{"id":657,"date":"2024-05-09T06:55:20","date_gmt":"2024-05-09T06:55:20","guid":{"rendered":"https:\/\/xdr-mdr.lmntrix.com\/main_web\/?p=657"},"modified":"2025-07-29T08:12:42","modified_gmt":"2025-07-29T08:12:42","slug":"less-is-more-a-thinking-practitioners-take-on-cyber-defense","status":"publish","type":"post","link":"https:\/\/lmntrix.com\/blog\/less-is-more-a-thinking-practitioners-take-on-cyber-defense\/","title":{"rendered":"LESS IS MORE \u2013 A \u2018Thinking\u2019 Practitioner\u2019s Take On Cyber Defense"},"content":{"rendered":"\n
\"\"\/<\/figure>\n\n\n\n

When it comes to security, a paradigm shift is necessary for the best cyber defense\u2026 Attackers have changed the rules of cyber security, and cyber defense and incident response is NOT what it used to be five years ago. Security must be done differently, and defenders need to address this reality. And this post is semi-philosophical when it uses the phrase \u201cLess is MORE.\u201d<\/p>\n\n\n\n

Origins of Less is MORE mentality:<\/h3>\n\n\n\n

The phrase \u201cless is more\u201d comes from a poem by Robert Browning called \u201cAndrea del Santo.\u201d It was written in 1855 as part of a set of poems. The German-American architect Ludwig Mies van der Rohe\u2019s words and work made the phrase more well-known, and as most people have come to use it today\u2026<\/p>\n\n\n\n

Rohe\u2019s tried to make architecture design and ideas as simple as possible by using clean lines, putting an emphasis on geometry, and leaving a lot of white, empty space. People think of Mies van der Rohe as one of the people who started the modern minimalist style in architecture. The modern meaning of \u201cless is more\u201d is closely linked to anti-materialism as in \u201cminimalism\u201d, which emphasize surrounding yourself with the things you love, embrace the experiences that provide a lot of value and getting rid of the rest.<\/p>\n\n\n\n

Stop Trying to Fix the User:<\/h3>\n\n\n\n

Every few years, a researcher repeats the security study by leaving USB sticks around an organisation\u2019s grounds and waiting to see how many people pick them up and plug them in, which causes the Autorun function to install harmless malware on their computers. These studies are great for making people who work in security feel better about themselves. The security experts get to show off their skills and use the results as \u201cteachable moments\u201d for others. They say, \u201cThe Internet would be a much safer place if everyone knew MORE about security and had more security training.\u201d<\/p>\n\n\n\n

Enough is enough already\u2026 The users are not the problem. The problem is that we\u2019ve made our computer security so bad that the users have to do all of these strange things.  We need to STOP trying to fix the user.<\/p>\n\n\n\n

Why can\u2019t users choose passwords that are easy to remember? Why can\u2019t they just click on any link in an email? Why can\u2019t they just plug a USB stick into a computer and not have to deal with a bunch of viruses? Why are we trying to fix the user instead of fixing the security problem at its source?<\/p>\n\n\n\n

We have always seen security and usability as two sides of the same coin: a more secure system is less useful and more annoying, while a more capable, flexible, and powerful system is less secure. This \u201cEither\/OR\u201d binary way of thinking makes systems that are neither useful nor safe. STOP trying to fix the user and change the way you think about cyberdefense in 2023.<\/p>\n\n\n\n

The Problem is Not Outside, it is INSIDE \u2013 So start looking inward:<\/h3>\n\n\n\n

Apply this minimalist approach to security, what do you get out of LESS Is MORE from a business owner\u2019s perspective?<\/p>\n\n\n\n