agree most orgs make - they've invested heavily into hiring engineers to solve security problems, and you generally have to pass a coding interview even for security roles.

edit: Reflecting more, I suspect that the described behavior of hyper-political teams that have a self-preserving structure is probably something prevalent, but that I haven't had the misfortune of being involved in. I would imagine companies like that are generally toxic across orgs, and not just in IT, but probably any area where investment is forced and it isn't revenue-generating.

Clarification, in my context I'm typically talking about the IT Security and employee relationship. But the dynamics you outline still hold, although my experience has been reverse (they value what they perceive as "the company" over employees).

> I would imagine companies like that are generally toxic across orgs, and not just in IT, but probably any area where investment is forced and it isn't revenue-generating

I'd agree this is probably a key contributing factor.

It's been my fortune / misfortune to work for a number of companies that qualify (healthcare, financial, insurance).

But it has also been true (in my much more limited experience) with healthier, IT-as-profit-center companies.

I'd hazard better framing (than profit/cost center) might be "incentivized to improve" vs "penalized for mistakes."

Unless it's the former, it's in no one's personal interest to go above and beyond or suggest change. So you get glacial, incremental processes, and lose people who are impatient with working that way.

As you note, I think monetizing security is a key step to establishing a healthier balance.

The hardest thing to come to grips with in security is that you are dealing with large(ish) groups of people.