Episode 200 - Building a Security Strategy - Part III

Episode 200 - Building A Security Strategy - Part III Recap Strategy vs Policy Understand the business of your Business Know who your stakeholders really are Capability = (Tech + Service) * Process Crawl, Walk, Run It Takes A Village The Question is "How do I make one?" Tech Tech, by itself, only consumes electricity and turns cool air into warm air So many choices…. The tech selection is the *least* critical one for developing a capability This is the "Stuff You Have To Do" Usually determined by regulation, policy, or corporate edict Describes a desired outcome - not how to get there Examples include "Malware Detection", "Email Security" Service How you do the crazy things you do Security is not a One-Off - things must be repeatable and consistent Process Describes value team brings to org While tech and service selection is important the biggest improvement usually comes from better process Capability Capability = (Tech + Service) * Process Armorguy's Maxim of Life: "Start small and iterate larger" Try to do to much out of the gate and you WILL fail Define success criteria for each stage that allows for error and learning Crawl, Walk, Run Security cannot exist as an island Interdependence with business units is key - if you don't you are the foreigner and will be rejected The relationship with IT Operations is going to be wonky at first It Takes A Village Where do you look for more info? Strategy - It's What CISOs Do…

You can listen to Episode 200 - Building a Security Strategy - Part III online on Radio and Podcast. Open the player on this page to stream the available audio.

Episode 200 - Building a Security Strategy - Part III is an episode from The Southern Fried Security Podcast by Martin Fisher.

This episode is 26:14 long.

This episode was published on Sep 13, 2017.

Yes. Use the heart button on the episode page to add it to your favorite episodes list.

Yes. This page shows related episodes from The Southern Fried Security Podcast when more episodes are available from the podcast feed.