Skip to main content

How to plan for a successful IT Security Team?

So I saw this come across one of the mail lists I watch today:

"Hi All,

Can anyone provide the references on the internet for best practices for forming IT and Security Team Structure?"

And it stuck me as a good topic to go in to some depth on, and it's not nearly as easy to answer as you'd expect.

To take a step or three back...

Some questions and ideas to get your thoughts flowing.

What problem are you trying to solve?
What resources or support do you have?
What limitations or constraints do you have?

Also consider the scope of what you are trying to accomplish, and the requirements (if any) provided by your management or company for success (hopefully you can define these to more accurately match what you intend to create).

Let's work on each of these questions a bit.

What problem are you trying to solve?
This seems simple, but to be successful you need to phrase this in a way that identifies a need (preferably a business need) and how you intend to improve the systems, processes, or environment to correct or prevent "bad things" from happening. The best motivators for Risk Management or Security these days is compliance. No matter the industry, compliance (with laws, privacy regulations (usually state, or GLBA for financial, or HIPAA for health care) is a key risk. Another key concern from a business perspective is protecting the intellectual property that the company creates (and also protecting trade secrets).
Warning here - Many pure techies and or security folks will come up with a problem statement something like "deploy network monitoring" or "create incident management process" which are both good solutions to problems, but not problems.

What resources or support do you have?
Hopefully you can answer this one with "unlimited budget and unsewerving dedication to all things security by senior management". If not, make sure that you have established the need for a security program with your management, the expectation that there will be costs involved (capital and expense, and on-going maintenance and likely staffing costs).

What limitations or constraints do you have?
We all have them, and it's better to be aware of them and work them in to your plan than to have them surprise you. Maybe you have a specific time constraint (within the next three quarters, in the next year, or maybe one month). Maybe there is a cost limitation (you only have $1,000 and a roll of duct tape). Whatever your constraints are get them on paper and address them with ideas and work them in to your plan. If you have only a month, scale back your grand ideas and focus on gathering requirements or understanding the needs of the organization better. If you have a year, plan to establish basic level services, but maybe postpone the more complex parts until later, etc.

If you take the answers from these questions, and spend some time talking to the management of your company, and understanding that makes them tick you will be in a much better position to succed at any project (including establishing security program).

So for our next installment I will discuss a sample Information Security Service Catalog.

->Pierre
Labels:

Comments

Post a Comment

Popular posts from this blog

Requirements for Information Security

If you want to get into Information Security you HAVE to be a/have this skill... Why this is total BS. Almost daily I see someone posting on twitter, trying to be helpful to folks who are looking to get into InfoSec. Often I see "If you want to be in Information Security (Cyber Security) then you HAVE to be a programmer" or "If you want to be successful you have to be a hacker/have a criminal record/have abused systems without permission" etc. While having technical capabilities (such as programming) and having the ability to compromise a system shows a specific skillset neither are required. When talking to people who are interested in Information Security I often refer to it as a cake, there are tons of slices, many flavors, many pieces and parts you can sample, choose to focus on, will be expected to know something about, etc. Incident Response and Forensics (my current focus) is not the only part of Information Security, and certainly not the only part tha
Post a Comment
Read more

Busting the myth of the malicious insider

The Myth of the Insider Threat Too often after the announcement of a new breach, the first reaction from the victim company and the media is "another malicious insider attack".  Case in point, I was catching up on news from various sources and came across the following: http://www.idgconnect.com/abstract/19647/lessons-sage-leak " “We believe there has been some unauthorised access using an internal login to the data of a small number of our UK customers so we are working closely with the authorities to investigate the situation,” the Newcastle, England-headquartered firm said in a statement." Of course an internal login was used to access the data, as part of the attack lifecycle, during your reconnaissance phase you identify accounts to target for possible compromise, based on the access/role of the individual.   Phishing attacks or other simply attacks are often successful in gathering login credentials for individual users, which can then of
Post a Comment
Read more
Weekly recap and why you should be concerned about "attackers" even if you have "nothing to hide" Why you should be aware of, defend against, and prevent attackers... even at home: I often hear from future victims "well I don't have anything to hide/anything of value/why would they target me!?" It's really not about you, usually the attackers aren't looking for your data (if they get it, or have easy access to it, they may try to profit from it, but the people doing the compromising aren't usually the same folks that monetize). What the attackers want are compromised systems they can use to do what they want at scale. So if they can compromise 50 systems, they can send 50X the amount of SPAM... 100 systems, 100X, etc. Some operations get paid based on the number of emails they can send per day. Of course the email will likely not just be SPAM, but may also be malicious (ransomware, etc.). http://thehackernews.com/2017/09/linux-ma
Post a Comment
Read more