Tactics Over Tools: Why Strategy Needs to Come Before Solutions for Optimal Security

Note: This article originally appeared on the Stratosphere Networks website.

You're probably familiar with Aesop's famous fable, "The Hare and the Tortoise," in which the hare agrees to race the tortoise, confident that he'll win easily. He dashes far ahead of his rival and is so sure of his victory that he decides to take a nap. However, the tortoise progresses slowly but steadily, passes the snoozing hare, and ultimately wins the race. 

This classic tale illustrates that the way you approach a challenge can matter much more than the tools or capabilities at your disposal. The hare had all the right "technology" to come out on top, which fueled his arrogant attitude and led him to put less effort into his strategy. We can apply this lesson to many other areas of life, including cybersecurity and data breach prevention: You can't simply install a bunch of next-gen solutions and sit back, confident that they'll be enough to achieve your end goal of optimal security posture. All the tools in the world won't save you from a steady barrage of cyberattacks if you don't have the right processes in place first and a well-rounded strategy as your foundation.  

Tools Are Toothless Without the Right Strategy

While cutting-edge solutions can make a difference when leveraged properly, more tools don't necessarily equal better security. A survey of over 3,400 security and IT professionals worldwide found that organizations utilizing the most security tools (over 50) ranked themselves as 7 percent lower in responding to an attack and 8 percent lower in their cyberattack detection capabilities compared to those using fewer than 50 solutions, according to the 2020 Cyber Resilient Organization Report from IBM Security.   

One of the factors that contributed to better incident response capabilities was formal planning, according to the report. Only 39 percent of survey respondents with a formal cybersecurity incident response plan (CSIRP) reported suffering an incident that significantly disrupted their business during the past two years, compared to 62 percent of those lacking an official CSIRP. 

These survey findings highlight the pitfalls of focusing on tools without thinking about strategy first. There's a dizzying array of cybersecurity solutions currently available, and adopting a bunch of them without figuring out the best way to approach security first can leave you lost and less able to safeguard your network and data than you would be with better processes and fewer tools. 

How to Achieve Optimal Cybersecurity With a Strategy-First Approach

Early in my career, someone mentioned an aphorism to me in passing. It has always stuck with me; call it an operational proverb of sorts.

"To automate a process, you need to actually have a process in the first place!"

If you want to achieve the highest possible level of security, it's vital to formally establish internal processes for information security, disaster recovery and incident response. You'll want to work with a team of high-level experts to get those processes in place – a Managed Security Service Provider (MSSP) like Stratosphere Networks can provide guidance. 

Additionally, to create and maintain a thorough security strategy, you'll need to routinely assess your risk level and points of vulnerability. A comprehensive risk assessment is a great first step on the path to more effective data and network protection. Once you have a clear idea of where you currently stand and have formally defined all the important procedures, then you'll be able to determine which tools you need to safeguard your organization and learn the best ways to leverage them to achieve your objectives.

If you'd like to learn more about how to establish a comprehensive cybersecurity strategy, our team has extensive experience advising our managed cybersecurity clients and would be happy to assist you. Feel free to give us a call at 877-599-3999 or email [email protected]. 

Jesse Miller is the CISO of Stratosphere Networks, which provides comprehensive managed services - including managed cybersecurity, managed IT and co-managed IT services - and trusted advisor services to businesses across all industries. Our team of IT experts strives to empower clients with exceptional service from our state-of-the-art Network Operations Center and Security Operations Center. Visit www.stratospherenetworks.com for more information.