RSAC 2021 Keynote: Telling Hard Truths to Impact Change in Cybersecurity

This RSA Conference 2021 keynote conversation features Angela Weinman (Head of Global Governance Risk and Compliance for VMware) and Jimmy Sanders (Information Security for Netflix) discussing three fundamental truths about cybersecurity that require immediate attention to drive meaningful change and improve organizational resilience.

**First Hard Truth: Security Risk Picture is Out of Focus** Research shows less than half of top executives are satisfied with how their resiliency risk plans were executed, reflecting that security professionals tend to be overly conservative when predicting risks and impacts. The speakers advocate shifting from narrowly defined risk scenarios to a broader spectrum-of-impact approach. Using the pandemic as a case study, most organizations planned for a small subset of employees working remotely temporarily, but reality required virtually everyone to have remote access for extended periods. Those organizations that pivoted fastest either had broader contingency plans or were further along their digital transformation journey. The recommendation is to present spectrum-based risk views across the organization—to CISOs, risk committees, executives, audit committees, and boards—allowing business stakeholders to participate in determining acceptable risk levels. Additionally, security teams should avoid treating all assets and environments uniformly; instead, environments should be prioritized so that loss of less critical systems doesn't cascade into organizational failure.

**Second Hard Truth: Legacy Security Practices are Slowing Us Down** Both speakers emphasize abandoning outdated security processes that have accumulated like geological layers—inflexible and heavy, constraining security teams and business units. They advocate challenging the "how" and "why" behind every security process, questioning whether box-checking activities still serve genuine security goals. Jimmy Sanders highlights that diversity means bringing various perspectives into the conversation, while inclusion means actively ensuring those voices are heard and valued. Organizations can build resilience by conducting monthly proof-of-concept evaluations of new tools and techniques. New team members often identify redundant work because they lack ingrained assumptions about standard practices. The speakers recommend mapping security efforts back to cyber hygiene fundamentals and business objectives, eliminating practices that don't align, and continuously challenging legacy approaches—necessary to scale and move faster in the modern threat landscape.

**Third Hard Truth: Security is Not a Solo Sport** No single company, regardless of sophistication, can unilaterally reduce industry-wide security breaches. Security professionals function as "superheroes" whose collective power achieves what no single entity can. Knowledge-sharing within the security community is essential; the most rapid growth in security practices occurs when organizations share both successes and failures. Relationships and connections are foundational to security success at all career stages. Jimmy Sanders leads the ISSA International emerging technology group, which aims to explore, document, and distribute information to the security community. Both speakers stress that peer support is a two-way street and emphasize that "we need each other now, more than ever."

**Takeaways:** The speakers distill their message into three actionable steps: (1) **Zoom Out** by adopting a wide-angle perspective on risk and letting business stakeholders help define acceptable risk levels; (2) **Throw Out** legacy security processes that no longer provide value; and (3) **Reach Out** to leverage professional relationships, join communities of practice, and share knowledge. They conclude that shared accountability, increased diversity, and a commitment to scientifically effective techniques—paired with genuine collaboration—are essential for driving meaningful progress in cybersecurity.