When starting from the business, we first have to identify, map, and categorize the risks of the specific business. Second, we have to determine, together with the business itself, which risks need to be dealt with and in which order.<\/p>\n
When that\u2019s done, the person responsible for the security within the company has to set up a security plan that describes how these changes are to be executed. In doing so, there have to be clear goals and deadlines. Ideally, this should be done in a \u2018smart\u2019 way, one step at a time, so as not to engage in too many projects at once.<\/p>\n
Lesson 2: Determine a security roadmap with a clear goal, step by step<\/b><\/h2>\n
Defining your security approach (or security roadmap) is essential and should be discussed with your business on an ongoing basis to make adjustments where and when necessary. During the creation and execution of the roadmap, the projects that are defined will all contribute to the reduction of risks and the achievement of the end goal.<\/p>\n
It\u2019s important to not lose sight of the business goals, because the people responsible for security shouldn\u2019t \u2018restrict or obstruct\u2019 the business with security measures. It\u2019s not rocket science, and shouldn\u2019t be treated like it is. The creation of a plan should be something that everyone, even without IT skills, can understand. Of course, IT plays a role, but only at the last moment when IT solutions are needed for the execution of the security projects.<\/p>\n
Lesson 3: Cover the basics before implementing more advanced security solutions<\/b><\/h2>\n
![\"](\"http:\/\/www.welivesecurity.com\/wp-content\/uploads\/2017\/01\/shutterstock_240564724-1.jpg\")
<\/p>\n
Looking back at the conferences we attended, we noticed that most organizations don\u2019t even have basic security measures in place, let alone advanced security solutions. Security company presentations on these technologies often look stunning and offer interesting content, but they are simply too advanced for most companies. Furthermore, experience shows that the most hacks (about 90%) are still using the simplest methods and weaknesses: phishing emails, malware attachments, etc. And, of course, there is the weakest link of all: the human being.<\/p>\n
Companies need to create basic security solutions for these simple risks first before they turn their attention to more advanced technologies. Of course, these are important as well and they should be implemented in the future, but only after the basics are fortified. Often during security conferences there is a focus on sophisticated threats and APTs (advanced persistent threats), but companies such as TalkTalk<\/a> and Ashley Madison<\/a> might have been protected from attack if even basic security was in place.<\/p>\n New developments arise quickly and malicious groups and individuals are using more varied and advanced attacks and tactics. Eventually, more advanced security solutions will become inseparable from our organizations\u2019 broader security roadmaps. However, the foundation has to be in place before the \u2018house\u2019 can be built. And to build this house, cooperation is needed between the architect, the realtor, the mason, the plasterer and of course the homeowner.<\/p>\n This sense of building something together is exactly what needs to happen in the security world. We have to cooperate intensively because, much like building a house, there is no single owner or architect who is also the best in masonry, painting, or construction.<\/p>\n No single security company has the best solution for each and every security risk, so working together is a must. Those who would cause your company harm are already doing this, so it\u2019s time security professionals do the same. We need to start with the owner (the business) and the foundation (the roadmap), and then forge relationships with the right contractors (security vendors). Only then can a strong, reliable, and safe house be built.<\/p>\nLesson 4: Build the right partnerships \u2013 cooperation between IT Security professionals is essential <\/b><\/h2>\n
![\"Business](\"http:\/\/www.welivesecurity.com\/wp-content\/uploads\/2017\/01\/shutterstock_424790479-1.jpg\")
<\/p>\n