A new report from the Security for Business Innovation Council (SBIC) underscores what many mature enterprises know – that IT organizations need to collaborate with the business side of the house in the name of security.
SBIC is composed of a group of top security leaders from Global 1000 enterprises. In its latest report, ‘Transforming Information Security: Future-Proofing Processes’, the council notes that while business groups within organizations are taking greater ownership of information risk management, outdated security processes still hamper efforts to combat new cyber-security risks.
“Understanding the business impact of security is a way of giving stakeholders a common language, and common goals,” said Sam Curry, chief strategy office and chief technologist for RSA, EMC’s security division. “By putting the impact of security in business terms it also builds “social networks” within the business and respect for the leadership in security. It also makes security more than a mere tax on the business. These are essential activities if future spend associated with becoming more mature will ever be possible.”
The new report advises information security professionals take five steps towards improving security: shift the focus from protecting technical assets to critical business processes; institute business estimates of cyber-security risks; establish business-centric risk assessments; develop data collection techniques and document capabilities for collecting data that proves the effectiveness of security controls.
Selecting key metrics is important, Curry said.
“This will be fundamentally a set of business metrics and indicators that will last a long time (through a number of growth phases) and that will encourage the right corrective actions and controls from all functions, not just security,” he continued. “From there, this becomes an operations mapping exercise. You shouldn’t start with the controls, start instead with the business.”
“Ultimately this isn’t about the C-Suite taking a crash course in security, it’s about security understanding the business and getting out of its silo,” he added. “The rest of the company will respond well and in kind.”‘
While immature organizations may typically try to measure risk in terms of impact to systems and perhaps a small lack of employee productivity, a more detailed and accurate assessment would be to think of a wider picture – things like brand damage, the effect on service level agreements and customer and partner commitments, Curry said. It would also plan mitigations and contingencies.
“Risks must ultimately be understood regardless of their type, so they can be accepted or addressed,” he said. “It’s also important that there isn’t perceived to be a finite checklist of IT security risk: this isn’t about checklists or ‘if I just do X, all will be ok.’ This is about treating security as a source of risk and as a business process like any other within the company from legal and finance to support and operations.”
More from Brian Prince
- U.S. Healthcare Companies Hardest Hit by ‘Stegoloader’ Malware
- CryptoWall Ransomware Cost Victims More Than $18 Million Since April 2014: FBI
- New Adobe Flash Player Flaw Shares Similarities With Previous Vulnerability: Trend Micro
- Visibility Challenges Industrial Control System Security: Survey
- Adobe Flash Player Zero-Day Exploited in Attack Campaign
- Researchers Demonstrate Stealing Encryption Keys Via Radio
- Researchers Uncover Critical RubyGems Vulnerabilities
- NSA, GCHQ Linked to Efforts to Compromise Antivirus Vendors: Report
Latest News
- Big China Spy Balloon Moving East Over US, Pentagon Says
- Former Ubiquiti Employee Who Posed as Hacker Pleads Guilty
- Cyber Insights 2023: Venture Capital
- Atlassian Warns of Critical Jira Service Management Vulnerability
- High-Severity Privilege Escalation Vulnerability Patched in VMware Workstation
- Exploitation of Oracle E-Business Suite Vulnerability Starts After PoC Publication
- China Says It’s Looking Into Report of Spy Balloon Over US
- GoAnywhere MFT Users Warned of Zero-Day Exploit
