Security Business Challenges

 

TENSION BETWEEN SECURITY AND PRODUCTIVITY

• Security and productivity are often diametrically opposed
• Security measures tend to drive up costs, slow down progress, and add steps
• Vendors often claim their security technology is seamless and invisible to users, but it requires installation, upgrades, and operation
• It is almost impossible to add security to an enterprise without impacting productivity in some way

MAXIMUM ALLOWABLE RISK

• Cutting the security budget and balancing security capabilities against risks encompass the concept of maximum allowable risk (in other words, how much security risk is acceptable?).
• Enterprises use metrics (such as probes, attacks, and intrusions), in part, to show management how the security risks are being stopped/mitigated
• Metrics help everyone understand how close the enterprise is operating to a potential cybersecurity disaster.

 

SECURITY EFFECTIVENESS OVER TIME

• An enterprise’s security posture effectiveness is not static and is subject to factors within and outside of its control
• Emerging vulnerabilities, setbacks, and mistakes impact security effectiveness
• Audits/projects identify and remediate security program issues.

 

SECURITY TOTAL COST OF OWNERSHIP

Total Cost of Ownership (TCO) consists of multiple cost components

• –Installing, maintaining, and operating enterprise security controls 
• –Maintaining/initiating an incident response capability and restoring normal operations 
• –Remediating lost productivity due to not having necessary privileges, requesting access, or processing policy exceptions

SECURITY TOTAL COST OF OWNERSHIP

Prevention Security Profile vs. Detection and Response Security Profile 

• Prevention suggests large numbers of security controls resulting in large amounts of lost productivity due to requesting permissions, re-certifying accesses, and interacting with security controls.
• Detection and response suggest the enterprise will have cheaper controls and less lost productivity due to fewer personnel maintaining firewall rules or re-certifying accesses permissions, but they will require more incident response resources. 
• It is important for an enterprise to consider TCO when evaluating its cybersecurity program.

#DigitalTransformation

#Digitalization

#Digitization

#Transformation

#Training

#التحول الرقمي

#الرقمنة

#التدريب

#EnterpriseArchitecture

#Security

#InformationSecurity

#Innovation

#ArtificialIntelligence