Are Security Assessments of Any Value?

By Eric Noonan • November 12, 2013

This post will be broken into multiple parts…taking readers through my experience from the customer side of the equation and how to derive real value out of security assessments.

Before I get too far into this posting let me provide a disclaimer similar to a financial pundit who has to disclose the stocks he/she owns as they pontificate on the merits of said stocks. DISCLAIMER: One of the services my company sells is assessment services and I think they are invaluable, not because I sell them but because in past lives I’ve used them to literally transform the organizations I was leading. Assessments tell you where you are and provide the map that will get you where you want to go.

Security professionals share a common trait, they all have more work than resources and that is not likely to change anytime soon. So, every day is spent fighting fires and you end up “living” on the hamster wheel of security.  Fun, right? Because there is always so much to do its difficult to know what to do first, then second, then third….so that eventually you have strung together a series of investments that measurably improve your security posture. More likely than not you will make a series of investments in response to a series of crisises and probably not have the time or system of management in place to measure the effectiveness of those investments.  Assessments can change that paradigm, permanently and for the betterment of your entire company, if you do them correctly.

The assessment is not an audit so don’t describe it that way; socialize it appropriately with your management and your team. How? Every culture and set of circumstances is different but something along the lines of, “We’ve got a good understanding of what we need to do in security to better align with the business and we are using this assessment to validate that thinking and create a multi-year investment strategy that will drive measurable improvement as opposed to the one off point solution improvements.”  If this assessment is going to be transformative you need to build support before it starts and ultimately you will have a burning platform off of which you can launch your strategy. The assessment is a tactic that will enable the execution of your strategy.

Don’t do the assessment yourself; you won’t have the time to do it justice and somehow having a third party conduct the assessment is always more effective. When you select a third party make sure they invest the time to know what you want to get out of this assessment. Lots of mediocre companies can produce assessments that follow a boiler plate template and answer all of your obvious question leaving you no better off than where you started and a little poorer. Take time up front to write a statement of work that forces your provider to deliver real value and not just a 100 page report. What’s real value?

In my next post I’ll take you through my experience as a customer and how I derived transformational value from security assessments, multiple times…

Cybersheath Blog

3 Reasons Why You Need a Privileged Access Risk Assessment

A privileged account is one used by administrators to log in to servers, networks, firewalls, databases, applications, cloud services and other systems used by your organization. These accounts give enhanced permissions that allow the privileged user to access sensitive data or modify key system functions, among other things. You can…

Incident Response – Learning the Lesson of Lessons Learned

“Those who do not learn from history are condemned to repeat it.” Over the years, variations of this famous quote have been spoken by everyone from philosophers to world leaders. The message — that we must learn from our mistakes or continue to repeat them — is also highly relevant…

What is DFARS 252.204-7012 and NIST SP 800-171?

With the Department of Defense (DoD) promising the release of an update to NIST Special Publication 800-171, it is imperative defense contractors understand what DFARS 252.204-7012 and NIST SP 800-171 Clause is and how noncompliance with the Clause will impact their business.  Compliance is mandatory for contractors doing business with…

Our Trusted Partners

Cyberark McAfee Thycotic RSA Tenable Alien Vault Alert Logic Trace Security