operations

Your First Security Hire Is a Prioritisation Problem Disguised as a Recruiting One

The job description lists fifteen domains and describes a person who does not exist and would not want the job if they did. The role you need is narrower and harder to write down.

The System Nobody Touches Is Unpatched by Default, Not by Decision

It works, it matters, the person who built it has left, and everyone has agreed without discussing it that touching it is riskier than leaving it. That agreement gets more expensive every month.

Nobody Notices When a Scheduled Job Stops Running

They run at three in the morning with broad credentials, unattended, and failure produces nothing because the output was always invisible. A retention job that silently stops means you are keeping data you promised to delete.

Compliance

An Engineer's First Week Sets Their Access for Three Years

Whatever they are granted on day two, they keep, because nothing removes it and asking for less is not a thing people do. The decisions get made by whoever is unblocking them at the time.

Compliance

Nobody Decided That Everyone Should Have Production Access

It was obviously right at eight people and nothing has forced a decision since. At some point the number who can read every customer's data stops being one you would say out loud, and nothing breaks to tell you.

The Postmortem Was Good. The Action Items Were Not Done.

Nine items with named owners. Six months later two are done, four are in a backlog, two were closed without checking, and one is the direct cause of the incident you are having now.

Compliance

Every Production System Has Accounts Nobody Created on Purpose

The demo tenant from the launch, the test user from a 2023 bug, the seed administrator that shipped with the first deployment. None appear on an access review, because reviews enumerate employees and these live in the product's own user table.

Time Is a Security Dependency Nobody Declares

Clocks disagree, and things expire. Both produce outages that look like security failures, both are entirely predictable, and both are usually discovered by a customer.

Your Health and Metrics Endpoints Describe Your System to Anyone Who Asks

Nobody designed them. A framework, a platform team or a monitoring integration added them, they were configured once, and they are the endpoints that describe your architecture most accurately.

An Audit Log You Can Actually Answer Questions With

During an incident you get asked three questions. If answering takes a week of grepping application logs, you do not have an audit log, you have debugging output that happens to contain some of the answer.

Deciding a Security Incident's Severity While You Still Know Nothing

Outage rubrics rate impact, which you can measure while it happens. A security incident's impact is unknown at the moment you must classify it, and often stays unknown for days. Rate the observation instead.

Write the Runbook for a Tired Stranger, Not for Yourself

Most runbooks are written by the person who least needs them and read by someone who has never seen the system, at night, afraid of making it worse. That mismatch explains nearly every runbook failure.