We work every day to manage risk and ensure the security of our organizations. We strive to create an environment where business can be transacted seamlessly, conveniently and securely. We are charged with enabling business to continue while accomplishing our ultimate responsibility of protecting the business. The threats coming at us are complex, advanced and hard to detect. We know that we can do everything the right and still fall victim. This is why the keys to security success are focused on not only doing the right things to protect our organizations, but also being ready for the worst. Security success no longer means preventing a breach. It now means achieving a balance between prevention, compliance, threat management and preparation.
As Steven Covey said, “Begin with the end in mind. “ Starting this journey with a clear picture of what you want to accomplish helps pave the way for a smooth journey. From decades of helping organizations achieve security success, we have come up with this list of eight things organizations should be doing in order to achieve security success.
- Have a coordinated operational and technical capability approach to prevention, detection and remediation of events and incidents. This sounds easy, but it requires buy-in and participation across the organization. Business and data owners must take ownership and responsibility for the security of data under their purview. This often means getting non-security personnel involved in security conversations. End users must be educated in the company’s security practices and policies. The security and network teams must work together to ensure a robust and well-protected infrastructure. The security team must have the proper tools to enable detection of events and incidents and there must be a documented and tested incident response plan ready to go. The executive suite must be continually informed and ready to uphold the incident response policy; and to address shareholders, customers and the media in the event of a breach. The key here is planning, preparation and practice.
- Have a centralized, systematic (technological or otherwise) way of sharing knowledge related to threats and incidents. Information regarding current and imminent threats and incidents is extremely valuable. This information could be used to help prevent attacks from spreading across an enterprise. Unfortunately, many organizations struggle to find ways to efficiently share information across disparate business units. Information silos prevent effective notification of emerging threats and attackers use this to their advantage. Leveraging a managed security services provider that delivers a master portal with a roll up view of the entire enterprise, along with business-unit sub-portals can help organizations ensure that everyone has the information they need as quickly as possible.
- Stay ahead of threats with continuous configuration management and analysis. Your technology is only as good as its configuration. This also requires highly trained specialists who are skilled in the use of a particular technology.
- Deploy the right security technology. Technology is the tools used by your people to enable your processes. Without the people and the process in place, the technology will never be fully utilized. Take the time to evaluate what you have. Are you using every tool in your arsenal to its fullest potential? Are you taking advantage of all the features? If you determine that you do need new technology, take great care in selecting it. What solutions are available to you? Are there alternative solutions that don’t require technology? What skills and training would your team need? How does this new technology fit with your organization’s plan and capabilities? Do you need another point solution? With traditional approaches becoming less effective, the addition of behavioral analytics greatly improves an organization’s detection capability and compliments the security technology investments already made.
- Keep Systems Running Efficiently and Beat Alert Fatigue with a Managed Solution. You can’t solve security problems with technology alone. You must have someone keeping up with patches and updates to ensure it is functioning as required. Organizations struggle to keep up with the vast quantities of alarms and alerts that most technologies generate.. According to a recent Ponemon study, it costs organizations an average of $1.27 million annually to investigate and respond to erroneous malware alerts alone. Managed security services are a great option to help one operationalize the maintenance of systems and streamline alert triage. As threats have become more targeted and sophisticated, so have the technology solutions. These new technologies can be complicated and confusing. In order to ensure they are doing the job they are intended to do, they must be constantly monitored and maintained by trained specialists.
- Respond to threats in a timely, and consistent manner. They key here is to be able to identify those threats quickly and be prepared with a response plan. Leveraging advanced tools such as behavioral analytics is one way to get ahead of the curve. Having the ability to constantly monitor network, user and application behavior and quickly identify behavior that falls outside of the norm is the advantage organizations need. Finding these compromises early and being able to respond and minimize impact is truly what security success is all about.
- Employ a consistent approach to the handling of incidents and threats from identification through closure. With the huge volume of attacks against an organization, it would be easy to get bogged down in dealing with these incidents. Organizations who have a well-developed and thoughtful approach to working through these incidents have an advantage. Having a trusted partner that can provide you with actionable intelligence to go along with each incident requiring your attention helps maximize the efficacy of your team and dramatically improves your ability to respond and contain incidents.
- Apply metrics around the efficiency of information security technologies, processes and people.
By starting off with a goal in mind, you can identify the key metrics you will track to ensure your journey to success is on the right path. Having access to the reporting and data needed to understand what is working and what needs improvement will help you make educated decisions on what to change, improve or do more of. Organizations that continually track key metrics are far more likely to achieve security success.