Building a cyber security strategy

Mo Ahddoud, CEO, Chameleon Cyber Consultants

---

Formalising a cyber security strategy is an essential step in defending against threats and protecting an organisation’s assets. Threat actors, attack vectors and IT system complexity are changing quickly, and organisations that don’t adapt will be implicitly accepting higher risk of a breach.

 

Regardless of the size of the organisation, a good security programme must be proactive about closing security gaps because ignorance is never blissful. The full extent of damage from an attack can extend past the loss of data and finances. Reputational damage as a vulnerable entity can cost organisations critical relationships they depend on to survive.

 

Organisations that use a systematic and proactive approach to cyber security not only create an effective security strategy and improve stakeholder satisfaction, but they also see other benefits:

 

1. Addresses the nature of cyber security. Numerous projects and components are involved in a security programme, including IT requirements and functions as well as countless other elements to consider. A structured approach creates a detailed plan and allows teams to focus on high-value security projects first while moving toward a target state.

 

2. Highlights functions that were previously overlooked. A systematic approach lays a foundation across all areas of cyber security upon which a complete programme can be built. Instead of pursuing new projects in an ad hoc nature, using a systematic methodology builds a comprehensive security programme today and enables the ongoing management of inevitable changes to the initial programme of work.

 

3. Justifies IT budget changes. Following a systematic investigation of all security functions and understanding of programme gaps, businesses can effectively estimate their necessary security budget or shine a light on areas where intolerable risks will persist without budgetary relief.

 

Assess security requirements

 

Identifying corporate goals is the first step in aligning the cyber security strategy with the business vision, so security leaders need to understand the direction the business is headed in.

 

Cyber security must support the primary business objectives. A strong cyber security programme will enable the business to compete in new and creative ways, support operational performance and ensure brand protection and shareholder value. Failure to meet business obligations can result in operational problems, impacting the organisation’s ability to function and the bottom line. Wise security investments also depend on aligning security initiatives to business objectives.

 

Gaining this understanding with non-security staff and senior stakeholders is the best way to start security socialisation and get an understanding of what their concerns are. We recommend taking the following steps:

• Introduce security management.
• Understand business and IT strategy and plans.
• Define business, compliance and customer security obligations.
• Define the organisational risk tolerance level.

Perform a gap analysis

 

Understanding the current state vulnerabilities enables both security teams and business leaders to gain clarity on the current state vs target state, a high-level understanding of the gaps between states and an understanding of common initiatives for each area of security.

 

The cyber security strategy should identify what you don’t need, as well as what you do need, to provide the most value to the organisation. We recommend taking the following steps: 

• Assess current security capabilities.
• Identify security gaps.
• Build initiatives to bridge the gaps.

Prioritise initiatives and build a roadmap

 

A good security programme won’t provide perfect security, but it will enable organisations to make educated decisions about which projects are most important and why. It provides cost-to-effort alignment for security initiatives as well as identifying easy-win tasks and high-value projects that will close the current or target state gap. It also supports decision-making on whether to begin initiatives based on resourcing and alignment. We recommend taking the following steps:

 

• Consolidate gap initiatives.
• Estimate and prioritise your initiatives.
• Build your roadmap.

The roadmap is the list of tactical efforts – it is not the strategy itself. The strategic elements are ensuring targets are aligned with what the business wants and needs and that it is being executed not by a dogmatic framework but in the order that will best benefit the organisation’s unique circumstances.

 

Benefits of a good strategy

 

Today, most customers or clients expect some level of security to protect their data. For many organisations, customer data privacy is arguably the largest driving factor for developing a mature cyber security programme. However, leaping from pre-foundation to being completely optimised in one step is an ineffective goal. Systematic improvements to your security performance deliver value to the organisation every step of the way.

 

Including stakeholder and executive input from the outset will also help to ensure that the strategy is aligned with business needs and fosters a relationship in which cyber security is seen as an enabler rather than a cost centre.

 

The benefits of a cyber security strategy are:

• An understanding of current security practice capabilities and performance.
• An understanding ofthe organisation’s security obligations and responsibilities.
• Establishes a security target state based on the organisational context.
• Develops a roadmap to help the business achieve its desired security target state.
• An understanding of which elements of a good cyber security strategy CEOs and other business leaders should be involved in.
• Determines at a high level the organisation’s current risk tolerance.

At Chameleon Cyber Consultants, we pride ourselves on facilitating business success through secure environments. Our mission is to use the very latest security thinking, practices and technology tailored to your specific business needs and objectives.

---

If you would like support creating a cyber security strategy tailored to your business, visit chameleoncyberconsultants.com