Security architecture is the framework that defines how your organization protects its data, assets, and operations from cyber threats. But as the threat landscape evolves, your security architecture needs to adapt and improve. How do you measure your security architecture against new threats? Here are some tips to help you assess and enhance your security posture.
Before you can measure your security architecture, you need to know what you want to achieve and what you need to comply with. Your goals and requirements should align with your business objectives, risk appetite, and regulatory obligations. You should also consider your stakeholders, users, and customers, and how they interact with your systems and data. By defining your goals and requirements, you can establish the scope and criteria for your security architecture evaluation.
The business objectives must be clear, concise, and achievable. This is how you can design a strategy to have the adhesion of all stakeholders and collaborators, and for sure the implementation of the established scope and criteria will become successful.
One thing I found helpful is regular alignment meetings with the business units to understand future plans and changes in business strategy allowing the information security unit to be proactive. This may include acquisition and mergers which may lead to new regulatory requirements that didn't exist earlier.
Prototyping approaches are appropriate when this isn’t clear, and for feedback for user experience in particular. Use the acronym SCORE to assist in understanding and communicating what you are trying to protect for the business: safety, compliance, operations, reputation, economy (revenue). Don’t do this in isolation - talk to different people in the business.
To measure security architecture against new threats, employ a multi-faceted approach. Regular risk assessments help identify vulnerabilities. Implementing threat intelligence feeds aids in understanding emerging threats. Conducting penetration tests and red team exercises simulates real-world attacks. Continuous monitoring with security tools ensures timely detection and response. Regular updates and patches keep systems resilient. Finally, ongoing education for staff fosters a security-aware culture.
Understanding Business Goals: Begin by understanding the broader business goals. What are the crown jewels of your organization that need protection? Legal and Regulatory Requirements: Identify all legal and industry-specific regulations that your organization needs to adhere to. GDPR, CCPA, HIPAA, and PCI DSS are a few examples.
Next, you need to review your current security architecture and identify any gaps or weaknesses that could expose you to new threats. You can use various tools and methods to audit your security architecture, such as security assessments, penetration testing, vulnerability scanning, and threat modeling. You should also check your security policies, standards, and procedures, and how they are implemented and enforced. By reviewing your current state and gaps, you can understand your current security level and where you need to improve.
Check out tidal community edition for specific TTPs on specific threat actors likely to target your industry or region. Self-assess against NIST or C2M2. Continually put yourself in the shoes of an attacker and look to get independent or outside views to avoid bias, and gaps that are often overlooked when you are often on the defence. Consider control diversity, NIST function areas, and layered security are important. Security is only as strong as your weakest link - find a balance between depth and breadth. The common attack vectors should be prioritised: social engineering / human element (phishing), internet-facing server weaknesses, third-party/ supply chain vulnerabilities
Internal Audit: Conduct a thorough audit of your current security infrastructure. Determine what's working and what's not. Threat Landscape Analysis: Engage in continuous monitoring of emerging threats. Understand how they could potentially impact your organization. Gap Analysis: Based on your findings, identify where you're vulnerable and the potential risks involved.
Another way to measure your security architecture is to compare it with best practices and standards in your industry and domain. You can use frameworks and guidelines such as ISO 27001, NIST SP 800-160, SABSA, or TOGAF to benchmark your security architecture and identify any deviations or discrepancies. You should also monitor the latest trends and developments in security architecture, such as cloud-native, zero-trust, or microservices, and how they can affect your security strategy and design.
Experience and intuition on how and when to use these is very valuable and should be cultivated for any security architect. Care with hype cycles. Architecture paradigms and tools (eg: zero-trust) when considered with high-level and priority business cyber risks and information assets can help in understanding their value.
Industry Frameworks: Leverage widely-recognized security frameworks such as ISO/IEC 27001, NIST, or CIS Critical Security Controls. Competitor Benchmarking: Understand the security measures that peers and competitors are employing. Sometimes, industry-specific security challenges can be addressed through collective wisdom.
To measure your security architecture performance and effectiveness, you need to define and track key performance indicators (KPIs) and metrics that reflect your security goals and requirements. Some examples of security architecture KPIs and metrics are mean time to detect (MTTD), mean time to respond (MTTR), security incident frequency and severity, security compliance rate, and user satisfaction. You should also collect and analyze feedback from your stakeholders, users, and customers, and how they perceive your security architecture.
Tie / select the metrics mapped to weaknesses / vectors identified in a high-level business cyber risk register. The SeeMetrics platform looks interesting to help collect and showcase metrics. APIs and PowerBI are a good option for automation. Start simple, and go into detail one area at a time - selecting, tracking and collecting these metrics takes time.
KPIs and Metrics: Define clear metrics that reflect the performance of your security infrastructure. This could include metrics like time-to-detect, time-to-respond, and patch management efficiency. Red/Blue Team Exercises: Simulate real-world cyber-attacks (Red Team) and defense mechanisms (Blue Team) to gauge your organization's response capabilities.
Based on your measurement results, you should prioritize and implement your security architecture improvements to address the most critical and urgent gaps and issues. You should also align your improvements with your business priorities and budget, and communicate them to your stakeholders, users, and customers. You should also document your changes and update your security policies, standards, and procedures accordingly.
Select items across NIST function areas, and control diversity. Prioritise major attack vectors tied to high-level business cyber risks. Look for items that you can track and maintain with metrics, are are lower in time / effort and cost. Items that can be well evidenced and supported also make sense.
Risk-based Prioritization: Not all vulnerabilities are equally critical. Use a risk-based approach to address the most pressing issues first. Feedback Loop: Post-implementation, gather feedback to understand if measures are working as intended and adjust as necessary.
Finally, you should repeat the measurement process regularly to ensure that your security architecture remains relevant and effective against new threats. You should also review and update your goals and requirements as your business needs and environment change. By repeating the measurement process, you can continuously monitor and improve your security architecture and maintain your security posture.
Continuous monitoring is paramount from this standpoint, so as to improve and innovate in the fast-changing environment. The growing threat landscape is the catalyst that forces the company to remain alert and review the existing controls V/s the existing security posture. This is where the repeating of the measurement process became a priority.
Periodic Reviews: Security isn't a one-time affair. Schedule periodic reviews to ensure continuous security posture improvement. Stay Updated: As new threats emerge, and technology evolves, update your threat models, and re-assess.
Employee Training: Humans are often the weakest link. Regularly train employees about the importance of security and best practices. Vendor Management: Ensure that third-party vendors and partners align with your security standards. Incident Response Plan: In case of a breach, have a clear and actionable plan on how to respond, recover, and learn from the incident. Collaboration: Foster a culture where security is everyone's responsibility. Encourage departments to collaborate, share insights, and drive towards a common goal of ensuring safety.
Most of the time, the threat persists in the form of "Data" or "Information". In the past, we had this unpleasant situation where some of the confidential information was leaked - which resulted in escalations. Our investigation showed that this information was shared many years back. I got a DLP (Data Leak Protection) solution implemented then. This would have a record of any and every file that left our office network. This way, we could take a look at the log any time to see the details of the transfer of information. We had even set up notifications to receive emails if the file names contained specific keywords. We can put the technology to better use for addressing the threats.