Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

12/11/2019
02:00 PM
Joshua Goldfarb
Joshua Goldfarb
Commentary
Connect Directly
Twitter
RSS
E-Mail vvv
50%
50%

5 Tips for Keeping Your Security Team on Target

In nearly every security environment, competing priorities are a constant battleground. Here's how to keep the focus on what's important.

When I sit down to write an article, I encounter any number of distractions. Each distraction seems to want nothing more than to keep me from writing. But my distractibility is not limited to writing. I also encounter a near-constant stream of distractions when I sit down to do most any task.

What does this have to do with security? In security, as we go about the business of protecting our organizations, most of us face a near-constant stream of distractions. If we allow those distractions to drive our day-to-day work, we can very quickly lose focus, which in turn weakens our security postures by preventing us from tackling the items that are most relevant and important.

In this piece, I'd like to share five steps for keeping your security program on target and on track:

Step 1: Build a framework. I've noticed over the course of my career that the people who seem to be busy and overwhelmed all of the time are the same ones who are extremely disorganized. Although getting and staying organized requires an investment in time, in the long run, the investment will pay huge dividends. This is particularly the case with respect to evaluating what activities your security organization should engage in. Building a framework to formalize how the security team encounters new ideas and possibilities, evaluates them, and decides whether and how to approach them is essential to staying on target because it reduces the chance that the organization will be led astray by more attractive distractions.

Step 2: Develop good processes and procedures. It is far too easy to get sidetracked: A security analyst spends far too much time on dead-end leads during analysis and investigation, or a member of the governance, risk, and compliance team is overly focused on a specific control or policy whose impact is marginal. Perhaps the vulnerability team wastes time uncovering vulnerabilities without considering the necessary context that would allow them to prioritize and address the most important ones with IT. Whatever the example, having mature processes and procedures is a great way to avoid many of these potential time traps and ensures that the security program stays focused on what's important..

Step 3: Maintain a strategic direction. To ensure that your security program is on course, it generally helps to have a well-defined vision and strategic direction. This statement may sound obvious, but far too many security teams ignore these essential guiding forces. If you take a step back and think about it, it seems foolish to expect your team members to choose the right path when they lack the fundamental criteria against which to evaluate each potential direction. The board, executives, and security leadership should all have a vision for how they want the organization to defend itself against the most concerning risks. That vision should be documented and communicated, along with the organization's strategy to realize the vision. These documents should be readily accessible and in the foreground of each team member's thinking. This ensures that members of the security team will have a strong foundation upon which to evaluate data points as they encounter them and make the appropriate decisions.

Step 4: Stick to goals and priorities. Vision and strategy are great strategic-level tools, but they don't help us stay on track at the operational and tactical levels, where each functional area needs well-defined goals and priorities to chart and maintain a course of action. It's important to take the time to set goals and priorities for each functional area in line with the security organization's broader vision and strategy. Those goals and priorities should then be documented in detail and used as criteria for decision-making and prioritization of day-to-day activities. Before any decisions are to be made, the data points should be evaluated against specific criteria. Will going in this particular direction help us achieve our goals? Is this activity a good use of time, and is it in line with our priorities? Does the endeavor help improve the security posture of the organization? If the answer to any of these questions is no, what's being proposed is likely not worth the effort.

Step 5: Objectively evaluate impact. In nearly every security environment, competing priorities are a constant. With limited human resources, budget, and technical capabilities, each potential undertaking needs to be evaluated against its potential impact to the organization. If a task, assignment, or project seems like a great idea and a wise use of resources, ask yourself if that activity will directly impact the organization in a positive manner. Will the undertaking improve the security posture of the organization? If so, how can that impact be measured? At what cost will that impact come? If the answers to any of these questions seem uncertain, it's likely that you'll need further analysis before making a decision to engage.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Criminals Hide Fraud Behind the Green Lock Icon."

Josh (Twitter: @ananalytical) is an experienced information security leader who works with enterprises to mature and improve their enterprise security programs.  Previously, Josh served as VP, CTO - Emerging Technologies at FireEye and as Chief Security Officer for ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Malicious USB Drive Hides Behind Gift Card Lure
Dark Reading Staff 3/27/2020
How Attackers Could Use Azure Apps to Sneak into Microsoft 365
Kelly Sheridan, Staff Editor, Dark Reading,  3/24/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-10560
PUBLISHED: 2020-03-30
An issue was discovered in Open Source Social Network (OSSN) through 5.3. A user-controlled file path with a weak cryptographic rand() can be used to read any file with the permissions of the webserver. This can lead to further compromise. The attacker must conduct a brute-force attack against the S...
CVE-2020-5527
PUBLISHED: 2020-03-30
When MELSOFT transmission port (UDP/IP) of Mitsubishi Electric MELSEC iQ-R series (all versions), MELSEC iQ-F series (all versions), MELSEC Q series (all versions), MELSEC L series (all versions), and MELSEC F series (all versions) receives massive amount of data via unspecified vectors, resource co...
CVE-2020-5551
PUBLISHED: 2020-03-30
Toyota 2017 Model Year DCU (Display Control Unit) allows an unauthenticated attacker within Bluetooth range to cause a denial of service attack and/or execute an arbitrary command. The affected DCUs are installed in Lexus (LC, LS, NX, RC, RC F), TOYOTA CAMRY, and TOYOTA SIENNA manufactured in the re...
CVE-2020-10940
PUBLISHED: 2020-03-27
Local Privilege Escalation can occur in PHOENIX CONTACT PORTICO SERVER through 3.0.7 when installed to run as a service.
CVE-2020-10939
PUBLISHED: 2020-03-27
Insecure, default path permissions in PHOENIX CONTACT PC WORX SRT through 1.14 allow for local privilege escalation.