Embed Notice

#infosec professionals. Do you ever feel like we've gone 2 or 3 levels too meta in our field?

What I mean is, actually securing a business with 2FA, password managers, and code reviews for #OWASP top 10 issues all seem practical, and useful.

But once we get into "Cyber Security Frameworks" and iso-27001 audits, and a bunch of GRC (Governance) stuff, it feels...abstract, to the point of being work for work's sake, and not for actually getting the result of improved security.

Thoughts?