# Don’t try to explain my world to me!

- Link: https://smartnuts.com/2024/08/31/erklaere-mir-nicht-meine-welt/
- Veröffentlicht: 2024-08-31T18:01:51+02:00
- Autor: Michael Bunzel

I’m not going to waste my time ranting about generational conflicts or “everything
used to be better” nonsense. No – this is a rant about the consulting industry in
cybersecurity. It’s time to call out the nonsense and demand better.

Everyone knows them. They’re the self-proclaimed CEOs of some consulting clique,
the thought cybersecurity leaders, the keynote speakers, the cybersecurity strategists,
the trusted advisors, the executive digital and security leaders, the security natives,
the mentors, the C-level advisors, the cybersecurity advocates, the people who just
slipped out of the cozy environment of their university a few years ago and who 
then offer you the hottest shit from their consulting portfolio on some networking
platform or “conference.” These are people who, apart from the information on some
marketing and sales sheets, have had no connection whatsoever in their lives to 
the products or services that they are now trying to sell as “cyber solutions”.

These security zombies target people who have been in the industry for over 20 or
30 years. People, who have learned to reject the multitude of “let’s link via xyz.
com” requests with a single click.

After being quite some time in this industry, I am convinced that there is almost
80% “white noise” in the cybersecurity landscape today. This useless chatter has
no depth of content. It’s just marketing mumbo-jumbo, self-evident facts wrapped
in glossy paper, bullshit bingo, and lies. It’s a typical side effect of a sectoral
gold rush mood without substance and sustainability.

The remaining 20% is invaluable information that will advance the entire industry.
However, I can say with confidence that this 20% is not generated by the consulting
industry. It’s simple. The salary structures of the Big 4/5/6/x don’t appeal to 
experts who can initiate “the real next big thing” based on their wealth of knowledge
and experience. Secondly, such employers simply do not offer an inspiring working
environment for people with an unconventional, creative mind; people who are generally
incompatible with the typical consulting environment. The really valuable information
is often exchanged in discussions between experts, shared at specialist conferences(
usually free of charge), or published online as a research paper.

Absolutely. There are also positive exceptions in the consulting industry, which
is spreading like wildfire. But these exceptions are like a needle in a haystack.
It’s tough to find, highly specialized, and perfectly suited to a specific job. 
It’s not at all what consulting services need to “scale” from the vendor’s perspective.
These services are ordered because the buyer is either in really trouble or because
he needs carte blanche from a reputable firm to justify his own failures.

But let’s get back to the “propagators” of that white noise. You are responsible
for the current crisis in the security industry. Your actions have led to the sale
of security solutions whose complexity is beyond the capabilities of even the sellers
of these products – let alone your customers. These products have never undergone
a quality management process, have never been designed according to the basic principles
of a future-oriented security architecture, and have never been verified and validated
from a security perspective. They are rotten products and services that go to rack
at the customer’s place.

Let’s not forget the army of consultants who are fuelling this veritable fountain
of horror on the service/product side. They are obviously in a symbiotic relationship
with another professional group: security coaches. People who claim to have the 
agility to deliver WhateverKindOfOps without ever having gained any experience of
it themselves. They’re just like the eunuchs: they know how to do it. And customers
have no choice but to accept these promises of salvation because they don’t want
to be seen as “not agile” in this fast-paced world.

Take the time today to search for the relevant buzzwords from the security community
in your career network. You will quickly be overwhelmed by an ever-growing wave 
of security coaches who have the supposedly right answer to every question, no matter
how abstruse. What’s truly remarkable about this professional group is its capacity
to adapt swiftly to emerging challenges. Initially, it was the staccato of security
events that accelerated the growth of this professional group like a catalyst. Then,
the topics of crypto and AI quickly followed. Once these topics have all landed 
in the same pot, all you need to do is stir them around a little and the result 
is a fruity cocktail of buzzwords that can then be monetized.

I would be remiss if I did not mention a final professional group or industry that
goes alongside with the aforementioned security esoterics: the saviors of public-
private partnerships in cybersecurity. These economic players have zeroed in on 
the weakest links in the cybersecurity landscape of society as a whole: the public
administration. They have focused their product portfolios on these weak spots and
have made them their priority. The public administration is the most grateful when
it is given a helping hand with cybersecurity issues. Let’s be real: they’ve already
lost the war for talent before they’ve even entered it. Who is prepared to work 
for an E15 civil service salary with the cybersecurity knowledge that is in demand
today (in numbers it is just under 95 kEUR/year with 15 years of professional experience)?
And this is where the supposed helpers from the private sector come into play. They
work on the starving field of missing know-how and resources – and they do so gratefully.
It is not realistic to expect skyrocketing revenues in the short term. However, 
this industry has learned to think more long-term. Instead of opening up solution
spaces for customers that address their needs in a sustainable and targeted manner,
the opposite is done. Dependencies are created by using monocultures and product
lock-ins that ensure a revenue stream even years after the project kick-off. Design
decisions are influenced both operationally vis-à-vis the executive and through 
lobbying vis-à-vis the legislature. Public structures are penetrated with personnel
in order to jump on the next train that is heading in the direction of their own
product portfolio in good time. 

Let’s be clear: this has resulted in the well-known million-dollar graves we’ve 
seen in public administration in recent years. And on the other hand, we have a 
cybersecurity landscape that collapses like a house of cards at the slightest tremor
in its own sphere of influence. It’s logical. You can’t expect resilience in a monoculture.
The public sector is particularly vulnerable because even the largest private sector
companies cannot guarantee the security of the products and services they provide,
despite investing vast sums of money and employing highly skilled experts.

Sure – I’ve ask myself why I am complaining about this, especially as someone who
was once part of the army of consultants. To be honest, I believe that many consultants
may not fully realize that the consulting firms are providing them with a valuable
opportunity to gain insight into their own inclinations, desires, and interests.
This can be an important step in their journey towards becoming a seasoned expert,
especially after years of experience. It appears that the concept of “seeking wisdom
along the way and ultimately making yourself indispensable through this accumulated
knowledge” has given way to a different idea of success. This new idea seems to 
be that of the typical influencer who has gone from precarious circumstances to 
becoming a winner (whatever “winner” may mean in this context) in no time. One can
see the result of this development everywhere. It is often the case that the “shortcuts”
that many seek and find are, in fact, the root cause of flawed risk decisions, which
in turn lead to the unfortunate headlines we see time and time again regarding cybersecurity
events. While headlines may suggest otherwise, it’s crucial to recognize that the
root cause of these incidents was not necessarily the advanced persistent threats,
state-sponsored hackers, zero-day attacks, or even the heightened criminal sophistication
of the attackers. In many cases, the underlying issue may have been a Layer8 vulnerability.