[BreachExchange] How Secure is Secure? Tips For Investing In The Right Strategy

[Audrey McNeil]

http://www.darkreading.com/operations/how-secure-is-secure-tips-for-investing-in-the-right-strategy--/a/d-id/1325958

Information is an asset; it’s the lifeblood of businesses. Companies know
this -- and so do criminals. That’s why it’s more important than ever for
security professionals to think more expansively about information as an
asset, compliance controls, privacy, and transparency and to take a
proactive approach to security, beginning with a strong security strategy.

In order to define your security strategy, you first need to determine the
right security investment for your organization. There are three criteria
that can help:

- Legal, regulatory, and industry compliance requirements. There are
specific compliance requirements, depending on your product or services,
the type of data that you collect or process, and the countries in which
you provide your services. For example, if you're collecting credit card
information for your consumers, there is a PCI compliance requirement. If
you're collecting patient healthcare information, HIPAA compliance may
apply. If you're providing your services in Europe and collecting European
citizens’ personal data, European privacy law comes into play. Your
specific compliance requirements will guide much of what you will need to
invest in your security program.

- Business risk exposure. Examine how much business risk you're exposed to,
and what the financial impact would be in the case of a data breach.
According to studies associated with data breaches, estimated costs range
from $50 per record up to $154 per record. To determine cost per record in
case of a data breach for your organization, consider what kind of data are
you collecting, processing and storing in your systems. For example, if
you're collecting credit card information and Social Security numbers, and
that information is compromised, the cost associated with that breach may
be higher than other types of breaches.

- Business and sales drivers. Your customers expect you to provide the
highest level of security. Having a strong security program is a
competitive advantage that can allow companies to win a larger share of the
market. In many cases, a strong security program can be the determining
factor in closing deals.

Now that you’ve determined the right investment for your company, you can
define your security strategy according to these key principles:

- Business alignment. Security vision, mission, and goals should align with
your business. Ensure that security is supporting the business by working
on the right set of priorities. I strongly suggest meeting with your
business and technology owners to understand the services they provide,
their priorities, and what they see as the top security threats and
opportunities. Then work in collaboration with the business and technology
owners to take a risk-based approach to rank risks.

- Defense in depth. The goal should be to have multiple layers of security
so that if one or two layers of security are compromised, your information
and assets will remain protected. The most important consideration here is
to balance security and business needs. Security controls should be as
seamless as possible without impacting usability or employee productivity.

- Phased approach. When you build out your security strategy, start with a
small set of security controls to address your business risk. Create a
baseline and then build upon it. Once you've established the baseline and
set a foundation, you can start scaling your program, defining the set of
controls needed for maturity and leadership. It’s important to understand
industry best practices and look to other companies that have set the bar
high with their security programs. Remember to start small: This is not a
one-time process, but rather a continuous improvement cycle. The threat
landscape is continuously changing, and you need to adapt.

Complexity is the modern world -- there’s no avoiding it. But you can try
to control it. By making the right security investment and strategically
building out a solid security strategy and program, you can manage
complexity, minimize vulnerabilities, and rally your entire organization
around security as a team effort and top priority.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.riskbasedsecurity.com/pipermail/breachexchange/attachments/20160621/828774eb/attachment.html>