This post will be broken into multiple parts…taking readers through my experience from the customer side of the equation and how to derive real value out of security assessments.
Before I get too far into this posting let me provide a disclaimer similar to a financial pundit who has to disclose the stocks he/she owns as they pontificate on the merits of said stocks. DISCLAIMER: One of the services my company sells is assessment services and I think they are invaluable, not because I sell them but because in past lives I’ve used them to literally transform the organizations I was leading. Assessments tell you where you are and provide the map that will get you where you want to go.
Security professionals share a common trait, they all have more work than resources and that is not likely to change anytime soon. So, every day is spent fighting fires and you end up “living” on the hamster wheel of security. Fun, right? Because there is always so much to do its difficult to know what to do first, then second, then third….so that eventually you have strung together a series of investments that measurably improve your security posture. More likely than not you will make a series of investments in response to a series of crisises and probably not have the time or system of management in place to measure the effectiveness of those investments. Assessments can change that paradigm, permanently and for the betterment of your entire company, if you do them correctly.
The assessment is not an audit so don’t describe it that way; socialize it appropriately with your management and your team. How? Every culture and set of circumstances is different but something along the lines of, “We’ve got a good understanding of what we need to do in security to better align with the business and we are using this assessment to validate that thinking and create a multi-year investment strategy that will drive measurable improvement as opposed to the one off point solution improvements.” If this assessment is going to be transformative you need to build support before it starts and ultimately you will have a burning platform off of which you can launch your strategy. The assessment is a tactic that will enable the execution of your strategy.
Don’t do the assessment yourself; you won’t have the time to do it justice and somehow having a third party conduct the assessment is always more effective. When you select a third party make sure they invest the time to know what you want to get out of this assessment. Lots of mediocre companies can produce assessments that follow a boiler plate template and answer all of your obvious question leaving you no better off than where you started and a little poorer. Take time up front to write a statement of work that forces your provider to deliver real value and not just a 100 page report. What’s real value?
In my next post I’ll take you through my experience as a customer and how I derived transformational value from security assessments, multiple times…