Worth Reading: How CEOs think
Robert Graham wrote a great article explaining why CEOs don’t care much about cybersecurity or any other non-core infrastructure (including networking, unless you happen to be working for a service provider). It’s a must-read if you want to understand the **** you have to deal with in enterprise environments.
"The next time your management claims IT is not your core business, remind them that Maersk, a shipping and logistics giant founded in 1904, with 35 billion revenue anually, almost went out of business due to ransomware affecting AD and Windows env. IT IS your core business."
Sometimes the CxO's need to be reminded before %$#@ hits the fan. And there's no better time than now, just ask Garmin.
In fact, I would argue that a solid security scheme can be executed with a mix of open source software and hardening your existing server configs. No need to wait for your next unicorn budget, make do with what you already have. Focus on the Mitre A@ttack framework's point of entries. Forget the silver bullet, work at improving what you already have in place, get visibility and logging in place (nxlog, sysmon, graylog is a great start).
If you absolutely need to buy that fancy box, make sure you look at what's already out there 1st. (Security onion, opnsense, graylog, efa, helk, and many more. )
Mario
@Mario: While I completely agree with everything you wrote, unfortunately your ideas go straight against the mentality described in the article. CxOs want to offload what they consider to be non-essential parts of their business (cleaning, power, air conditioning, water, IT...) not be burdened with staff that glues together an open-source puzzle.
You might be able to start a service company that takes the open-source bits and integrates them into something a CxO can buy though. I know several companies using this model. IBM/RH immediately comes to mind ;), and would be Gartner-blessed on top of everything else, but there are also small companies doing a great job in this space.