You're facing a clash between security policies and user convenience. How can you find the right balance?

To balance security and ease of use, start by understanding how people work and adjust security rules based on what they really need. Use tools like single sign-on (one login for everything) and simple two-step verification. Keep security in the background when possible, listen to feedback, and make sure everyone knows why security is important without making things too complicated.

Cpllect and classify all the data(Ex: identities, applications domains, training, op model, tools/tech, etc.) and establish risk scores based on Risk assessment. There are two system assessments available for System/Business Owners to meet the current requirements of the ATO process: the SCA and Cybersecurity and Risk Assessment Program (CSRAP). Establish a framework to assess the effectiveness of the current controls in mitigating risks/ Threats - involve all the relavant stakeholders Example : workshops to conduct gap analysis to identify potential risks Build a baseline model (current state) and then build an Maturity framework(improvements to the existing, operational Data Governance) that tailors with your security strategy

Regular checks, employee training, and understanding potential threats are crucial. When security conflicts with business needs, find the root cause and adjust policies accordingly. Always consider legal and regulatory requirements.

During a routine security audit, I noticed that one department was consistently slow in adopting the new security protocols we had implemented. Rather than sending out another round of stern reminders, I decided to spend a day shadowing the team to understand their workflow. It turned out that the protocols, while secure, were interrupting their processes and causing frustration. I worked with them to streamline the security measures, ensuring both security and efficiency. As a result, compliance in that department increased by 40%, and the team felt more confident and valued. This experience reinforced my belief that effective cybersecurity leadership is about understanding and integrating into the daily operations of the business.

By involving key stakeholders like IT, legal, compliance, and end-user teams in the assessment process. Each group offers valuable insights—for example, IT might highlight technical vulnerabilities, while end-users can provide feedback on potential disruptions to daily work. Engaging diverse perspectives helps design security policies that protect assets while aligning with operational workflows. Additionally, consider the regulatory and compliance environment in which the organization operates. This holistic approach ensures security policies are both effective and sustainable.

Beyond SSO and RBAC, incorporating multi-factor authentication (MFA) enhances security without overburdening users. By requiring a second form of verification, such as a mobile app or biometrics, MFA adds an extra layer of protection while still allowing seamless access. Another approach is adaptive authentication, which adjusts security requirements based on user behavior and risk level—granting flexibility where appropriate and tightening controls when necessary. This dynamic method balances user convenience with robust security, ensuring that both are maintained effectively.

Alignment of security and business goals can often make these cultural clashes easier to resolve. Often we find that if all teams are heading toward the same goals, with the milestones agreed upon, then security can be an integral part of the culture rather than a competing initiative. Early on in the security world these types of clashes would lead to 'Thunder Dome' scenarios where out of shape men fought each other for office dominance. Project managers officiated since nobody knew what they did, yet they were known to boss people around. After trial by combat was decided the Helpdesk would be informed and a carrier pigeon sent to executive management. This practice largely ended with the implementation of patch management schedules.