Security assessments can be of transformational value for your organization or they can be shelfware, the determining factor on what you end up with is a matter of leadership and strategy. Here just one example of how an assessment can be transformational.
Several years ago I came into an organization with 5 separate security silo’s, all reporting independently of one another with almost no unifying set of objectives or control framework. One thing all 5 groups had in common was their belief that “the business just doesn’t get it”, it being security. When the 5 “families” got together the debate was fierce, discussions academic and action towards improvement nonexistent. If only we had more money, more tools, more people, more, more, more…then and only then could we be effective. I’m simplifying the story a bit to fit into a blog posting, but not by much.
Having the advantage of being new to the organization I recognized that part of the problem with the state of security was security. If you listened to the groups the sky was falling but they had no data to support their assertions. They had no way to demonstrate, with facts and figures, that the company was taking on more risk than was reasonable.
We needed a quantifiable way to give the business actionable data and let them come to the right conclusions around investments in the security arena. So with my enormous team of 1 which eventually grew to 3 (including me) we set out to educate the business as to the risks they were taking and make the company more secure. It’s not an exaggeration to say that the effort to transform security at a global Fortune 500 company began with 3 people and an assessment.
We knew that we needed a way to measure security and to do that we had to select a control framework that could withstand scrutiny and provide an actionable baseline against which we would measure improvement year over year. The two candidates were NIST and ISO and there were passionate arguments for and against each. In my opinion this is an area that can be “overthought”, meaning you can always change your mind later but the most important thing is taking action now. In fact we did exactly that by selecting ISO and then reverting NIST.
Contrary to what may people might think the next step was not to start the assessment. For the assessment to be effective the business would have to understand how and why it was important to their business and making them ISO or NIST experts was not in the cards. We had to select the parts of ISO and NIST that were relevant to the business from a regulatory compliance perspective. The business understands compliance, be it with HR (Employment law), workplace safety (OSHA), finance (SOX) and or any other functions that support the business. Security however had never taken the time to map the work they were doing back to regulatory requirements in a language the business could understand.
So we set out to do that mapping….long before we started engaging vendors to do an assessment. In my next post I’ll share some of the challenges with doing the mapping and how we ended up selecting a vendor.