I have been looking into expanding our security program and taking a larger role within my organization and I really believe that by incorporating security metrics into our program and my professional growth, that I will be not only able to continue on the path of my own professional growth, but also to improve our security footprint at my organization.
I am still waiting on the book and am expecting it on Monday, so there will likely be more information to follow, but I did watch a great quick talk from Caroline on YouTube, and took some notes that I will be using for my review. Both a link to the video on YouTube and my notes are below. Thanks Caroline for all of the information that you have already provided, as well as all that information that I will be able to glean from this book!
RSA Conference 2011 - Security Metrics: A Beginner's Guide
Notes:
Why measure Security Metrics?- Limited resources
- Measure the effectiveness of your information security activities to assure you that you are getting value
- Measurements, allow to show continuous improvement.
- GETTING BETTER
- Outcomes oriented.
- The question isn’t what are you doing, it’s what have you accomplished.
- Lends itself to goal setting.
- Gathered data allows to make better decisions
- Gathered data allows to justify spend.
- DON’T COLLECT DATA ON SOMETHING YOU ALREADY KNOW
- How do you use data to energize people to drive change in their behavior?
- Going beyond the security team, the stakeholders and sponsors.
- Security Metrics program can help to make sure that other stakeholders have an understanding of what we are trying to accomplish.
- To determine, what security metrics should be for my company, examine the environment
- For all organizations, security metrics will likely be specific to that particular organization.
- Compliance
- PCI
- HIPAA
- Tools
- Determine what tools you have already that you can collect metrics from.
- Zero in on targets for improvement.
- REMEMBER: There are lots of ways that we can improve, so trying to focus on all of them at once is a sure fire way to not improve meaningfully in any single way.
- Step 1: Narrow in on one or two or 3 target areas to focus on
- SET A BASELINE!
- If you don’t know where you’re starting, you can’t possibly know how far you’ve come!
- Step 2: Set clear goals that you want to accomplish
- If you don’t know where you’re going, it doesn’t matter where you’re starting!
- Useful Metric for Goals - S.M.A.R.T. Metric System
- Specific
- Measurable
- Actionable
- Reasonable
- Time Based
- Step 3: Continuously and consistently measure and report your progress.
- Checking in with stakeholders
- Adjusting expectations to make sure they remain reasonable
- What’s important to your business?
- Compliance
- PCI, HIPAA, etc.
- Are we in a position to pass the next audit?
- Risk
- What are our most high profile risk areas?
- How well are they protected?
- How important are they to the business?
- Build metrics to tell this story!
- Enabling your business!
- What are the critical information assets
- Who is responsible for managing these assets
- What is the lifecycle for these assets
- What’s broken and needs fixing?
- Process - Process improvements should not be overlooked!!!! Security is not a checklist!
- How can we improve our security processes? How do we improve our IT processes?
- To assist with this, document our processes.
- Do all people agree to the same steps.
- Are they performed consistently?
- Verify SLAs
- EXAMPLES:
- Exceptions Process
- Vendor Assessment Process
- Vulnerability Management Process
- Business Continuity Assessments
- Technology
- Security Technology
- What’s the coverage?
- Does it work when off the network?
- Where are the gaps? Sniff them out.
- Non-Security Technology
- Is the data stored adequately protected?
- What is it?
- Where is it?
- Audit Findings
- Develop metrics around the audit findings
- What’s basic? What’s expected?
- Hot things in the news?
- Big vulnerabilities? Thank Hearbleed, Poodle, etc. Are we able to scan for this vulnerability? Know your threat footprint and be able to speak about it.
- What’s new?
- What are you developing that are new processes?
- Fix processes before you automate them. Don’t automate a broken process!
- Key messages for specific audiences. Your stories need to be keyed towards the specific audience for your talk or report.
- List people you may meet with, and what types of metrics might they be interested in?
- CFO
- Might be interested in the justifiction for your security program
- How many people are on the team?
- How much are you spending?
- Benchmark data comparing other industries
- CTO
- Patch and vulnerability management
- Scanning processes
- Be EXTREMELY CLEAR with defining your goals.
- Start reporting immediately.
- Show the data right away, even if it’s not perfect.
- Be patient and be purposeful.
- If you discover that something is wrong, that you didn’t know about before, take it as an opportunity to improve!
Keep growing!
No comments:
Post a Comment