Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Risk Management

Experts: Security Professionals Should Focus on Protecting Business Processes, Not Just Assets

A new report from the Security for Business Innovation Council (SBIC) underscores what many mature enterprises know – that IT organizations need to collaborate with the business side of the house in the name of security.

A new report from the Security for Business Innovation Council (SBIC) underscores what many mature enterprises know – that IT organizations need to collaborate with the business side of the house in the name of security.

SBIC is composed of a group of top security leaders from Global 1000 enterprises. In its latest report, ‘Transforming Information Security: Future-Proofing Processes’, the council notes that while business groups within organizations are taking greater ownership of information risk management, outdated security processes still hamper efforts to combat new cyber-security risks.

“Understanding the business impact of security is a way of giving stakeholders a common language, and common goals,” said Sam Curry, chief strategy office and chief technologist for RSA, EMC’s security division. “By putting the impact of security in business terms it also builds “social networks” within the business and respect for the leadership in security. It also makes security more than a mere tax on the business.  These are essential activities if future spend associated with becoming more mature will ever be possible.”

The new report advises information security professionals take five steps towards improving security: shift the focus from protecting technical assets to critical business processes; institute business estimates of cyber-security risks; establish business-centric risk assessments; develop data collection techniques and document capabilities for collecting data that proves the effectiveness of security controls.

Selecting key metrics is important, Curry said.

“This will be fundamentally a set of business metrics and indicators that will last a long time (through a number of growth phases) and that will encourage the right corrective actions and controls from all functions, not just security,” he continued. “From there, this becomes an operations mapping exercise.  You shouldn’t start with the controls, start instead with the business.”

“Ultimately this isn’t about the C-Suite taking a crash course in security, it’s about security understanding the business and getting out of its silo,” he added. “The rest of the company will respond well and in kind.”‘

While immature organizations may typically try to measure risk in terms of impact to systems and perhaps a small lack of employee productivity, a more detailed and accurate assessment would be to think of a wider picture – things like brand damage, the effect on service level agreements and customer and partner commitments, Curry said. It would also plan mitigations and contingencies.

“Risks must ultimately be understood regardless of their type, so they can be accepted or addressed,” he said. “It’s also important that there isn’t perceived to be a finite checklist of IT security risk: this isn’t about checklists or ‘if I just do X, all will be ok.’ This is about treating security as a source of risk and as a business process like any other within the company from legal and finance to support and operations.”

Written By

Click to comment

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

CISO Strategy

Cybersecurity-related risk is a top concern, so boards need to know they have the proper oversight in place. Even as first-timers, successful CISOs make...

Risk Management

A threat-based approach to security often focuses on a checklist to meet industry requirements but overlooked the key component of security: reducing risk.

Risk Management

CISA has published a report detailing the cybersecurity risks to the K-12 education system and recommendations on how to secure it.

Funding/M&A

More than 4,000 internet-accessible Pulse Connect Secure hosts are impacted by at least one known vulnerability, attack surface management firm Censys warns.

Cybersecurity Funding

2022 Cybersecurity Year in Review: Top news headlines and trends that impacted the security ecosystem

Application Security

Fortinet on Monday issued an emergency patch to cover a severe vulnerability in its FortiOS SSL-VPN product, warning that hackers have already exploited the...