In Greek mythology, a mortal king of Corinth, Sisyphus, was condemned by the gods to roll a boulder up a hill, only to watch it roll back down each time. For eternity.<\/p>\n\n\n\n
The punishment was not the labor itself, but the absence of an end point. No finish line, endgame, or closure.<\/p>\n\n\n\n
Jonathan Langer, co-founder and CEO of Act Security, argues that the image fits much of modern cloud security. Security teams work through an ever-growing list of findings, including vulnerabilities, misconfigurations, and risky settings, one item at a time. \u201cNobody ever finishes the list,\u201d Langer told me. \u201cThat\u2019s the dirty little secret in cybersecurity.\u201d<\/p>\n\n\n\n
His company has built its brand around this, even including the message \u201cdon\u2019t be a Sisyphus.\u201d When we spoke, I wanted to understand whether that was simply a memorable metaphor – or a useful way of thinking about an industry that keeps finding more work for itself.<\/p>\n\n\n\n
Langer\u2019s thinking about this began at Medigate, the medical-device security company he previously co-founded. Its technology could show customers what devices they had and the risks associated with them. But customers eventually asked a fairly obvious question: Now what?<\/em><\/p>\n\n\n\n \u201cNow I know. Now I have all this risk. Now I have all these issues and findings. What do I do with it?\u201d he recalled them asking. The idea with Act is to reduce the access that makes attacks possible, including permissions that allow an application or person to reach systems they do not need.<\/p>\n\n\n\nThe dashboard problem<\/strong><\/h2>\n\n\n\n