How do you improve your information systems' security performance?

• Conduct Business Process Analysis & Reviews of the AS-IS, and the Future To-Be Plans. • Identify Critical Assets and Security Plan. • Identify Internal and external threats. • Implement and deploy security standards to all layers of the organization. • Implement CORE Image to Servers and Desktops (Encrypted). • Implement Segmented Networks. • Implement Group Policies, Network Policies, Internet Policies, Social Media Policies. • Implement Virtual Environments . • Implement Risk Management Plan. • Implement Disaster Recovery Plan (including backup and restoration, and locations). • Prepare detailed security requirements analysis , that cover sub-processes, applications and data.

Asset Management - identify your critical assets, conduct related risk assessments, improve your security posture by implementing layered controls to protect your valuable infrastructure and data.

Assessing the security posture is a critical aspect of my role. I conduct comprehensive audits and vulnerability assessments to identify potential weaknesses in the infrastructure. By analyzing logs, monitoring network traffic, and implementing security controls, I ensure that our systems are protected against emerging threats. Regularly reviewing and updating security policies and procedures is also essential to maintain a strong security posture.

The ability to have a clear picture of the information system resources using network visibility and monitoring tools is very important for security in a corporate environment. It is also important to ensure end-point protection for assets operating in one environment. The above measures should be integrated with a security in-depth approach (People, Systems, processes, policies and awareness). These steps will go along way in enhancing information security. However, there are no systems that are absolute.

Assessing your current security posture is a dynamic, not a one-time, process. Continuous monitoring is crucial due to evolving cyber threats and changing regulations. I've found automated security metrics dashboards integrated with SIEM systems effective for real-time insights and alerts based on KPIs. Inclusion of business leaders in the assessment aligns security posture with business objectives and risk tolerance. Employee awareness is often an overlooked yet critical factor. Also, it's vital to tailor assessment frameworks like ISO 27001 to your industry's unique needs.

While implementing security best practices is fundamental, it's not a static checklist but an ongoing commitment. From my experience, it's imperative to customize best practices to suit your organizational context. A key principle I adhere to is the Zero Trust Model, which aligns well with the 'security-by-design' and 'least privilege' approaches, but extends it by never implicitly trusting any entity, internal or external. Implementing strong encryption and multi-factor authentication is table stakes, but don’t underestimate the value of Behavior Analytics tools for identifying anomalies. Also, I emphasize the role of real-time incident response plans and tabletop exercises to simulate security scenarios, ensuring preparedness.

Security best practices are just that, best practices. And if you want to truly make a difference you need to recognize that a best practice is a starting point….not the finish line. There are many frameworks that provide direction and intent but at the end of the day they give people a “box to check”….compliance does not equal security! I personally happen to be a big proponent of the CIS framework for one simple reason, “offense informs defense”. I believe this is how you stay above the bar instead of always trying to reach it. So if you really want to make a difference and mature your security program reach above the bar, try harder!

Security of the information systems is very critical to every organization. It is very important to understand all the components of the information systems and their roles during the information flow. This will help to identify the at-risk points or connections that could be dependent on cyberspace. Regular pen tests and risk assessments are essential to determine the weakest links to the systems. The use of artificial intelligence tools is recommended to determine the early warning and vulnerability of the system components.

One of the best ways to see if these policies are effective is to study past security breaches where good policies did not actually stop the breach. And example of this would be when there are so many policies that it causes "policy fatigue". Administrators can get to a point that they bypass their own policies just to "get a job done". How to resolve this is to automate the checks and admin that is required and raise issues when it is not done. Example say you have SSL certificates that need to be updated. Look at systems that can auto update or auto notify when these are due. The system needs to check the current SSL's not a manual date of expiry, and notify Admins until it has been done. Escalation notice if not followed through.

If you are still measuring security performance on how many tickets you work, you’re doing it wrong. The bar is constantly evolving so traditional means are not an effective gauge of measure. From a pure security perspective the only thing that matters is “the size of the haystack”- think alert fatigue. To become effective, machine learning has to be leveraged to reduce the noise (aka. haystack) so you can find the “needle” faster. Without ML/AI you will never be able to keep up, your metrics are based on Garbage in garbage out. So to truly measure the performance of your security program the first step is making it relevant.

Monitoring and measuring are critical for maintaining an agile and responsive security posture. In my role, I've leveraged Security Orchestration, Automation, and Response (SOAR) platforms to correlate data and automate incident responses. These platforms not only streamline workflows but also help in faster detection and remediation of threats. I also advocate for aligning your security metrics with business metrics. This makes it easier to communicate the ROI of cybersecurity initiatives to upper management and board members. Additionally, customer-facing metrics can enhance trust and brand value. Remember that continuous improvement requires a feedback loop; post-incident analysis is invaluable for refining strategies.

I agree Marcel on this topic. However I'm interested in gaining some insight in to non automated techniques and procedures which can be used to generate relationship between data and responses.

To add to others who say we need to leverage AI and ML to effectively find the needle in the haystack of data logs. Regular testing and simulations need to be done not just on IT teams but all users within an organization. Many years ago, after installation of a new server with full RAID redundancy, I had the FD of the company while doing a tour of the system pull out a HDD to test if the RAID would work. At first the team was shocked as this could have destroyed all the work we had done. But on reflection, doing this was a practical "non IT" systems evaluation. Yes the RAID worked by design. How many systems have never been tested to see if they "work by design"?

Reviewing and updating your security strategy is a cyclical process, not a one-off event. Drawing on my experience, I recommend quarterly strategy reviews as part of the governance structure. This frequency allows for agility in response to emerging threats and business changes. I’ve found the use of balanced scorecards particularly useful in linking security KPIs to business objectives. It's not just about tools and frameworks; it's about being in sync with the business ecosystem. Incorporating lessons learned from previous incidents and external threat intelligence can further refine the strategy. Continual refinement and innovation should be the mantra; complacency is the enemy of security.

However the the security meetings should be more frequent. Atlest once a every 1.5 months. This way could keep up with ChatGPT creating hackers. Also simplicity is the key when developing solutions to tackle problems.

Learning from incidents is crucial for creating a resilient security posture. I've institutionalized After Action Reviews (AARs) post-incident, which engage all stakeholders, not just the security team. This broadens the understanding of the business impact and helps in refining risk assessments. Tools like AI-driven analytics can aid in root cause analysis, providing deeper insights into the incident. Importantly, the lessons should be integrated into a living document, continuously updating the incident response plan. Also, consider sharing sanitized findings with trusted partners or ISACs (Information Sharing and Analysis Centers) to improve collective security.

Incidents can be a valuable teaching tool but, it is equally important to not assume you faced the latest and greatest. You really need to understand the threat landscape and what the motivations are. Opportunity, political driver, activist, etc. then understand looking through a lens from their perspective. “Walk a mile in there shoes” then you can start to see the “opportunity” that they see. It isn’t until this phase that the proper defenses, controls, and governance will prevent itself as viable solutions.

I would like to know Marcel's insight in to benchmarking and how would he gather knowledge about similar technologies, novel ideas beyond ones own corporate environment.

Baselining against security frameworks is critical based upon your company’s industry, and risk profile. Infrastructure baselines like CIS provide staple industry backed standards, and external audit attestations like SOC 2 Type II and ISO 27001 eliminates selling impediments while helping to drive transparency about your security posture.

We look at policies and systems and their effectivness yet systems don't break policies, people do. Good education in an organization is not enough, the culture of security needs to be followed from the top to the bottom and up again. A CTO who runs simulation to test his users or a receptionist who can identify when someone is trying to get information over the phone that can lead to a potential data breach. Finally an over worked IT team that do not have the time to deal with security and user issue due to a lack of resources. Reputational harm costs more than the cost to maintain a good security team that by design protects your data, your clients data and ultimately your company.

The organization needs to adopt a strategy to enforce and manage security control and process regular risk assessment against the assets and implement relevant security controls to protect organization.