Russian state-sponsored hackers and zero-day attacks sound infinitely more exciting than, say, multi-factor authentication and patch management. But these seemingly boring security basics should be top of mind, says Monzy Merza, VP and head of security research at Splunk.

During a conversation at RSA Conference last month Merza also talked about basic security hygiene and quantum computing — “that’s been a geek exploration area for me since middle of college,” he said. Although quantum computing is still in its infancy, nation states are already capturing massive amounts of network traffic, banking on the fact that in the future they will be able to use a quantum machine to break public key cryptosystems. “So that’s the dystopian side of the fence,” Merza said.

Still, he looks at quantum “more from the optimistic side of the fence.” And on that side, quantum can enable breakthroughs in science and exponentially faster algorithms. “It opens doors to faster communication, better understanding of materials, and better capabilities for analytics and faster analytics," Merza said.

This latter piece, of course, bodes well for Splunk, which started in the security information and event management (SIEM) space before adding and acquiring technologies to its arsenal. At its annual users’ event in October, Splunk unveiled its latest full-fledged security platform called Mission Control. The new product integrates Splunk’s existing security tools — SIEM, user behavior analytics (UBA), and security orchestration, automation, and response (SOAR) — into a unified, cloud-based application.

Merza calls Splunk’s security strategy a “nerve center” with three layers of capabilities. The base layer, or platform, “can collect information from anywhere, and has open APIs to be able to communicate and connect with anything.”

The second, analytics layer becomes more specialized with services like UBA and SIEM. “And then the third layer is about decision making,” he said. This top layer includes “our security automation orchestration response capability that happens as a consequence of that decision making.”

And, he says, the nerve center exists in the larger ecosystem — Splunk’s technology and design partners and its customers.

But while still mostly-theoretical topics like quantum computing, or what’s-your-business-strategy questions are the ones that reporters like to discuss at RSA, it’s the basics, Merza says, that we should be talking about.

“Vulnerability management, configuration management, patch management — those things should still be top of mind for CISOs and even for analysts,” Merza said. And, he added, security “hygiene can be sexy. I mean, there’s ways you can do that.”

To do this, however, the sector needs to grow up. “There’s a lot to be learned from other mature practices,” he said. “Cybersecurity is still a very is very nascent discipline.”

For example: Merza’s brother is a urology oncologist robotic surgeon. (Side note: Smart family, right? I’m sure their mother is very proud.) While surgical procedures and tools continue to evolve, Merza’s brother’s “terrain,” as he calls it, is the human body, which has remained relatively consistent for centuries. Even so, surgeons practice fundamentals over and over again to hone their craft.

Security, however, which is obviously a much younger discipline than medicine, has a constantly changing terrain. “Like there’s somebody throwing rocks at us as we walk down the street,” Merza said. “And, it’s not always sexy to do the same thing over and over and try to refine our discipline. But when you look at these other disciplines that are mature, how many hours or days of the week is someone constantly just practicing the fundamentals?”

One of the reasons for this is that cybersecurity rewards newness, he said. “Practice and specialization is not rewarded as much.”

Merza said he was on a team building a vulnerability management system for a government agency. When the team expanded the security coverage from 30% to 95%, the organization’s senior director’s response was “why are you missing that 5%? It just blew our mind,” Merza said. “From 30% to 95%, and we thought we were the world heavyweight champions.

The c-suite and upper-level management within organizations needs to have the maturity to reward a job well done and ask what security teams need to help cover that last 5%.

“So how can [security hygiene] be sexy? We have to map that to business value, and we have to reward the people who do the good things,” Merza said. “We have to reward not just the heroes, but we have to reward the bus drivers too because they’re doing something consistently and they’re the backbone of how the operation happens. That’s how you make it sexy. You make it more inclusive, you treat people for their value and therefore the value of their effort. It’s not just rewarding the person who’s doing the next amazing thing right. I think that’s gonna make it sexy.”