Building a matrix that measures people, process, and technology against security goals is a proven method for reducing risk in an organization. Here’s how.

Joshua Goldfarb, Global Solutions Architect — Security

January 7, 2016

4 Min Read

Those of us who work in the information security field have grown accustomed to a certain level of hype and noise. While I could certainly wax poetic about this topic, I’d like to take a slightly different angle. Where there is hype, there is a need to cut through that hype. With the overwhelming amount of noise in the security marketplace today, how can organizations make any sense of it?  I’d like to try and answer that very question.

In my experience, building out a matrix of operational requirements can assist greatly in the task of evaluating security products and services.  It helps organizations ensure that they improve their security posture, rather than damage or impede it.  But how can an organization build out such a matrix?  And what additional benefits does this matrix bring an organization?  Let’s take a look at those questions in additional detail.

Understand Risk

Every organization faces threats to its security.  In turn, those threats introduce some amount of risk to the organization. Each organization faces different threats, and each threat will introduce a different amount of risk. The goal of a security program should ultimately be to minimize and mitigate risk, with the understanding that risk can never be eliminated.

It therefore follows that before an organization can understand its operational needs, it must first understand the risk it faces. That understanding begins by understanding the threat landscape the organization is facing. What types of attacks do similar organizations (perhaps by industry vertical, geographic location, size, or otherwise) face?  What sensitive, confidential, and/or proprietary information are attackers after?  What are some of the ways in which attacks succeed, persist, and result in theft of coveted information?  These are just a few of the many ways in which the threat landscape can be analyzed.

Understanding the threat landscape is a start, but without being able to map it to an understanding of risk, it doesn’t do an organization much good.  How would the organization detect an intrusion or other illicit activity?  What gaps in telemetry exist that could prevent or inhibit detection or analysis?  What skill sets are lacking or in short supply?  What procedural shortcomings exist?  How can the workflow be improved or made more efficient?  There are many ways in which an organization can work towards understanding the risks it faces, of which these questions represent just a few different perspectives.

Set Goals

Understanding the risks and threats to the organization is a first step, but it is still too abstract to facilitate the buildout of a matrix of operational requirements.  What is needed is an intermediary step. This involves breaking the enumerated list of risks down into goals and priorities.

Goals and priorities are much more tangible, specific, and focused than the list of risks.  Each one describes a step along the journey to mitigating a given risk. This is a one to many relationship here. For each risk, there may be many goals and priorities required to properly address it.  Once a list of goals and priorities has been assembled, it can be used to build out the desired matrix of operational requirements.

Enter The Matrix

The goals and priorities enumerated for each risk form the building blocks for the matrix of operational requirements.  On one axis goes people, process, and technology, while on the other axis, the consolidated, de-duplicated goals and priorities.  The resulting matrix spells out what is needed operationally to ensure an adequate security posture for the organization. 

In some cases, people, process, and technology that can be leveraged to mitigate certain risks may already be in place.  In other cases, you may need to develop a specific solution. Using the matrix to identify where gaps exist allows an organization to strategically acquire the necessary people, process, and technology to address the remaining challenges.

There are two additional benefits to using this approach that the astute reader may pick up on:

●     Value is maximized: The security budget can be put to its most efficient use by acquiring the minimum number of solutions that meet the maximum number of requirements.

●     Complexity is reduced:  Acquiring fewer solutions reduces complexity.  Success is much less likely with a haphazard pile of products and services that don’t work well together and don’t meet operational requirements.

The concern organizations have for their security postures has grown considerably over the last few years.  In many cases, budget has increased along with those concerns. But -- not surprisingly -- this has resulted in a noisy, hype-filled marketplace that can be confusing to operational information security professionals.  You can cut through the hype by approaching the challenges of technology acquisition and gap analysis with a matrix of operational requirements

About the Author(s)

Joshua Goldfarb

Global Solutions Architect — Security, F5

Josh Goldfarb is currently Global Solutions Architect — Security at F5. Previously, Josh served as VP and CTO of Emerging Technologies at FireEye and as Chief Security Officer for nPulse Technologies until its acquisition by FireEye. Prior to joining nPulse, Josh worked as an independent consultant, applying his analytical methodology to help enterprises build and enhance their network traffic analysis, security operations, and incident response capabilities to improve their information security postures. Earlier in his career, Josh served as the Chief of Analysis for the United States Computer Emergency Readiness Team, where he built from the ground up and subsequently ran the network, endpoint, and malware analysis/forensics capabilities for US-CERT. In addition to Josh's blogging and public speaking appearances, he is also a regular contributor to Dark Reading and SecurityWeek.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights