With no foreseeable end to IT security risks – and the increased sophistication of threats poised to negatively impact business continuity, finances, organizations' reputations and/or intellectual property – security programs should always remain top priorities.
By planning ahead and aiming to enhance operational efficiencies, organizations can prioritize expenditures and implement programs to increase their security posture.
While improvements to security are no doubt multi-pronged, my best recommendation is for organizations to build a strong security program and risk management strategy. This program would have multiple elements, including strong governance, an oversight committee and a well-executed educational program.
At times of strapped resources, organizations should prioritize their budgets to achieve a number of priorities.
The first of these is to understand and protect against risk. As always, preventive security strategies are preferred, and it's recommended that organizations adopt a tiered protect/detect/respond strategy for optimal coverage. A vulnerability assessment can give senior executivess a view of their company's information security risk profile.
Secondly, it makes sense to consolidate to gain operational efficiencies. Most organizations that have implemented defense-in-depth, layered security with risk management strategies have a lot of the elements necessary to improve their security posture. Organizations should look to provide operational efficiencies by consolidating their security management systems.
It's also important to utilize endpoint security. While companies have beefed up network security over the years, endpoints can still pose security threats. Consequently, organizations should plan a program to address data protection.
And last but not least, implement network access control. Network access control enforces endpoint security policies by setting a baseline of who's allowed on the corporate network, as well as what services they are allowed to access.
With these guidelines in mind, companies can steer IT spending – and get in the fast-lane toward a more flexible, adaptive and holistic security strategy.
By planning ahead and aiming to enhance operational efficiencies, organizations can prioritize expenditures and implement programs to increase their security posture.
While improvements to security are no doubt multi-pronged, my best recommendation is for organizations to build a strong security program and risk management strategy. This program would have multiple elements, including strong governance, an oversight committee and a well-executed educational program.
At times of strapped resources, organizations should prioritize their budgets to achieve a number of priorities.
The first of these is to understand and protect against risk. As always, preventive security strategies are preferred, and it's recommended that organizations adopt a tiered protect/detect/respond strategy for optimal coverage. A vulnerability assessment can give senior executivess a view of their company's information security risk profile.
Secondly, it makes sense to consolidate to gain operational efficiencies. Most organizations that have implemented defense-in-depth, layered security with risk management strategies have a lot of the elements necessary to improve their security posture. Organizations should look to provide operational efficiencies by consolidating their security management systems.
It's also important to utilize endpoint security. While companies have beefed up network security over the years, endpoints can still pose security threats. Consequently, organizations should plan a program to address data protection.
And last but not least, implement network access control. Network access control enforces endpoint security policies by setting a baseline of who's allowed on the corporate network, as well as what services they are allowed to access.
With these guidelines in mind, companies can steer IT spending – and get in the fast-lane toward a more flexible, adaptive and holistic security strategy.
