OK, we are going to jump right into it. The doctrine and principles of Security Brutalism, not with shiny new tools, but with the basics.

Employees, customers, and partners have accessed our data from everywhere for more than a decade, and without a way to verify who is accessing what, we have no control. Strong, centralized identity and access management has to come first, ahead of every other investment, and it is the required first step.

Compromise is happening right now, and no number of controls will stop an adversary from eventually finding a way in, whether through an unpatched vulnerability, an exposed endpoint, or someone who clicks the wrong link. We have to protect data at rest and in transit as if our lives depend on it, so that anyone who does get through finds only information that is useless to them.

Vulnerabilities, including phishing people, are the most common way attackers gain entry, and every unpatched system is an open invitation, just as every "unpatched" human is the weakest link. That calls for streamlined patching processes with top priority behind them, along with active work to eliminate technical debt in the form of old, unmaintained legacy systems and code that are impossible to secure. Anything we cannot secure should be retired, since it serves only as attack surface.
Yes... I'm not saying anything you have not heard before. Security Brutalism is really going back to the fundametants that we seem to have forgotten in favor of shiny tools...

An attacker who gets into one part of our network should not be able to move freely through the rest, so we need to architect and segment our networks into small, isolated zones while keeping the design simple enough to manage. Every added layer of complexity creates more attack surface, which makes simplicity one of our most critical defenses.

Forget the buzzword. Zero trust means we never assume trust based on location or network. Every user, device, and application must be authenticated and authorized continuously, wherever it sits, so we verify before granting access and keep re-verifying for as long as the access lasts.

We cannot protect what we cannot see, so we need to collect logs from every system, device, and application and treat that data as our eyes and ears. With the logs in hand, we can monitor the environment relentlessly for anomalous behavior, which means establishing baselines, looking for deviations, and having a plan ready for when we find one. That monitoring lets us detect threats early, and it leads to our next point...

Breaches are inevitable, so we should build our security programs around the assumption that one will happen. That calls for an incident response plan that is written in advance and rehearsed until everyone knows exactly what to do when things go wrong, because we have already planned for failure.

Time is our most valuable asset in a security incident, because the longer an attacker stays in our environment, the more damage they can do. We should compress the attacker’s OODA loop under pressure, which forces rushed decisions and raises the likelihood of mistakes, while keeping our own loop just as fast and driven by control and intent. Our response has to be rapid and decisive, with containment as the top priority so the blast radius stays small, and removal of the attacker follows from there.

Brutalist Security is a way of operating and thinking, an uncompromising philosophy that has to reach every part of the organization. Security is a central business function in addition to a technical one, and our ability to operate, innovate, and keep the trust of our customers and users depends entirely on the strength of our security doctrine.

You can download the deck as a PDF. Please ensure appropriate credit is given when using any part or all of this deck.