{"version":1,"type":"rich","provider_name":"Libsyn","provider_url":"https:\/\/www.libsyn.com","height":90,"width":600,"title":"Episode 200 - Building a Security Strategy - Part III","description":"Episode 200 - Building A Security Strategy - Part III Recap Strategy vs Policy Understand the business of your Business Know who your stakeholders really are Capability = (Tech + Service) * Process Crawl, Walk, Run It Takes A Village The Question is \u201cHow do I make one?\u201d Tech Tech, by itself, only consumes electricity and turns cool air into warm air So many choices\u2026. The tech selection is the *least* critical one for developing a capability http:\/\/www.southernfriedsecurity.com\/episode-192-security-waste\/ This is the \u201cStuff You Have To Do\u201d Usually determined by regulation, policy, or corporate edict Describes a desired outcome - not how to get there Examples include \u201cMalware Detection\u201d, \u201cEmail Security\u201d Service How you do the crazy things you do Security is not a One-Off - things must be repeatable and consistent Process Describes value team brings to org While tech and service selection is important the biggest improvement usually comes from better process Capability Capability = (Tech + Service) * Process Armorguy\u2019s Maxim of Life: \u201cStart small and iterate larger\u201d Try to do to much out of the gate and you WILL fail Define success criteria for each stage that allows for error and learning Crawl, Walk, Run Security cannot exist as an island Interdependence with business units is key - if you don\u2019t you are the foreigner and will be rejected The relationship with IT Operations is going to be wonky at first It Takes A Village Where do you look for more info? Strategy - It\u2019s What CISOs Do\u2026 ","author_name":"The Southern Fried Security Podcast","author_url":"http:\/\/www.southernfriedsecurity.com","html":"