When people hear "information security," they picture dark rooms full of monitors, analysts hunting threats in real-time, maybe someone in a hoodie. It's a great aesthetic. It's also about 5% of the job.
The reality is less cinematic. Security — real, operational security — is mostly the boring stuff. Policies. Access reviews. Making sure someone actually reads the vendor contract. I say this as someone who ended up as a CISO without ever running a SOC or spending years as a security analyst. Turns out, the fundamentals matter more than the flashy stuff, and most of those fundamentals are organizational, not technical.
I think of it as seven pillars. They map to international standards like ISO 27001, but framing them this way helps explain what the job actually involves to people who think it's all firewalls and penetration tests.
The Pillars
Who are you, and what should you be able to do? IAM is the foundation. It governs how identities are created, verified, and given access to systems. Get this wrong and nothing else matters — every breach ultimately comes down to someone accessing something they shouldn't.
Every device and application is an attack surface. This pillar covers hardening the things people actually use day-to-day — laptops, phones, internal tools. It includes secure configuration, vulnerability management, malware protection, and secure development practices.
The boundary between your environment and the outside world. Network security encompasses segmentation, firewall policy, encrypted communications, and increasingly, supply chain risk — because your perimeter now extends to every vendor and partner you connect with.
Prevention eventually fails. This pillar is about knowing when it does. Logging, alerting, threat detection, incident response planning — the ability to see what's happening in your environment and act on it before damage spreads.
Ultimately, data is what you're protecting. Classification, encryption in transit and at rest, data loss prevention, retention policies, anonymisation. In a world shaped by GDPR and similar regulation, this pillar increasingly intersects with legal and privacy.
The connective tissue. GRC provides the policies, the risk framework, and the accountability structure that tie everything else together. Without it, security is a collection of tools. With it, security is a program — measurable, auditable, and aligned to business objectives.
Technology alone doesn't create security — people do. Awareness training, phishing resilience, secure behaviors, clear reporting channels. The goal isn't to make everyone a security expert; it's to make security a natural part of how the organization operates.
The Boring Truth
Most security incidents don't happen because of one gap — they happen because of cascading failures across multiple pillars. A weak IAM policy combined with poor monitoring and a culture that doesn't report anomalies creates the conditions for a breach.
Thinking in pillars makes it possible to assess maturity, identify gaps, and communicate risk in a way that both technical teams and business leadership can understand. It also maps naturally to frameworks like ISO 27001, NIST CSF, and CIS Controls — making audit and compliance a byproduct of doing security well, rather than a separate exercise.
If you're building a security program from scratch, or trying to make sense of one you've inherited, start here. Understand where you're strong, where you're exposed, and where the interdependencies are. That's where the actual work lives.