Some systems are only as good as their weakest part. Others are defined by their strongest. Rowing is an example of the first type as the weakest rower can often dictate the outcome for a boat during a race. Basketball can be used as an example for the second type where a superstar can carry a team. I learned of this idea while reading Fluke by Brian Klaas and I couldn’t help but see how it applies to different areas of cybersecurity. Based on my experience as an industry we approach the majority of security through a strong-link lens. However, if we really want to improve the security posture of a company viewing it through a weak-linked system can yield larger gains.
When executing a specific, concrete task, a strong-link viewpoint is often best. The moment the work touches multiple systems, teams, or tools, a weak-link viewpoint produces better outcomes.
Strong-linked Security
Many offensive cybersecurity tasks are great examples of security work that is strong-linked; anywhere the output is a security issue/vulnerability. Having one solid tester (similar to a stand-out basketball player) can find enough issues that it can tie up a company or team for weeks if not months. Comparing this to using ten low-skilled testers evaluating the same target and the results will be drastically different. In general the idea being that focusing on the strongest tester in a given project will increase the chance of high-quality issues being found, which is very much a strong-link system.
Many variables can impact the quality and output from people or tools. Things like how well a person slept, what is going on in their life, how many other things they are juggling at work, or in the case of tools, how well the tool has been configured, what context it has been given, who is running it, what version is being used, and the list goes on and on.
A highly-scoped tactical task should be viewed as a strong-link system, where we want to use the best tool / person for the task and when we do the outcomes can be exponentially better than if we don’t. However, when we look at the bigger picture in security taking a weak-link viewpoint leads to improving the overall security posture at a company.
Where is Security Weak-linked?
Anyone who has spent time as a security person has heard the idea that an attacker only has to find one gap in the armor while defenders have to solve all the problems. It is a great sound bite but it doesn’t really reflect reality. The intent behind that statement is good; defenders have the odds against them. And if the goal is to prevent all breaches or security issues from ever occurring then, yes, the statement is true. However, that is like trying to protect your kid from never getting hurt; impossible. In reality we can make it harder for attackers to get in and when they do get in minimize the blast radius and hopefully speed up detection. Is this easy? No. Is it possible? Yes! How does this tie into the idea of weak-linked systems?
If we take a step back and take into account a company’s operating context (what type of things do they do, what data they hold, etc.), what controls they have in place, and what a bad business-impacting attack would be for them we can then prioritize areas to improve in the near future. As an example an oil company’s business-impacting attack is quite a bit different than a hospital’s which is quite a bit different than a SaaS company. Are there some standard controls we should still put in place across all of them? Yes. As usual though the devil is in the details. Let’s walk through one of the company types above.
Say we just got hired as a security leader at an oil company. How does the company make money? In this case they make money from extracting oil out of the ground, finding new oil reserves, and getting the rights to said oil. With this in mind is it business-impacting if the website gets defaced? Doubtful. Is it bad if an attacker gets into the system(s) that is holding the data showing possible new oil reserves? Yes.
When we focus on the business-critical assets to protect, we can review the safeguards and controls for that area — things like monitoring and alerting, access, and data storage. After reviewing we want to test what we have been told to confirm reality vs. perception. With that in mind we might find that access is highly restricted and is just in time, monitoring is solid, and its main storage is encrypted and can’t be directly accessed from the Internet. However, once someone has access there is nothing stopping a person from copying that information on to another device nor is there any device posture check to confirm the person is connecting from a hardened system. With all of these controls in place (which are great) we have now found an area we can shore up to make it even more challenging for an attacker.
Using a weak-linked approach has allowed us to focus on protecting a truly business-impacting asset. Instead of trying to protect the company at large, where we might have focused on our EDR deployments, or making sure our log sources were correct, or that we use SAST across all of our repos, we shored up the asset that actually matters. In my view our job as security leaders is not to prevent a breach but rather when it occurs that the business survives and gets back up and running as quickly as possible.
It is easy to say we have a huge number of critical issues that need to get fixed and no one is fixing them. However, figuring out which systems with criticals actually need to get patched and if there are other controls we can put in place is where we can leverage weak-link thinking. Making these trade-offs requires judgement, ownership, and being ok that we might get it wrong. No matter what we do we can’t eliminate all of the risks at the company but we can focus on the weakest link protecting our most vital assets and fix those problems first.
Take the recent guidance saying we need to patch faster or that the latest LLM frontier model is finding so many bugs so quickly that we are all going to get exploited. Should we try to patch quicker? Yes, what else is new. Should we minimize the number of bugs in our systems? Yes. However, even if we tackled those two problems it wouldn’t ensure that those activities have helped us improve the security posture in the right areas. Sometimes patching resources so that there are no known security vulnerabilities isn’t going to materially change a company’s security posture and sometimes it will. It is on us as security leaders to see what is actually going to help a company survive and thrive and what is just busy work.
Wrapping Up
In my experience I see security practitioners default to strong-linked thinking when in reality the most impactful work we can do is weak-linked.
Framing security as a set of strong or weak-linked systems can help us figure out how to approach problems. People way smarter than me have said attackers think in graphs (e.g. Dave Aitel, John Lambert) and the vast majority of people don’t. I agree with this and I also think it ties into the strong and weak-linked systems. The vast majority of people seem to think in terms of the silver bullet that is just going to fix security when in reality it is more nuanced and balanced. It is our job as security leaders to figure out the balance and more importantly communicate that to our teams and executives so they can understand our approach and push back when there is a problem with our approach.