The idea
Security is not just about software and tools. It depends on three connected elements:
- People: awareness, skills, responsibilities and the confidence to report problems.
- Processes: repeatable ways to manage access, changes, incidents and recovery.
- Technology: controls that support safe, reliable operation.
How they connect
A reporting tool is useful only if people know when to use it and a process ensures reports are acted on. Likewise, a policy needs workable controls and clear responsibilities to become everyday practice.
My learning takeaway
The three elements should reinforce each other. Focusing only on technology leaves gaps in how security is understood and carried out.
Further reading
NCSC secure design principles considers the system and how it is used.