Soapbox Cybersecurity

What Everyone Is Thinking But Nobody Is Saying
by Craig Raymond

There is a version of information security that gets written about, talked about at conferences, and sold to executives. And then there is the version practitioners actually live with. With over two decades of doing this job, I've learned those two versions of the same industry are very different.I have opinions about that gap. Strong ones, developed over a long time, and I'm not going to soften them for the sake of being agreeable. Some of what I say in this book is going to piss some people off — particularly people whose professional identity is built on practices I think are broken. That's not the goal, but I've made peace with it. The goal is to be useful. To make you laugh. For you to read something that resonates with you for once.I'm not perfect and I'm not claiming to be. Everything in this book comes from my experience, my observations, and my judgment. Take it as a perspective — a well-earned one, not a decree.You don't need a technical background to follow this book. What you need is a sense of humor, thick skin, and the willingness to question some stuff.

About Me
I've spent over two decades in information technology and security — from hands-on technical work to organizational leadership. I've built security programs, designed datacenters, navigated audits, managed risk, and wasted more of my time in ridiculous meetings than I care to count.At times I've gotten fed up and annoyed, I needed to vent — and over the years, friends and colleagues have enjoyed my spiels, so I've written them down.