Security Business Challenges
TENSION BETWEEN SECURITY AND PRODUCTIVITY
- Security and productivity are often diametrically opposed
- Security measures tend to drive up costs, slow down progress, and add steps
- Vendors often claim their security technology is seamless and invisible to users, but it requires installation, upgrades, and operation
- It is almost impossible to add security to an enterprise without impacting productivity in some way
MAXIMUM ALLOWABLE RISK
- Cutting the security budget and balancing security capabilities against risks encompass the concept of maximum allowable risk (in other words, how much security risk is acceptable?).
- Enterprises use metrics (such as probes, attacks, and intrusions), in part, to show management how the security risks are being stopped/mitigated
- Metrics help everyone understand how close the enterprise is operating to a potential cybersecurity disaster.
SECURITY EFFECTIVENESS OVER TIME
- An enterprise’s security posture effectiveness is not static and is subject to factors within and outside of its control
- Emerging vulnerabilities, setbacks, and mistakes impact security effectiveness
- Audits/projects identify and remediate security program issues.
SECURITY TOTAL COST OF OWNERSHIP
Total Cost of Ownership (TCO) consists of multiple cost components
- –Installing, maintaining, and operating enterprise security controls
- –Maintaining/initiating an incident response capability and restoring normal operations
- –Remediating lost productivity due to not having necessary privileges, requesting access, or processing policy exceptions
SECURITY TOTAL COST OF OWNERSHIP
Prevention Security Profile vs. Detection and Response Security Profile
- Prevention suggests large numbers of security controls resulting in large amounts of lost productivity due to requesting permissions, re-certifying accesses, and interacting with security controls.
- Detection and response suggest the enterprise will have cheaper controls and less lost productivity due to fewer personnel maintaining firewall rules or re-certifying accesses permissions, but they will require more incident response resources.
- It is important for an enterprise to consider TCO when evaluating its cybersecurity program.
#DigitalTransformation
#Digitalization
#Digitization
#Transformation
#Training
#التحول الرقمي
#الرقمنة
#التدريب
#EnterpriseArchitecture
#Security
#InformationSecurity
#Innovation
#ArtificialIntelligence
Comments
Post a Comment