Simplify or Sink: Practical Strategies for Streamlining Security Processes

Simplify or Sink: Practical Strategies for Streamlining Security Processes

Speakers: Sebastian Avarvarei, Information Security Manager, Canon EMEA

Conference: DefCamp

YouTube: https://www.youtube.com/watch?v=aVF-p-GT9JY

Overview

In today's rapidly evolving threat landscape, security teams are often overwhelmed, perpetually understaffed, and bogged down by inefficient processes. Sebastian Avarvarei, Information Security Manager at Canon EMEA, addressed this critical challenge in his DefCamp talk, "Simplify or Sink: Practical Strategies for Streamlining Security Processes." Avarvarei presented a compelling argument for re-evaluating and optimizing security workflows, asserting that the traditional approach of embedding security personnel in every operational step often creates bottlenecks rather than enhancing security. His core message revolves around the concept of "doing more with less" – a vital skill in an era of constrained resources and increasing demands.

The talk highlights that while processes are the backbone of any large organization, they often become convoluted, outdated, and counterproductive within the security domain. Avarvarei champions a shift in mindset, urging security professionals to critically question the purpose and effectiveness of their involvement in various processes. By drawing parallels with established business efficiency methodologies, he provides actionable strategies for identifying problematic processes, redesigning them for optimal security and efficiency, and ultimately empowering organizations to integrate security more effectively without draining valuable security team resources.

Avarvarei's presentation is not merely a call for efficiency; it's a strategic guide for transforming security teams from operational gatekeepers into influential advisors and designers. By focusing on defining clear security goals, responsibilities, and leveraging automation and auditing, security professionals can step out of the operational minutiae and focus on higher-value activities. This approach promises not only to streamline security operations but also to foster a deeper understanding and ownership of security responsibilities across the entire organization, aligning security efforts with broader business objectives.

Background

▶ Watch: The core problem and mantra for effective security processes (4:47)

The problem addressed by Avarvarei is a pervasive one: security teams are constantly busy, often feeling like they are "drowning in tickets" and requests. While processes are essential for structure and predictability, security teams frequently find themselves entangled in an ever-growing web of workflows, leading to significant inefficiencies. The speaker notes that he has yet to encounter a company that feels it has "enough security people," underscoring the universal challenge of resource scarcity. This scarcity necessitates a strategic approach to how security resources are allocated and utilized.

Avarvarei emphasizes that security professionals often get lost in the sheer volume of tasks, neglecting to ask fundamental questions such as: "Why are we doing it this way?" "What is the risk we are actually reducing by being part of this process?" and "What is the problem we're trying to solve?" This lack of critical inquiry leads to the perpetuation of outdated or ineffective processes. A recent survey Avarvarei conducted at another conference revealed that approximately three-quarters of the audience felt involved in "too many processes," confirming the widespread nature of this issue. The current operational model, where security is embedded as a gatekeeper in every step, creates bottlenecks, wastes resources, and paradoxically, can even lead to a false sense of security. This problem is exacerbated by the tendency to add more processes as a default solution, rather than critically examining the root causes of security challenges.

Key Findings

▶ Watch: Real-world example: Redesigning SharePoint access for partners (19:30)

Avarvarei introduces a powerful diagnostic framework for identifying inefficient and problematic security processes, which he terms the "Four Horsemen of the Processes Apocalypse." These are red flags that indicate a process is ripe for optimization or elimination:

1. "We've always done it this way.": This is the "bane of my existence," according to Avarvarei. It signifies a lack of understanding of the process's original intent or current relevance. Such processes are inefficient, potentially dangerous (giving a false sense of security), and likely designed for a threat landscape that no longer exists.
2. "Just to see what's happening.": Security teams often embed themselves in processes merely to monitor or "see what's going on." This is a significant waste of resources and, more critically, a signal of a deeper governance problem. Instead of fixing the underlying issue of bypassed security, teams compensate by adding themselves as observers, creating unnecessary overhead.
3. Processes where you never reject. If a security team consistently approves every request within a process, it indicates a diluted sense of responsibility. Approvals become a rubber stamp, providing a false sense of security without genuine scrutiny. Teams often lack the necessary information to make informed decisions, merely passing responsibility without truly owning the risk.
4. Security doing administrative tasks. This refers to instances where security personnel are performing non-security-related administrative checks, such as verifying form completion or correct field entries. Avarvarei stresses the business concept of "do only what you can do," meaning security teams should focus solely on actual security work, not administrative overhead that others are better suited to perform.

These four red flags serve as clear indicators for security teams to challenge their current involvement and initiate a critical review and redesign of their processes.

Technical Deep Dive

▶ Watch: Applying threat modeling to identify process risks (23:50)

The core of Avarvarei's solution lies in a multi-faceted approach to process redesign, drawing heavily from established business methodologies and a critical mindset shift.

Challenging the Status Quo and Mindset Shift:

The first step is cultivating a critical mindset: "Do I need to be in that process?" Security teams often believe that direct involvement is necessary to secure a process. Avarvarei argues this is fundamentally flawed. Instead, security should act as an advisor and designer, defining security goals and responsibilities for others within the process, rather than being an operational bottleneck. This involves setting clear security goals, defining responsibilities for individual steps, and establishing auditing tools or automation to maintain control and accountability without direct, manual intervention. Documentation of all redesign decisions and assumptions is crucial for future reference and ongoing review.

Remediating the "Four Horsemen":

• "We've always done it this way": This requires process redesign and challenging assumptions. Security teams must question the initial intent and current relevance, focusing on real responsibilities and the problem being solved.
• "Just to see what's happening": The solution is to get out of the process and address the underlying governance problem. Alternatives include creating automated reports or technical automation to gain visibility without active participation.
• Processes where you never reject: This calls for checking assumptions and ensuring the security team possesses the necessary information to make informed decisions. If not, the responsibility should be pushed back to the rightful owners, or the security team should exit the process.
• Security doing administrative tasks: Security teams must adhere to the principle of "do only what you can do." They should focus exclusively on security-specific tasks, such as restructuring requirements or implementing automation, and delegate administrative checks to appropriate personnel or systems.

Threat Modeling for Processes:

Avarvarei advocates for applying threat modeling, a technique typically used in application security, to processes. This involves identifying and tracking risks and their mitigations within a workflow. When threat modeling processes, two main categories of threats must be considered:

1. Threats for the systems being protected through the process.
2. Threats within the process itself, i.e., what can go wrong if the process is not followed correctly or is inherently flawed.

Threat modeling encourages documentation, which is vital for maintaining a "living book" that is periodically reviewed for validity and relevance. While sophisticated methodologies like STRIDE or PA can be used, Avarvarei emphasizes starting simple, perhaps with just two columns: "Threats" and "Mitigations," to build the habit. An example for admin account access threat modeling might list threats like "employees accessing without need" or "external attackers gaining access," with corresponding process or external mitigations.

Learning from Business Methodologies:

A significant technical recommendation is to leverage existing process redesign frameworks and methodologies from the business world. Avarvarei highlights that these techniques, developed over decades (e.g., Lean methodology, Six Sigma, Theory of Constraints, Business Process Reengineering), are not security-specific but are highly effective and readily applicable. Learning these methodologies offers several advantages:

• Efficiency: They provide proven approaches to optimize workflows.
• Common Language: They enable security teams to communicate more effectively with business stakeholders, fostering better collaboration.
• Existing Resources: Many organizations already have training and documentation for these methodologies, making adoption easier.

Avarvarei suggests starting with qualitative methods for quick results and then progressing to quantitative methods for measurable, provable improvements in efficiency (e.g., "improved efficiency by 30%"). He mentions the "Five Whys" technique (from Lean) for root cause analysis and the Theory of Constraints, which states that a process's overall output is determined by its slowest step.

Metrics for Measuring Success:

To demonstrate the value of process improvements, Avarvarei recommends utilizing established frameworks for security metrics:

• Pragmatic Security Metrics: This framework offers a predefined set of metrics and guidance on how to measure them effectively, helping to select the most suitable metrics for specific problems or dashboards.
• ISF Measured Security Community: For companies that are members of the Information Security Forum (ISF), this community provides useful tools for measuring security, often simpler to apply than other frameworks.

These metrics are crucial for proving efficiency gains to management, which can be vital for job security and continued investment in security initiatives.

Demo / Proof of Concept

▶ Watch: Summary of five key takeaways for process improvement (38:50)

While the talk did not feature a traditional live "demo" of a security tool or exploit, Avarvarei provided two compelling demonstrations of how process redesign principles and methodologies can be applied in real-world scenarios.

1. SharePoint Access for Business Partners (Process Redesign Example):

Avarvarei detailed a past scenario where business partners required access to confidential data on SharePoint, necessitating Non-Disclosure Agreements (NDAs). The original process involved security manually reviewing each NDA for correct clauses, then sending it for implementation if approved, or rejecting it if not. This was a cumbersome, time-consuming bottleneck.

The redesigned process involved several key changes:

• Standardized NDAs: Encouraging the use of pre-approved standard NDAs, which bypass security review. Only partner-provided NDAs would go to legal (not security).
• Policy-Driven Accountability: Implementing a clear policy stating that the business requester is responsible and accountable if a third party accesses data without a valid NDA. This shifts ownership and encourages compliance.
• Tooling Integration: Integrating tooling into the request process to ensure that necessary fields (e.g., NDA status) are filled, forcing compliance.
• Sample-Based Auditing: Instead of individual reviews, security transitioned to taking a sample of requests on a regular basis (e.g., quarterly) to check for proper adherence. This significantly reduced the security team's operational burden to "a tenth of the time."
• Adding a Revocation Process: A critical security improvement was the addition of a process to revoke access. Every quarter, the original requester would receive an email inquiring about the continued validity of the third party's access. If no legitimate need was confirmed or no response received, access was automatically cut. This not only streamlined operations but also significantly improved the security posture by minimizing stale access.

This example effectively demonstrated how process redesign can both improve efficiency for the security team and enhance overall security.

2. The Q-Chart Methodology (Process Redesign Tool Demonstration):

Avarvarei demonstrated how easy it is to learn a new process redesign tool using the Q-Chart, a type of decision matrix methodology. He walked through a theoretical example: a company where approvals for new cloud deployments take too long due to multiple sequential approvers.

The Q-Chart demonstration involved four steps:

1. Define the Problem and Goal: Problem: Slow cloud deployment approvals. Goal: Improve the process, make deployments faster.
2. Define Options: Three hypothetical approaches were considered:

• Keep the current process but add automation between steps (notifications).
• Implement workflow tools for parallel approvals.
• Outsource the approval process.

1. Define Criteria: Measurable criteria for evaluating options were established:

• Speed of approval
• Level of compliance assurance
• Cost
• Ease of implementation
• Risk reduction

1. Create and Score the Matrix: A table was created with options as columns and criteria as rows. Each option was scored against each criterion (e.g., "minus minus," "zero," "plus plus"). Crucially, the "current process" was included as the first column to establish a baseline. By summing the scores, the methodology objectively identified the best option.

This demonstration highlighted the simplicity and effectiveness of qualitative methods for making complex process decisions, emphasizing that even complex business tools can be quickly understood and applied to security challenges.

Defensive Implications

▶ Watch: Q&A: Pitfalls and effective compliance communication (41:30)

Sebastian Avarvarei's talk provides a critical roadmap for security defenders to move beyond a reactive, operational mindset towards a proactive, strategic one. The key defensive implications are:

1. Proactive Process Auditing: Defenders must actively identify and challenge existing security processes using the "Four Horsemen of the Processes Apocalypse" as a diagnostic tool. This means regularly asking "Why are we doing this?" and critically evaluating the value derived from each process.
2. Shift from Bottleneck to Enabler: Security teams should transition from being operational gatekeepers (bottlenecks) to strategic advisors and designers. This involves defining clear security requirements and responsibilities for others, rather than embedding security personnel in every approval step.
3. Implement Process Threat Modeling: Extend threat modeling practices beyond applications and systems to encompass internal security processes. Identify threats to the systems being protected and threats inherent in the process itself. This helps in designing more resilient and secure workflows.
4. Leverage Automation and Auditing for Control: Instead of manual checks and approvals, defenders should implement automation for routine tasks and rely on periodic auditing (e.g., sample-based checks) to ensure compliance and accountability. This frees up valuable security resources for higher-level strategic work.
5. Embrace Business Process Improvement Methodologies: Actively learn and apply established business frameworks like Lean, Six Sigma, or the Theory of Constraints to security processes. These methodologies provide proven strategies for efficiency and offer a common language for collaboration with business units.
6. Focus on Measurable Outcomes: Adopt security metrics frameworks such as Pragmatic Security Metrics or the ISF Measured Security Community to quantify the impact of process improvements. Demonstrating tangible gains in efficiency and risk reduction is crucial for securing resources and proving value to management.
7. Document and Regularly Review: All process redesign decisions, assumptions, and threat models must be thoroughly documented. This documentation should be treated as a "living book" and reviewed periodically to ensure continued relevance and effectiveness against evolving threat landscapes.
8. Foster Organization-Wide Security Responsibility: Clearly communicate the "why" behind security requirements and processes. By explaining the risks being mitigated and defining specific security responsibilities for all stakeholders, defenders can cultivate a culture where "security is everybody's responsibility" is genuinely understood and acted upon, rather than merely being a slogan.

By adopting these strategies, security teams can streamline their operations, reduce burnout, and significantly enhance their overall effectiveness and strategic influence within the organization.

Key Takeaways

• Identify Problematic Processes: Utilize the "Four Horsemen of the Processes Apocalypse" (doing it "just because," being involved "just to see," never rejecting, or doing administrative tasks) as red flags to pinpoint inefficient or ineffective security processes.
• Security as Designer, Not Just Operator: Security teams do not need to be an explicit step or bottleneck in every process to secure it. Instead, focus on designing secure processes, defining clear security goals and responsibilities for others, and leveraging automation and auditing for control.
• Leverage Existing Business Methodologies: Avoid reinventing the wheel. Adopt proven process redesign frameworks and methodologies from the business world (e.g., Lean, Six Sigma, Threat Modeling) to improve efficiency and foster a common language with business stakeholders.
• Measure and Quantify Improvements: Start with qualitative methods for quick wins, but strive to progress to quantitative metrics using frameworks like Pragmatic Security Metrics to objectively measure and prove the efficiency gains and risk reduction achieved through process optimization.
• Communicate the "Why": Clearly articulate the reasons behind security requirements and processes. By explaining the risks being mitigated and defining individual security responsibilities, security teams can empower the entire organization to contribute effectively to the overall security posture.

About the Speaker(s)

Sebastian Avarvarei is an Information Security Manager at Canon EMEA, with over 20 years of experience in IT and security. He began his career on the technical side, specializing in software development, before transitioning into roles focused on security management, governance, and efficiency. A self-professed "big fan of learning from my mistakes," Avarvarei is dedicated to optimizing security operations and sharing practical strategies for doing "more with less" in the security domain. His extensive background provides him with a unique perspective, bridging the gap between technical implementation and strategic security leadership.