Reader

You know your client security posture needs to be strong, but how do you know what is good enough?

Security is a sliding scale.

It's a constant battle between cost and security. Sure, you could throw crazy amounts of money at the problem, but in what case is that necessary?

Your clients don't have an enterprise-level budget to dedicate to security.

As a former Citrix administrator I used to fight a similar battle on uptime. How much was enough to keep the systems up?

How much downtime was the business willing to tolerate?

In some cases, 2 hours wasn't that big of a deal. In other companies, 20 minutes costs them tens of thousands of dollars.

This is where the five nines conversation came in.

Executives would tell me they want five nines of uptime (99.999%).

"Sure you can have five nines, but it's gonna cost you X." I would tell them.

They would often deflate and say, "Oh... well... maybe three nines will do."

🙂

It's the same in security. Having a strong posture is critical for everyone's protection.

99.999% protection often isn't necessary, though.

No one wants to have a breach, but isolating a workstation and dealing with it afterward is A LOT cheaper than active countermeasures.

I would encourage you to invite clients into that decision.

How much security is enough, and what are their risk tolerances?

If you discover they have a very low risk tolerance, great! Work with them to develop a more advanced solution. Worst case, they have a better understanding of what they pay for, and the realities of breaches happen sometimes.

​

​

​

​

​

​

​

​

​

​