On an ordinary Tuesday about seven hundred of our twenty six hundred staff have a device connected to our own network. Of the twenty three applications this company genuinely runs on, fourteen are not on it and never touch it. The remote access platform we sized for two thousand simultaneous users in 2020 peaks at under four hundred. Two systems went live this year whose only infrastructure requirement was that the user has an internet connection.
Our policies, our joiner process and a good deal of my department's expertise still assume that being inside is meaningful. For most of my career it was the central fact of the job. It is becoming a statement about a diminishing corner of the estate, and I do not believe that reverses.
What replaces it is less comfortable than the marketing suggests. The controls move to identity and to the condition of the device, which means a rule that used to be a line in a firewall configuration, written by a network engineer who has done it for twenty years, is now a conditional access policy written in a different console by a different team with three years of practice. The rule is no less important. Our ability to review, test and reason about it is considerably worse, and I have not yet met an organisation that has solved the second problem as fast as it created the first.
The consequence I think about most is where failure now concentrates. A data centre going dark used to be our worst day, and we have planned and rehearsed that for years. Today, if the service that authenticates people is unavailable, nobody reaches anything at all, including the tools we would use to diagnose it and the documents describing what to do. That dependency is newer than our recovery plan and considerably more absolute than anything in it.
None of the old work disappears. There will always be buildings, circuits, radios and the cabinet in the depot. But the interesting risk has moved off the wire, and the questions worth being good at have changed from what may cross this boundary to who is asking, from what, and how certain are we of either.
– Serguey Shinder
