·
People, Process and Technology
Security is not just about technology.
Buy another tool. Skip the boring training. Leave the incident playbook as a PDF nobody has opened. Then wonder why the breach still happened.
People, process, and technology only work as a set. One weak leg tips the stool.
People
Everyone from the CEO to the contractor with a laptop. One wrong link, one mis-sent email, one over-privileged account, one person who knows how to work around the controls - that is enough.
Your staff are also the first line of defence. They need the threats that actually matter for this organisation, not a generic awareness video. Where are the policies? How do you report something weird? Who answers at 2am?
Hiring checks and least privilege are not optional extras. Access should match the job, not the org chart politics.
When you talk to people about this:
- keep it short
- use examples from their work
- humour helps more than fear slides
Processes
Process is how work actually gets done when someone is busy, stressed, or new. Without it, security is "ask Sarah" until Sarah is on leave.
You need a policy that states what you are protecting and why, plus procedures people can follow under pressure - especially incident response. Review them when the business changes, not once a year as theatre.
If nobody can find the policy, or everyone says it is unreadable, you do not have a process. You have shelf-ware.
Technology
Technology multiplies whatever you already do - good or bad. Attackers get the same multiplier.
Pick tools with security and privacy in mind from day one. Defence in depth, configuration that matches the threat, and regular tests that the controls still work. Technology does not replace people or process. It amplifies them.
Try this week
- Find your policies. Ask three people if they know they exist and whether they make sense.
- Check whether your last awareness training used threats that match your real risk.
- Run one phishing test or access review and measure what broke.
- Pick a framework (even a light one) and score where you actually are - not where the slide deck says you are.
Sweat in practice. Bleed less later.
Related
- Threats, Risks, and Controls for using people, process, and technology to map the risk chain
- Security vs. Compliance for why compliance is the floor and security sets the priorities
- Confidentiality, Integrity, and Availability for how the CIA triad applies across people, process, and technology