What would you do if your enterprise had unlimited funds to spend on cyber security? Install the very latest technology to identify malware? Hire every security analyst you could find to monitor and respond to potential breaches in your network? In a perfect world, these would be options you could afford, and you’d invest in them without hesitation.
Unfortunately, most organizations do not have an unlimited security budget and must maximize results with limited resources. Based on our experience with organizations of various sizes across diverse industries, we have compiled some strategies for common challenges.
Scenario 1: An organization with newly acquired or segmented businesses
Common challenges of new acquisitions or business segments include: disparate systems and technologies, decentralized infrastructure, diverse priorities and differing existing technologies.
Strategies for finding ways to leverage buying power across the entire organization include:
· Perform an assessment of the current environments and security capabilities
· Analyze the assessment results to identify commonalities and capability gaps
· Develop a security technology strategy to utilize organization wide
· Minimize the number of vendors to maximize buying power and lower costs
· Utilize an internal charge-back model to allocate the cost to each business segment
The assessment should consist of specific criteria to obtain an understanding of the security technology environment. Examples of information to capture during an assessment include: categorization by vendor, capability, dependencies and deployment topology. The results will then determine potential synergies and strategies to improve existing security technology deployments and create processes to support enterprise wide purchases. An internal charge-back model can assist with managing costs once an enterprise-wide technology is in place. Costs can be allocated back to each business segment based on the number of endpoints, usage or other metrics. Therefore, costs are still managed at the business segment level while still achieving volume efficiencies.
Scenario 2: A company has underutilized or unimplemented technologies
Common obstacles that can prevent organizations from realizing the full potential of security technologies include: leadership priorities, resource constraints and overly ambitious project goals.
Strategies for successfully executing security projects include:
· Prioritize projects and spending based on security risk, realistic duration, available resources, and the overall security mission of the organization
· Proportion large projects into manageable segments
· Develop smaller strategic security project goals to achieve quick wins and show progress against the overall larger project
With careful planning, accountability, and supervision, organizations can maximize results and minimize spending on unnecessary security technologies.
Scenario 3: Automate repetitive manual processes
Repetitive manual processes can waste valuable resources, weaken the security control environment, and inhibit the information security organization. Initially, the implementation of an automated process can appear daunting; however, with some strategic planning, organizations can generate long-term efficiencies.
Some strategies for automating security processes include:
· Perform a detailed analysis of process times within the information security organization
· Prioritize improvements based on potential time savings and ease of automation
· Utilize built-in API interfaces to automate interactions between security technologies (e.g., endpoint and network controls)
· Develop scripts to accomplish repetitive tasks, data manipulations, and reporting
With some initial time and resource commitment, organizations can achieve improvements and add efficiencies using their existing security technologies – even without unlimited funds.