In 1996 a group of hikers set off to climb Mount Everest. They had the correct equipment, were well trained and fit. However, on Mount Everest there is a rule. If you do not reach the summit by a certain time of the day, you must abandon your attempt. This particular day there was a traffic jam of sorts, and these hikers did not reach the summit at the specified time. At this point they should have turned around…. but they did not. They knew better. They were experienced hikers and they have done this many times before. They reached the summit too late, had to climb down in darkness, and sadly they all died. A sad story indeed.

What is even more sad is that we see this in businesses and information security today. It is called a five year strategy or a three year plan. The business context will change, the threat landscape will evolve, and evidence will start to emerge that the current strategy is a bad idea…. At that point we should stop, re-evaluate, and readjust our strategy…. But often we are already eighteen months into the journey, and several millions later. How do we at this point go back to the board and say we got this wrong? So, to avoid having to face the possibility that we are heading in the wrong direction, we sometimes increase our efforts in the wrong direction. 

As security leaders, we must do better than this. Let us always remain mindful of the changing cyberthreat landscape and business context and adjust our security strategies when required.