How to Build the Most Effective Cybersecurity Capability You Can Afford

The challenge of cybersecurity is as much economic as it is technological. The fact is no matter what the size of a company no amount of spending will provide complete safety. The crucial questions for Google, Facebook, IBM or your company are the same:

  • What assets are we trying to protect?
  • How much can we afford to spend protecting them?
  • How do we spend that money so that we get the most security possible?

This article will explain the journey that CIOs and CSOs must lead their companies through to understand security and make the best investments. We define the journey in the following stages that form a cycle of security analysis that should be constantly carried out:

  • Assessing your assets
  • Designing your security philosophy and policy
  • Choosing security technology
  • Creating a security operations team
  • Implementing security technology and practices
  • Tuning and optimizing your security capabilities

Assessing your assets

  • It is vital to understand what the bad guys will be after and protect that more than other assets that are less valuable.

Designing your security philosophy and policy

  • What risks are you willing to accept?
  • What attacks do you want to discourage and make difficult?
  • What attacks must be prevented with all possible means of protection?

Choosing security technology

  • What technology helps you implement each policy according to your philosophy?

Creating a security operations team

  • How will you staff your security operations team?
  • What skills must you have in-house?
  • What role can consultants and vendors play?

Implementing security technology and practices

  • How can you improve the process discipline required for security?
  • How can security be made usable?
  • When is onerous security justified?

Tuning and optimizing your security capabilities

  • How are false positives used to improve the tuning of your capabilities?
  • How do you look for false negatives?
  • How do you evaluate new technology?

Related

Teaching Your CEO about Cybersecurity: An Anatomical Analogy

Author: Dan Woods

My mission: Find technology for Early Adopters. Follow me on Twitter @danwoodsearly and on LinkedIn www.linkedin.com/in/danwoodsearly/. I am a CTO, writer, and consultant. For tech vendors, I help explain their technology. For users, I help find, select, and deploy new solutions that have explosive business value. I love to speak and share ideas.