Years ago I was the sole security person at my employer and I felt like I could never get security stuff done.

You probably know the feeling. If it wasn't on fire, due tomorrow, or involved someone standing over your desk, it just didn't happen. It was very frustrating because there was important work not being done and it was my job to do it. I just didn't have the time, or so I thought.

After a while I got frustrated enough to do something about it. Instead of waiting for time to be available, I scheduled time to do the work.

What it looked like

I built a crude process to track my progress doing active security monitoring. I logged my process in Jira tickets. Whatever I found in Snort, Tripwire, and Splunk got logged. I couldn't do it every day, but when I had it on the calendar I tried to spend at least an hour digging into our security data.

It sucked at first, but it got better over time. I got familiar with what was normal. I spotted stuff that wasn't. When the auditors came, I had my Jira tickets to demonstrate what I had been doing.

It wasn't perfect, but it was better than waiting for the time to suddenly be available.

I stumbled into a useful lesson. Don't wait for perfection. Schedule time to make the most of what you have. Improve over time. Track your progress.