CategoriesExperience, Guide
Guidance for a successful security program
This article is aimed at providing guidance for a successful security program and insight into the differences and challenges between compliance operations and security operations.
Evolving compliance
Compliance is no check mark sport – it is a constant gardening exercise. Here are some of the essential points for keeping your compliance in good shape, Guidance for a successful security program:
- Keeping up to date with standards, regulatory requirements, and future changes can be a good way of staying ahead. Be knowledgeable about many different standards and security best practices, while ensuring that you are going beyond just meeting compliance. Why? Standards are not updated fast enough to correlate with the ever evolving threat landscape and security best practices.
- In the case of the organization not have to meet information security standards or issue reports such as ISO 27001, SOC 2, NIST, PCI DSS or others, it is still a good idea to follow the frameworks such as ISO 27001 or NIST as they provide good guidance and a foundation on security best practices for your ISMS.
- Continually monitoring the effectiveness of your controls and implementing security measures that not only meet standard or regulatory requirements, however going beyond to increase the security posture of your organization is a great way to ensure your ISMS is up to date and the controls are actually helpful for you and your business units. If the organization has multiple frameworks that it needs to be certified against, evaluate whether the policies, processes, and controls can be used to meet the objectives of multiple standards at once. This cross-reference can save you valuable time.
Compliance is only a small part of the security function and being compliant or certified must be taken with a grain of salt as compliance to standards does not mean you are completely secure or that your vendors are secure as the scope and quality of controls can significantly differ.
Current threat landscape
The ever evolving landscape of corporate business is a:
- Modern threat agents are becoming more and more sophisticated and the threat landscape is continually evolving. Following news on security, recent attacks, and vulnerabilities is paramount to being up to date with the current threat landscape.
- It is recommended to conduct threat intelligence, implement continuous monitoring and alerting, and use continuous risk management for new threats that are arising at each time. If budget allows for it, consider implementing technical solutions that allow for continuous monitoring of thresholds and vulnerabilities through agents, and implementing solutions that offer threat intelligence of your company and supply chain.
Guidance for a successful security program
Keeping current within your own company
- It can be common that some business leaders may view the security function as a barrier or blocker for the business. It is important to understand the business goals and create a culture of security as an enabler where business units are freely willing to share information and concerns and seek help from the security team. This is why it is critical to be visible, knowledgeable about where your company is headed, what the business requirements are, and how security best practices can be implemented at each phase and within all business units.
- Creating a culture and mindset where the company sees security as an enabler for the business instead of a restriction, will lead to better collaboration between the companies departments and increased information sharing to ensure the security team is up to date with new developments, systems or strategies. In addition, ensuring your colleagues and stakeholders such as the BoD are informed through a Security Council, regular reporting and awareness training to ensure the success and visibility of the security function and increased security awareness within your organization. Stand-ups or regular meetings with relevant teams, especially development and IT should be held in order to follow current changes and issues with the IT environment.
- Ensure you have a good overview of your assets and vendors through dedicated asset management and vendor management programs. As the attack vectors are increasingly becoming more and more sophisticated, keeping current with your enterprise infrastructure, assets, and supply chain will enable your organization to have a deeper understanding of your attack vectors.
Being involved within the industry and security sector
- Join security communities if they are available through professional industry specific platforms or social media platforms as they may often provide good intel on current challenges and threats.
- Evolving cyberthreats create a continual need to educate the security team, and all relevant team members on how to protect against data breaches and threats. Being involved in discussions, events, and gathering intel from trusted media will help in being current with the industry.
- Offering to achieve professional certifications for your security team additionally gives a good foundation for the career success and continued learning of your security team.