Security Think Tank: Shift to outcomes-based security by focusing on business needs

Education for all

Communication and education are both critical. There needs to be an understanding of the risks being managed and the importance of this for the enterprise as a whole, as well as the role of each individual within it.

The channel for this education is of less importance. The crucial element is that the message is embedded into the minds and actions of all stakeholders. Audit, risk and security teams need to be equipped with the skills to communicate to their business’s teams in a way that enables them to better appreciate the priorities of the business and where these can be supported by security.

Organisations tackle this articulation requirement in different ways. It is not unheard of for some to enlist specialist performance coaches to help teams increase their emotional intelligence and empathy, as well as their presentation skills.

Day-to-day actions and decision-making are then influenced by this knowledge, which encourages people to be less trusting and more vigilant in identifying when a request is suspicious, thus reducing the likelihood of security risks. This starts to lead to “security by design” and other core principles being applied and adopted more consistently, which, in turn, creates a positive multiplier effect. 

Fostering the right culture

As well as an emphasis on education, it is essential that organisations foster a culture that supports “doing the right thing”. This requires mechanisms and processes that enable concerns to be raised easily and without fear of retribution. This does not happen overnight, however, and enterprises need to allow time for it to embed fully.

It is important that people throughout the organisation feel supported and confident in speaking up about any activities that may adversely affect the security design or increase the threats. This may sound obvious, but business projects have defined plans and milestone dates, and standing in the way of these to raise concerns from a secure architecture point of view is a daunting prospect.

However, a supportive culture and an outcomes-focused security strategy will champion legitimate challenges, hearing and considering the claim regardless of the seniority of the individual making it.

Similarly, there need to be appropriate channels for individuals to flag poor practice, without having to challenge the perpetrator directly (which can have serious consequences in terms of stress and morale). Few people willingly become whistle-blowers. It is therefore far better for an organisation to ensure there is a safe way for its staff to do the right thing.

The process for raising security-related concerns should be intuitive and easy for all members of the organisation to reach. However, it must also be controlled to avoid it becoming an open forum where any issue can be raised, which is not an effective way to operate.

Continuous assessment

Appropriate “check points” within project delivery and operations ensure that the security ethos is being applied consistently. Rather than being a one-off, onerous, upfront assessment that is not referred to again, this should be a continuous, but evolving, interaction that is appropriate and acts as a reminder to tease out information when it is relevant and available.

For example, a security assessment conducted at the beginning of a project, when the design may not be fully mature, will probably need to make some assumptions on processes, technology or data requirements that are inaccurate, resulting in the project being considered either too high- or too low-risk from a security governance perspective.

Without further check points during the delivery of the project, this assumption would remain throughout its life, leading either to material weaknesses in the security design being missed or identified too late in the delivery cycle or, conversely, resulting in further controls – with a significant overhead – that, in reality, are not required because the assumed security risks are not appropriate or relevant.

Upfront impact assessments and checklists of this nature are often perceived as tick-box exercises – a mandatory means to an end to “get through” a project stage gate with the minimum number of questions answered and the fewest review questions asked.

Bridging the gap between “security” and “operations” to focus on the intentions, risks and potential controls required, demands a more supportive and collaborative approach that also seeks to understand the overall objective of the assessment.

On the operational side, education about, and communication of, the intentions of the assessment will encourage alignment, while greater empathy and engagement from the security side will allow them to operate in a manner that more easily reflects the business objectives and transforms the tick-box from an overhead to a business enabler.