5 Tips for Keeping Your Security Team on Target

When I sit down to write an article, I encounter any number of distractions. Each distraction seems to want nothing more than to keep me from writing. But my distractibility is not limited to writing. I also encounter a near-constant stream of distractions when I sit down to do most any task.

What does this have to do with security? In security, as we go about the business of protecting our organizations, most of us face a near-constant stream of distractions. If we allow those distractions to drive our day-to-day work, we can very quickly lose focus, which in turn weakens our security postures by preventing us from tackling the items that are most relevant and important.

In this piece, I'd like to share five steps for keeping your security program on target and on track:

Step 1: Build a framework. I've noticed over the course of my career that the people who seem to be busy and overwhelmed all of the time are the same ones who are extremely disorganized. Although getting and staying organized requires an investment in time, in the long run, the investment will pay huge dividends. This is particularly the case with respect to evaluating what activities your security organization should engage in. Building a framework to formalize how the security team encounters new ideas and possibilities, evaluates them, and decides whether and how to approach them is essential to staying on target because it reduces the chance that the organization will be led astray by more attractive distractions.

Step 2: Develop good processes and procedures. It is far too easy to get sidetracked: A security analyst spends far too much time on dead-end leads during analysis and investigation, or a member of the governance, risk, and compliance team is overly focused on a specific control or policy whose impact is marginal. Perhaps the vulnerability team wastes time uncovering vulnerabilities without considering the necessary context that would allow them to prioritize and address the most important ones with IT. Whatever the example, having mature processes and procedures is a great way to avoid many of these potential time traps and ensures that the security program stays focused on what's important..

Step 3: Maintain a strategic direction. To ensure that your security program is on course, it generally helps to have a well-defined vision and strategic direction. This statement may sound obvious, but far too many security teams ignore these essential guiding forces. If you take a step back and think about it, it seems foolish to expect your team members to choose the right path when they lack the fundamental criteria against which to evaluate each potential direction. The board, executives, and security leadership should all have a vision for how they want the organization to defend itself against the most concerning risks. That vision should be documented and communicated, along with the organization's strategy to realize the vision. These documents should be readily accessible and in the foreground of each team member's thinking. This ensures that members of the security team will have a strong foundation upon which to evaluate data points as they encounter them and make the appropriate decisions.

Step 4: Stick to goals and priorities. Vision and strategy are great strategic-level tools, but they don't help us stay on track at the operational and tactical levels, where each functional area needs well-defined goals and priorities to chart and maintain a course of action. It's important to take the time to set goals and priorities for each functional area in line with the security organization's broader vision and strategy. Those goals and priorities should then be documented in detail and used as criteria for decision-making and prioritization of day-to-day activities. Before any decisions are to be made, the data points should be evaluated against specific criteria. Will going in this particular direction help us achieve our goals? Is this activity a good use of time, and is it in line with our priorities? Does the endeavor help improve the security posture of the organization? If the answer to any of these questions is no, what's being proposed is likely not worth the effort.

Step 5: Objectively evaluate impact. In nearly every security environment, competing priorities are a constant. With limited human resources, budget, and technical capabilities, each potential undertaking needs to be evaluated against its potential impact to the organization. If a task, assignment, or project seems like a great idea and a wise use of resources, ask yourself if that activity will directly impact the organization in a positive manner. Will the undertaking improve the security posture of the organization? If so, how can that impact be measured? At what cost will that impact come? If the answers to any of these questions seem uncertain, it's likely that you'll need further analysis before making a decision to engage.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Criminals Hide Fraud Behind the Green Lock Icon."