Complexity is the enemy of security — it reduces visibility, expands the attack surface, and increases the chance of human error. The KISS principle reminds security professionals to keep designs as simple as possible without sacrificing essential requirements like availability.
Simplicity in Security
A similar concept to minimizing our attack surface would be simplicity: making sure that we're not making things more complex than they need to be.
I'm going to give you an example that's not really related to cybersecurity, but drives home this point. I have a brother who was an appliance repair technician. He would go from home to home, and what he'd do is he'd fix people's washers and dryers and refrigerators and dishwashers.
When I was in the market and needed a new appliance — I think it was a washer or dryer or something like that — I asked him, what should I buy? He said, well, it doesn't really matter necessarily if you buy one of the cheaper or more expensive ones, the expensive ones are not necessarily better in quality, and in fact sometimes they actually cause more problems. And this is the reason why. You buy a cheaper version of something, a washer or dryer, it could still be good, possibly good quality, but what it doesn't have is a bunch of features that the expensive ones have. So you get more features with these expensive ones, which is one of the reasons why they're more expensive. The quality could be maybe a little better possibly, but what happens is, because it has more features, there are more things that can break on it. And so he sees just as much of these expensive machines as he sees of these cheaper machines.
This is an example where just adding more features can cause more problems, and creating something that's more simplistic can actually be better and more stable.
The term that's kind of the opposite of simplicity is complexity. These more expensive machines are more complex — they have more features, and so they do more, but because of that they're more complex.
There is a saying that complexity is the enemy of security. So complexity is not something that we want when it comes to security. What does complexity do?
This is where the KISS acronym comes into play. The KISS acronym is keep it simple stupid, and it's just a way to remember that we need to not create things that are too complex when it comes to security.
Now, I am a believer that complexity is the enemy of simplicity, but I'm 85% on board with that concept. What I mean by that is that there are exceptions, and there are other principles that overrule this sometimes.
For instance, maybe I want a network that has high availability to it. Right here, this is a simple network with a couple of LANs, and they're interconnected with some routers in between. The problem with this is there's not a lot of redundancy with it. So maybe what I need to do is interconnect another router here, or maybe make a mesh network, to make it highly available.
Well, this creates complexity on my network. Complexity, remember, is the enemy of security. Now I've got more connections here that I have to manage and secure, by creating a more complex network. But part of security is availability, and making things available as well. So what I've done here is I've increased availability while increasing complexity, and so I do have some security concerns with it.
This is more really of a guideline that I need to use when I'm rolling out security. You need to make sure that you're being conscious of maintaining a certain level of simplicity, but still meeting our other requirements, and still meeting our other principles.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →