[BreachExchange] 10 best practices for bolstering security and increasing ROI

[Inga Goddijn]

https://gcn.com/articles/2018/04/13/10-steps-security-roi.aspx?admgarea=TC_SecCybersSec

There is nothing easy about government security operations. Most chief
information security officers struggle with countless manual processes,
numerous disconnected tools and a shortage of properly trained talent
<https://blog.demisto.com/5-tips-on-hiring-and-retaining-the-right-cybersecurity-talent>.
However, the increasing number of widely publicized breaches, the growing
complexity of regulations pertaining to the protection of personal data and
the uptick in ransomware attacks have made agencies' top executives acutely
aware of the dangers posed by inadequate security.

As a result, those executives have become more willing to approve spending
on security operations -- but the increased spending has often not provided
the type of returns that agency leaders and financial officers expected. So
now CISOs are being asked to provide proof that the money spent -- or that
they are asking to be spent -- will lead to greater effectiveness, more
efficient operations or better results when the agency is attacked.

If calculating the return on security investments could mirror predicted
ROI for return on a new piece of equipment, the task would be simpler.
However, security operations represent both tangible and intangible
benefits, complicating the issue. For example, if the goal is to determine
whether automation improves incident response, it is relatively easy to measure
the ROI
<https://blog.demisto.com/measuring-roi-effectiveness-incident-response-platform>
in
terms of wages. It is less straightforward to quantify the benefits of
lowering employee turnover, boosting worker productivity or reducing the
stress levels of security analysts. Assigning a dollar value to an agency's
reputation can be tricky as well.

Fortunately, when it comes to enhancing security operations while also
increasing ROI, there are some steps that CISOs can take to achieve their
goals. Consider following these 10 best practices:

*1. Articulate the purpose. *It is important to clearly spell out the
purpose of the security investment, providing a well-defined analysis of
what will be accomplished and why the activities are important. This helps
decision-makers discern whether the proposed initiative will be worth the
money, time and effort. Securing the support of non-technical C-suite
executives by clearly articulating the initiative's goals can help ensure
success.

*2. Dovetail with other projects. *Look for opportunities to enhance
security operations as an add-on to other projects. For example, if the IT
department plans to upgrade the network to support VoIP, see if upgrading
the security network could be performed as an add-on to the IT project.
This reduces the cost -- compared to having two separate projects -- and
increases the ROI on both projects. Naturally, security risks may make it
impossible to delay a project, but unless the need is immediate,
incremental additions to other planned projects are often feasible.

*3. Automate and orchestrate. *Strive for security orchestration
<https://www.demisto.com/security-orchestration/> and process automation.
The current threat landscape is vast, complex and constantly changing. Even
a well-staffed security operations center cannot keep pace with the volume
of alerts, especially with the ever-increasing number of duplicates and
false positives. Use automation for threat hunting, investigations and
other repetitive tasks that consume too much of analysts' time.

*4. Create an integration plan. *Build a security operations and analytics
performance architecture (SOAPA) integration plan. Consolidate security
technologies, reduce the number of vendors and build a platform that
unifies the tools for detection and response across a common architecture.

*5. IT and security synergy. *Tear down the walls between IT and security
operations. Too often, IT and security teams pursue different goals and use
diverse tools to fulfill their missions. Improve collaborative efforts --
such as using SOAPA -- to enable data sharing, task prioritization and
process automation.

*6. Leverage analytics. *Adopt advanced analytics. Machine learning and
artificial intelligence are delivering truly innovative solutions. CISOs
should research these two fields carefully to determine which analytics
tools best fit their agencies, taking into account the organization's
strengths and weaknesses related to skills, personnel and risks.

*7. Start small. *Be willing to take small steps when necessary. Instead of
insisting on an all-or-nothing approach, consider pilot projects to prove
the benefits and costs associated with an initiative.

*8. Go beyond compliance. *Articulate the difference between compliance and
security. Too many CEOs and other decision-makers believe their
organization is secure if it complies with existing regulations. However,
regulations change frequently to react to new threats. When new guidance is
written, it may be several months before organizations must comply with
them. In the meantime, organizations can be in full compliance, but they
can still be vulnerable to attacks.

*9. Shoot straight. *Honesty is always the best policy. CISOs who oversell
a new technology and then discover that it is more expensive and less
effective than expected risk having their credibility challenged in the
future.

*10. Measure and course-correct. *Make sure to put the right metrics in
place to measure progress. Based on data collected, periodically make
changes to the strategy or continue on the course. This will create a
feedback loop for all cybersecurity strategies.

In today's world, implementing security initiatives is often tough.
Justifying these initiatives in terms of dollars and cents can be just as
challenging. However, by following the above top best practices, CISOs can
make significant progress toward fulfilling their goals for security
operations.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.riskbasedsecurity.com/pipermail/breachexchange/attachments/20180415/8ecd0f2b/attachment.html>