1 rich Libsyn https://www.libsyn.com 90 600 Episode 200 - Building A Security Strategy - Part III Recap Strategy vs Policy Understand the business of your Business Know who your stakeholders really are Capability = (Tech + Service) * Process Crawl, Walk, Run It Takes A Village The Question is “How do I make one?” Tech Tech, by itself, only consumes electricity and turns cool air into warm air So many choices…. The tech selection is the *least* critical one for developing a capability http://www.southernfriedsecurity.com/episode-192-security-waste/ This is the “Stuff You Have To Do” Usually determined by regulation, policy, or corporate edict Describes a desired outcome - not how to get there Examples include “Malware Detection”, “Email Security” Service How you do the crazy things you do Security is not a One-Off - things must be repeatable and consistent Process Describes value team brings to org While tech and service selection is important the biggest improvement usually comes from better process Capability Capability = (Tech + Service) * Process Armorguy’s Maxim of Life: “Start small and iterate larger” Try to do to much out of the gate and you WILL fail Define success criteria for each stage that allows for error and learning Crawl, Walk, Run Security cannot exist as an island Interdependence with business units is key - if you don’t you are the foreigner and will be rejected The relationship with IT Operations is going to be wonky at first It Takes A Village Where do you look for more info? Strategy - It’s What CISOs Do… The Southern Fried Security Podcast http://www.southernfriedsecurity.com <iframe title="Libsyn Player" style="border: none" src="//html5-player.libsyn.com/embed/episode/id/5734607/height/90/theme/custom/thumbnail/yes/direction/forward/render-playlist/no/custom-color/88AA3C/" height="90" width="600" scrolling="no" allowfullscreen webkitallowfullscreen mozallowfullscreen oallowfullscreen msallowfullscreen></iframe> https://assets.libsyn.com/secure/item/5734607