The Laws of Security

Security rests on four practical laws. They apply regardless of tools, team size, or budget, and they work for junior team members and senior professionals alike.

The Laws

1. Know what you have.
2. Make it hard to break.
3. See trouble fast.
4. Limit and recover.

Why

Know what you have. You can't protect what you don't know exists, so inventory and visibility form the foundation everything else builds on.

Make it hard to break. Strong defaults, least privilege, and simple defenses raise the cost an attacker has to pay.

See trouble fast. Fast detection is more useful than an attempt at perfect prevention, since it catches what slips through before it spreads.

Limit and recover. Contain damage quickly, then restore what was affected. Each recovery is a chance to strengthen the system against the next attempt.

How the laws support each other

These four laws form a closed loop. Defense and detection depend on knowing what you have; reliable detection depends on a hardened baseline; containment depends on detection; and sustained security depends on recovery, which feeds back into knowing and strengthening what you have.

Remember

Know. Harden. See. Recover.