August 2022ENTERPRISE SECURITY| | 9organizations in different industries begin implementing new concepts, you may observe parts of the concept become a new standard while some become optional. As an example, XDR capabilities may not necessarily be a framework requirement today, but the elements comprising XDR may be, such as Endpoint Detection and Response (EDR). In no way, however, am I suggesting you should not evaluate or implement new products and technologies until they become part of a particular framework. In fact, you may find they you need to leverage them to immediately address specific concerns in your security technology landscape. However, I recommend caution when implementing an overabundance of innovative technologies that have not been vetted successfully across multiple industries or simply may not be required to achieve a desired state of security. It is with this in mind that frameworks and models can help security leaders develop an organized, strategic approach for implementing capabilities and leverage a risk-based mindset for prioritization and determination of need. Frameworks can be slow to include newer technologies and approaches, especially to a level that allows an organization to keep pace with emerging threats. This is where it becomes imperative for each organization to evaluate which method they choose to follow, and the scope with which they choose to implement it. But the advantage of a risk-based approach is you do not have to implement every capability to the highest level. While it may be desirable, it is not always achievable. Using a risk-based mentality allows us as security leaders to implement capabilities in support of organizational priorities that align with the risk appetite. As frameworks and models continue to evolve and incorporate new capabilities, they can provide a viable method to help organizations prioritize and focus their security efforts. These enable leaders to leverage an organized, risk-based approach to achieve the desired level of maturity for the security program while meeting regulatory requirements for their specific industry. But security leaders should always maintain a watchful eye on the technology landscape and understand how those technologies can specifically address new threats or gaps in their program. If the new capability or technology solves an immediate problem, then the leaders, based on their organization's risk appetite, can prioritize without waiting for the various frameworks and models to catch up. ESAS FRAMEWORKS AND MODELS CONTINUE TO EVOLVE AND INCORPORATE NEW CAPABILITIES, THEY CAN PROVIDE A VIABLE METHOD TO HELP ORGANIZATIONS PRIORITIZE AND FOCUS THEIR SECURITY EFFORTS
< Page 8 | Page 10 >