You’re in charge of cybersecurity. How do you make the right decisions?

Use the OODA loop framework to evaluate your situation and drive action: 1. Observe Collect as much actionable information as possible through existing documentation, previous risk assessments, and business plans/objectives. 2. Orient Analyze the data through the lens of current organizational priorities, risk appetite, and the threat environment. Identify key performance indicators (KPI) and milestones. 3. Decide Do not wait for "perfect" information before proceeding. Once you have a 70% solution, move on to the next step. 4. Act Implement the decision, tracking completion against your KPIs and milestones. The OODA loop works best if executed continuously and concurrently. Chain decisions together quickly to iterate rapidly.

Aside from a controls and vulnerability assessment, so many people ignore the business context, business priorities, and actual business risk. When "Assessing your situation," understand that half of your technical security conversations may be irrelevant without understanding what you are really looking at.

Begin by thoroughly assessing your organization's digital landscape, identifying assets, vulnerabilities, threats, risks, and compliance requirements. Simultaneously, evaluate available resources and capabilities. Utilize frameworks like SWOT analysis or the NIST Cybersecurity Framework to streamline information and identify gaps. Finally, integrate the Eisenhower Decision-Making Matrix for prioritization. This comprehensive approach ensures informed decision-making aligned with your organization's cybersecurity objectives.

Familiarize yourself with the organization’s business processes, security infrastructure, and its people. What are they concerned with, what are their pain points and what expectations do they have? Talk to executives, business functions, IT teams and other groups such as talent and legal and ask what risks they see across the company and how security enables or impacts their work. Remember security is about enabling people to thrive in their businesses, and building relationships is crucial in stepping up the security posture and making the organization more secure.

Es kommt in erster Linie nicht darauf an welches Framework man ausw?hlt, oft habe ich Diskussionen gesehen ob ISO 27001 oder doch IEC62443 oder NIST das bessere ist, das ist zweitrangig, wichtiger ist überhaupt eines auszuw?hlen und dieses richtig und kontinuierlich zu nutzen und zu verfolgen.

After gaining a lucid understanding of your circumstances, the next step is to articulate your cybersecurity goals and envisioned results. What is the overarching aim of your cybersecurity strategy? Establishing metrics to gauge success and progress is crucial. Aligning these objectives with your organization's mission, vision, and values is key for coherence. Crafting SMART objectives—specific, measurable, achievable, relevant, and time-bound—serves as a guiding framework, ensuring that your decisions and actions remain purposeful and aligned with your strategic cybersecurity endeavors.

Defining your objectives is an exercise you go through with functional business leaders. Understanding their needs, critical events, suppliers, 3rd party vendors involved helps you build a strategy that’s relevant and impactful.

Defining objectives is great but they need to be positioned in relation to something. Clearly define where you are now, then define where you want to be. This is where good objectives may differ from the all too often harped on SMART goals.

Bei der Zielsetzung für die Cybersecurity muss man sich immer im klaren sein, worum es eigentlich geht: Die eigene Business Continuit?t. D.h. ich muss die Abh?ngigkeit meines Unternehmens von der IT verstehen. Kritische Prozesse besser schützen als nachrangige, leicht wiederherstellbare Prozesse. In der Cybersecurity geht es darum, finanziellen Schaden abzuwehren, aber nicht um jeden Preis. Es muss ausgewogen sein und für den eigenen Bedarf passen. Nicht jedes Unternehmen ist KRITIS!

How can you build solid foundations in your organization for cybersecurity if you don't have a clear visual of your destination. Therefore, it is crucial you analyze all the business objectives and needs so you can build a strategy that reflects and answer to a specific situation. This exercise increase the efficiency of your measures and ensure you optimize your investment by implementing security controls that will secure an important aspect of your company.

Upon defining your cybersecurity objectives, the subsequent step entails a thorough exploration of potential solutions and actions that could facilitate the achievement of these goals. This exploration requires a detailed examination of the advantages and disadvantages associated with each available option, assessing their suitability in the context of your specific situation.

Moving forward, it's essential to delve into the realm of possibilities and alternatives. What potential solutions or actions can propel you toward your cybersecurity objectives? A comprehensive analysis of the pros and cons associated with each option is imperative. It's crucial to assess how these alternatives align with your specific situation and context. Embracing diverse scenarios and perspectives is key. Employing tools like brainstorming, mind mapping, or decision matrices can facilitate the generation and comparison of options, providing a nuanced understanding to inform your decision-making process.

Don't have a tunnel vision over a certain methodology. It is a great mindset to approach every problems and milestones with an open minded thinking. Therefore, a good exercise to complete is benchmarking all the possible solutions to understand the pros and cons of each solutions. You might be able to see better solutions by identifying all the functionalities and limits of a solution. Make sure to also hear the feedback and opinions of your team. Some of your team members might have a more specific and expertise over a certain topic which can benefit your decision making process.

One thing I found helpful when creating a cybersecurity strategy is to think how to apply it from people, process and technology perspective. How does your cybersecurity strategy affect capacity, does your existing team have the capability to carry out the strategy, is your current process aligned with NIST or other selected cyber framework? Do you have any technology that helps you monitor and alert vulnerabilities? Going through these questions as a team helps you derive a more balanced cyber strategy.

Every organization should have a cybersecurity playbook. This playbook consists of all basic cybersecurity information (I.e. what company assets are being protected, who has access to them, process to obtain sensitive data, etc.) It’s like a manual for pilot. New hires should go through that as part of their on boarding process. The playbook should be refreshed as things evolve.

Use adversary intelligence to effectively and efficiently prioritize and evaluate your decisions. By understanding who your adversaries are, what their motivations are, what their constraints are, what their resourcing is, and what their playbooks look like, you can prioritize better, assess risk more accurately, build more effective controls, and operate more efficiently than if you use traditional frameworks and thinking.

Upon thorough exploration of available options, the next step involves crafting a strategic plan for implementation. This pivotal phase marks the culmination of your decision-making journey, where the final choice is made based on meticulous criteria and analysis. It's paramount to factor in the potential impact and consequences of your decision, contemplating how you will communicate and justify it to stakeholders. A comprehensive and lucid plan detailing actions, responsibilities, allocated resources, timelines, and contingencies is essential for seamless execution. This strategic blueprint serves as a guiding document, ensuring a well-defined path forward with clarity and precision.

Now, this is finally the step where you can look more in depth at a variety of frameworks and standards and base your strategy on industry best practice. Not only does this help with getting you on the right course, but it also makes your strategy defensible whenever it inevitably is attacked. Security is always going to get some push back by its very nature, be ready to have a why to explain and defend it.

The strategy you are going to implement will ensure the execution is done in an optimal manner. It needs to involve all the concerned parties, communication channels and techniques which will be used to fulfill the job. Don't forget to detail out the different milestones, budget, time and resources needed to complete a job. A strong communication minimize the risk of errors.

Make 70% decisions. This means not waiting until perfect information before acting, but rather accepting some uncertainty before proceeding. Especially because the pace of technological development (and speed of attackers) is fast - and accelerating - lengthy deliberation is likely to create more risk than it resolves.

Having an executive dashboard that provides key cybersecurity risk landscape helps. Benchmark where you are at first. Automating the monitoring process is a must. Sharing your plans and seeking feedback prior to executing it is important.

With your plan in motion, the subsequent step is its execution and vigilant monitoring of results. This phase is the litmus test for the effectiveness and efficiency of your decision. Actively track progress and performance, gathering valuable feedback and data essential for evaluating outcomes. Employ tools like dashboards, reports, or audits to meticulously measure and document results. This ongoing monitoring ensures that your decision aligns with the envisioned goals and provides insights into any necessary adjustments or refinements required for optimal performance. Regular assessments guarantee that your cybersecurity strategy remains dynamic and responsive to evolving circumstances.

Just as we have feedback in systems it's also important to have feedback with respect to your decisions to adjust if you need to. Always looks for ways to improve. Feedback tells us how we did, or are doing dynamically (like a steering wheel) so that's important to use this as another tool.

-- Identify and assess potential risks to your organization's information systems. Prioritize risks based on their potential impact and likelihood. -- Implement continuous monitoring systems to detect and respond to security incidents in real-time. Regularly assess the effectiveness of your security controls and adjust them as needed. -- Educate and train employees on cybersecurity best practices. Foster a culture of security awareness to reduce the risk of human error. -- Assess the security practices of third-party vendors and partners. Ensure that vendors adhere to your organization's security standards. -- Establish clear cybersecurity governance structures within your organization.

Remember to also ensure there you also have alignment with business needs. You can do this by communicating your findings, strategy and short/long term roadmap and plans with your Executive and business stakeholders which will be critical to your success and the success of the security program at your organization.

It is important to understand the "right decision" is much more nuanced than a pronounced black-and-white process. What is right today, may be wrong tomorrow. It is important to remain flexible and adaptable, and to see input. If you are in a leadership role in cybersecurity, or otherwise, you must effectively communicate. Importantly as well, you have to make decisions. Many people I know struggle with this concept (i.e., making decisions). Again, your business understanding and relationships will be essential in the process of making the right decisions.

The concept of "right" rarely applies here. But efficacy and efficiency does. Make effective decision to do things efficiently. Then pivot fast when something doesn't work.