A Pathway to Yes with Rich Casselberry

Security is hard because you're proving a negative. Casselberry's team sifts roughly one billion log entries a day, about 30 billion a month, to find the needles. Stopping 85 billion attacks at the firewall counts for little next to the one that gets through.

For 99% of organizations the goal is balanced risk. Maximum security is the wrong target. Outside agencies like the NSA, FBI, and CIA, you weigh profitability and operational efficiency against control. The line between too secure and not secure enough is half a mile wide, and hitting it precisely is not the point.

Automated action reframes the security team from enforcer to helper. When a tool acts first, the call becomes "security can help me fix this." The user no longer feels security caught them doing something wrong. Casselberry calls this a cultural shift.

Casselberry describes defense as four knobs you can turn up or down by risk: who can reach a system, how exposed it is, how fast you patch, and how aggressively you automate. Tie them to a threat feed and tighten them when a campaign is active.

Never start with no. Listen to what someone is trying to do, then find a different yes. Casselberry turned a risky open access point request into a locked-down VPN profile. The requester became a security evangelist. He told colleagues the security team would help them find a way.