What Listening to My Father Taught Me About Cybersecurity

So what?: When evaluating whether to pursue a suggestion, it can be helpful to ask the question: "So what?" If I were to pursue this, what impact would it have? Is there a real potential for any outcome that would be worth it, or will this merely be a time sink? If the impact is nonexistent, that is probably a sign that we can safely ignore it. In our scenario, improving API security is almost certain to yield value, so the suggestion would remain on the table.

What's my action?: It can also be helpful to think about what, if any, action is required from you. Is any action required? Will this bring tangible results? Or is this just a whirlwind of information that will not yield any material change in your day-to-day? If there is no action, you can probably look elsewhere for suggestions. Improving the state of API security would definitely involve action from me, so I'm still listening.

Practicality: Unless we are in a theoretical research position (which most of us are not), any idea we consider needs to have a practical application. It can be helpful to ask the question: "Is this an academic exercise?" If it is, it is probably safe to move along. There are many API security improvements a colleague might recommend to me that would have real-world impact, so I'm still taking notes.

Strategic fit: Most security teams have a strategic direction that includes priorities designed to steer them in that direction. If some new API solution grabs people's attention, for example, it is worth my taking a moment to slow down and assess whether it fits the team's strategy. If not, it is probably best to move along.

Detraction: When assessing a suggestion, most people will think about what it could potentially bring to the security team. What fewer people consider, unfortunately, is what the suggestion could detract from. This is an important point to consider, however. If pursuing a suggestion will take away from other, more important activities, it is likely not a good one. If this theoretical API security project took resources away from threat detection and response, we'd want to know that and weigh the pros and cons.

Source: When an idea is suggested, it can be helpful to consider the source. Some people suggest practical, actionable ideas that fit the organization's strategic direction and don't detract from other important activities. Other people suggest ideas that are more half-baked. It is worth asking: "Has this person led us astray in the past?" If they have, it is likely safe to ignore their ideas, absent any compelling evidence that the ideas are good ones. If, for example, my colleague tends to make suggestions based on their friends' social media posts, I am less inclined to get excited about any new API security ideas they bring up.