Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

1/7/2016
10:30 AM
Joshua Goldfarb
Joshua Goldfarb
Commentary
Connect Directly
Twitter
RSS
E-Mail vvv
100%
0%

The Matrix Reloaded: Security Goals v. Operational Requirements

Building a matrix that measures people, process, and technology against security goals is a proven method for reducing risk in an organization. Here's how.

Those of us who work in the information security field have grown accustomed to a certain level of hype and noise. While I could certainly wax poetic about this topic, I’d like to take a slightly different angle. Where there is hype, there is a need to cut through that hype. With the overwhelming amount of noise in the security marketplace today, how can organizations make any sense of it?  I’d like to try and answer that very question.

In my experience, building out a matrix of operational requirements can assist greatly in the task of evaluating security products and services.  It helps organizations ensure that they improve their security posture, rather than damage or impede it.  But how can an organization build out such a matrix?  And what additional benefits does this matrix bring an organization?  Let’s take a look at those questions in additional detail.

Understand Risk

Every organization faces threats to its security.  In turn, those threats introduce some amount of risk to the organization. Each organization faces different threats, and each threat will introduce a different amount of risk. The goal of a security program should ultimately be to minimize and mitigate risk, with the understanding that risk can never be eliminated.

It therefore follows that before an organization can understand its operational needs, it must first understand the risk it faces. That understanding begins by understanding the threat landscape the organization is facing. What types of attacks do similar organizations (perhaps by industry vertical, geographic location, size, or otherwise) face?  What sensitive, confidential, and/or proprietary information are attackers after?  What are some of the ways in which attacks succeed, persist, and result in theft of coveted information?  These are just a few of the many ways in which the threat landscape can be analyzed.

Understanding the threat landscape is a start, but without being able to map it to an understanding of risk, it doesn’t do an organization much good.  How would the organization detect an intrusion or other illicit activity?  What gaps in telemetry exist that could prevent or inhibit detection or analysis?  What skill sets are lacking or in short supply?  What procedural shortcomings exist?  How can the workflow be improved or made more efficient?  There are many ways in which an organization can work towards understanding the risks it faces, of which these questions represent just a few different perspectives.

Set Goals

Understanding the risks and threats to the organization is a first step, but it is still too abstract to facilitate the buildout of a matrix of operational requirements.  What is needed is an intermediary step. This involves breaking the enumerated list of risks down into goals and priorities.

Goals and priorities are much more tangible, specific, and focused than the list of risks.  Each one describes a step along the journey to mitigating a given risk. This is a one to many relationship here. For each risk, there may be many goals and priorities required to properly address it.  Once a list of goals and priorities has been assembled, it can be used to build out the desired matrix of operational requirements.

Enter The Matrix

The goals and priorities enumerated for each risk form the building blocks for the matrix of operational requirements.  On one axis goes people, process, and technology, while on the other axis, the consolidated, de-duplicated goals and priorities.  The resulting matrix spells out what is needed operationally to ensure an adequate security posture for the organization. 

In some cases, people, process, and technology that can be leveraged to mitigate certain risks may already be in place.  In other cases, you may need to develop a specific solution. Using the matrix to identify where gaps exist allows an organization to strategically acquire the necessary people, process, and technology to address the remaining challenges.

There are two additional benefits to using this approach that the astute reader may pick up on:

●     Value is maximized: The security budget can be put to its most efficient use by acquiring the minimum number of solutions that meet the maximum number of requirements.

●     Complexity is reduced:  Acquiring fewer solutions reduces complexity.  Success is much less likely with a haphazard pile of products and services that don’t work well together and don’t meet operational requirements.

The concern organizations have for their security postures has grown considerably over the last few years.  In many cases, budget has increased along with those concerns. But -- not surprisingly -- this has resulted in a noisy, hype-filled marketplace that can be confusing to operational information security professionals.  You can cut through the hype by approaching the challenges of technology acquisition and gap analysis with a matrix of operational requirements

Josh (Twitter: @ananalytical) is an experienced information security leader who works with enterprises to mature and improve their enterprise security programs.  Previously, Josh served as VP, CTO - Emerging Technologies at FireEye and as Chief Security Officer for ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
Mobile App Fraud Jumped in Q1 as Attackers Pivot from Browsers
Jai Vijayan, Contributing Writer,  7/10/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15105
PUBLISHED: 2020-07-10
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authenticati...
CVE-2020-11061
PUBLISHED: 2020-07-10
In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in...
CVE-2020-4042
PUBLISHED: 2020-07-10
Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge to...
CVE-2020-11081
PUBLISHED: 2020-07-10
osquery before version 4.4.0 enables a priviledge escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables l...
CVE-2020-6114
PUBLISHED: 2020-07-10
An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerabi...