You're a leader in Network Security. How can you gauge the success of your security initiatives?

We must measure our security success by response speed to incidents, incident frequency, recovery time, update efficiency, training effectiveness, compliance, and tool accuracy. These metrics help us stay secure and improve continuously.

Several best practices for leveraging metrics to drive cyber maturity are as follows: 1) Align to industry best practice standards/controls associated with the type of organization you are 2) Baseline all networked systems to those standards - implement rules and adjust tools, then LOG all the relevant alerts 3) Quantify the quality of your implementation based on the completion of deployment of controls - how many systems out of how many systems are covered 4) Drive improvements based on quantifiable outputs from your security tools - analyze LOG data 5) Don't fall into the trap of patting yourself on the back and hire a pro to pen test and evaluate your work

Podemos avaliar o sucesso das iniciativas de seguran?a implementando as seguintes práticas: - Monitoramento de Incidentes; - Auditorias e Avalia??es de Seguran?a; - Conformidade com Normas e Regulamentos; - Métricas de Desempenho;

We should measure the effectiveness of our network security initiatives based on these parameters: Number of Incidents, Incident Response Time, Severity of Incidents, Time to identify new vulnerability, Time to Implement New Security Measures, Number of Security Policy Violations, Risk Assessment Scores, Mean Time to Detect (MTTD), Mean Time to Respond (MTTR).

KPIs are effective tools for external stakeholders, but for internal team measurement, OKRs (Objectives and Key Results) are more important. KPIs are short-term and can be manipulated, whereas OKRs are long-term and not as easy to measure. However, once achieved, they have a lasting impact. For instance, you could meet the KPI of a low phishing test failure rate by running an easy test, but an OKR of educating your staff to avoid clicking on phishing emails contributes more significantly to protecting your company. Your staff can then become your strongest defence, and this achievement won't easily fade once accomplished.

L'audition régulière de son système d'information permet d' affirmer ses initiatives de réduction de la surface d'attaque dans son SI, la renforcer qui plus est.

I would also add that an organization's security is heavily dependent upon its people's preparation for day-to-day security activities and a crisis-ready mindset. The organization protection thread is within more often than without.

Acredito muito que nas auditorias tanto internas quanto externas servem para corrigirmos alguns pontos que podem ser críticos, mas te dá um norte para você corrigir a tempo, muito melhor perder um tempo a mais para fazer esses corre??es do que ser explorado por um atacante que n?o vai te dar op??o de corrigir.

As stated the human is the weakest link in this chain, so the most attacks happen with social media where a human is targeted and regardless what you have spent on hard- or software is jeopardized by just one click. Security Awareness is one of the most important training to give to employees and they can use it also on their private online life...

Regular phishing simulations and security training are a great way to evaluate employee awareness and readiness in identifying and reporting phishing campaigns. Improvements in these tests can indicate successful training and awareness programs. You can use tools like KnowBe4, Terranova etc to conduct phishing simulations and security training

Training should be meaningful; the content should relate to staff's daily work or life. Staff should see the benefits of attending the training. The 'check-the-box' type of training will only waste time and defeat the purpose of training.

Threat Intelligence needs to be applied, black and whitelisting is not enough anymore. Modern attacks can lie dormant for x time in your system without anybody noticing. If you invest in threat intelligence you will mostly receive a lot of swarm intelligence data with it, so invest in it so you can be protected from what happens outside of your perimeter.

Incident analysis is a valuable tool for training your team. Don't limit yourself to your own incidents; you can learn from others' incidents too. Understand the details of how others were compromised and ask your team to double-check if the same could happen to you. Ask them what they would do differently if it did. This approach can be more effective than tabletop exercises or annual drill tests.

Leveraging lessons from past incidents, threat intelligence, and regular audits to validate KPIs enables adaptive and informed security strategies. This approach ensures the organisation remains proactive in addressing emerging threats. Benchmarking against industry standards helps set realistic targets, maintaining a competitive edge. When data indicates new threats, KPIs can be adjusted to keep security measures relevant and effective, fostering continuous improvement.

Incident analysis and make sure you don't have am idiot teaching your clients how they should be using their software. What they should not and ever do when having an issue. I really think we should proceed with the UNIONIZATION of IT professionals. Having someone who just got out of high school, took one course to get his IT certification and drop him in a large company will destroy what most have worked to create. The person who replaced me when my contract ended, didn't even understand the federally required courses to work in the IT industry.

Avoid the temptation to pursue new technology solely for its latest features. Begin by reviewing your organization's requirements and evaluating the capabilities of your current security stack. Many organizations purchase technology but only deploy a fraction of its features before it reaches the next refresh cycle. Make sure to fully utilize the capabilities available to you. Prioritize automation, managing it as code, with auditable and QA-tested processes to avoid production impact and simplify the need for manual deployment every time there is a change.

I would look at my level of success by how much we could anticipate technology trends and associated products. Have we looked at the mmaturity of what we have and determined if we are falling behind the curve and statred the process of looking at whats out there. That assumes that what we have has gaps in capabilities. I would not advocate replacing anyting just for the sake of replacement. I would also look at what level of knowledge my. staff is maintaining and encouraging them to keep current and point out any risk gaps. Do we have a maturity program where we understand our maturity levels in the many dfferent Network Security areas and have we mapped out a plan for review based on business and projected need.

It isn't only tools. Every few years another service provider (MSSP) comes to market with better capabilities, more intelligence, faster response times, and more favorable pricing. Renewal because it's the easy button, shouldn't be your first choice. Analyze current requirements and the current market. A SEIM vendor of the past doesn't provide the security of a SASE vendor of today. Things change. Is it worth it to evaluate and suffer through the migration from vendor A to B? Only your analysis or your analysis with expert assistance can provide that answer.

True success in network security goes beyond achieving individual metrics; it lies in the organisation's agility and responsiveness to evolving threats. A flexible security posture, enabled by regularly updated metrics and strategies, allows rapid adaptation to new risks and minimises the impact of incidents. Continuous training, frequent updates to security tools, and fostering a culture of ongoing learning and improvement ensure comprehensive preparedness for various threats. By maintaining this agile and proactive approach, organisations can effectively defend against current and future challenges, ensuring robust and resilient security readiness.

Create a risk profile and then a plan to reduce risk as much as possible. There is no silver bullet in IT security but there are things that can be done to create acceptable risk.