| | DECEMBER 2023ENTERPRISE SECURITY8IN MY OPINIONIN MY OPINIONWHAT IT TRULY MEANS FOR IT SECURITY TO BE A BUSINESS ENABLERWe all know the cliché, "IT security teams always say no!" but what does it mean for security to be a business enabler? The answer is to be proactive. This means being on the front foot, having all the controls in place to manage innovation risks and freeing up the business to explore its goals. Understanding and managing innovation risks are extremely important but often given little attention by reactive Information Security teams until they are called to respond to an incident. A common industry example of innovation risk is taking shortcuts in the cloud due to time pressures or knowledge gaps, leading to cloud misconfigurations and exposure of sensitive data.Let me demonstrate by sharing some examples of proactive security in my current organisation, a UK insurer going through a digital transformation.DRIVING BEHAVIOUR WITH NEAR REAL-TIME KRI DASHBOARDSNot every vulnerability or misconfiguration is the same. Some carry more risk than others and simply looking at the vulnerability or misconfiguration severity provided by your scanner to prioritise work will completely overburden your development teams. Apply your own logic on top of scores from your vulnerability tools by considering if the asset is in a production environment, reachable from the internet, exploitable or will become exploitable (EPSS), processes sensitive data or is mission critical. Have visual dashboards to measure your KRIs at Exec, Tribe and Squad levels with different buckets for your SLAs. For example, a severity 1 bucket for production vulnerabilities or misconfigurations severe enough to be fixed within 24 hours. A severity 2 bucket for 7 days, and so on. There is nothing like a KRI dashboard to drive behaviour, particularly if this is visible to the risk committee!REDUCING USER FRICTION- Imposing a significant burden on the end-user experience to maintain security will soon force end-users to bypass controls and result in complaints. A simple example is password expiry. Many systems will force users to change their password at regular intervals, typically every 30, 60 By Richard Frost, Chief Information Security Officer, esure Group
< Page 7 | Page 9 >