That’s basically the entire cybersecurity industry. Companies buy these tools as a kind of blast door for when things go wrong, to point a finger at. “We followed all the checklists and our security software didn’t catch it, it’s not our fault.”

If companies cared about security they would hire red teams instead of paying for useless scanners with a <1% signal to noise ratio.

That’s not just cyber security, that’s part of the reason many service/support contracts tend to exist, the whole CYA finger pointing by externalizing the responsibility.

Ultimately you end up having to clean up the mess after either way but at least there’s a paper trail of responsibility passing to CYA.

If you can't do checklists though, you can't do anything else.

All activities have lists and recurring calendar entries at their heart.

You have to regularly show up and do the things.

I agree that deeper / better approaches are required during the "do the things" steps.

Right, I think the industry is too self-critical at times.

I onboarded a new client recently, and within five minutes of guessing a Wi-Fi password I had sensitive financial data using stock tools. Anyone with physical access to the office could do the same. Contrast an existing client, after a month of trying and writing custom shellcode loaders, spear phishing campaigns, my entire team had... some graduate CVs.

Really, you're saying that because the NSA could probably do a better job with the latter than us by intercepting and hardware-hacking networking gear, that no value has been provided?

Perhaps it depends upon why the checklists exist, how accurately they model what needs to be done, and how closely they are followed. Consider aviation: pilots live by checklists. In the world of aviation, following checklists doesn't guarantee that things won't go wrong during a flight, but not following them or treating them cavalierly is an invitation for disaster. Those checklists are built upon years and years of hard-earned experience.

Granted, however, having a checklist for no good reason other than to say that you have a checklist, or not regularly reviewing and updating the checklist based upon real-world conditions, is meaningless.

I'll be more nuanced.Doing operational security can enhance your security posture, but the real trick in cybersecurity isn’t just putting measures in place, it’s keeping them up over time. That’s where checklists come in.

A lot of companies get it wrong. They think the checklist is the security. But really, the checklist is just there to remind you that you did something right before and you need to keep it up. Treating the checklist like it’s the goal is where things go off track.