{"id":9412,"date":"2020-08-24T10:31:54","date_gmt":"2020-08-24T10:31:54","guid":{"rendered":"https:\/\/www.experfy.com\/blog\/?p=9412"},"modified":"2023-11-17T07:06:55","modified_gmt":"2023-11-17T07:06:55","slug":"good-security-governance-is-not-a-piece-of-useless-consultant-jargon","status":"publish","type":"post","link":"https:\/\/www.experfy.com\/blog\/bigdata-cloud\/good-security-governance-is-not-a-piece-of-useless-consultant-jargon\/","title":{"rendered":"\u201cGood Security Governance\u201d is not a Piece of Useless Consultant Jargon"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

\n

It is an essential protective layer for any organisation.<\/h2>\n<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Irrespective of what many of us may say or write, the cyber security agenda remains dominated by products and technology.<\/p>\n\n\n\n

Of course, the problem has a technical dimension and the protection of any firm against cyber threats will require the application of technical countermeasures at a number of levels.<\/p>\n\n\n\n

But there are countless tech vendors and service providers out there trying to sell their products as the\u00a0silver bullet<\/a>\u00a0which will protect you from anything. And countless small firms still holding simplistic views on cyber threats: \u201cWe\u2019re fine; all our data is in the cloud\u201d<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\n

For any organisation above a certain size, effective and efficient protection can only result from the layered application of protective measures at people, process and technology level. And in that order.<\/p>\n\n\n\n

It has to start with people. And that doesn\u2019t mean rolling out a security\u00a0awareness<\/a>\u00a0programme. Middle management has always had the tendency to jump straight into the solution space at the back of a simplistic analysis of the problem, but at the heart of the \u201cpeople\u201d aspects of any security strategy, lay issues of corporate culture and corporate governance.<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\n

\u201cGood security governance\u201d is not a piece of useless consultant jargon. It is an essential protective layer for any organisation.<\/p>\n\n\n\n

It ensures a visible endorsement of security values from the top down, brings clarity around security roles, responsibilities and accountabilities across the whole organisation, and more importantly, it is the cornerstone that \u201cget things done\u201d around security through an effective and efficient layer of reporting.<\/p>\n\n\n\n

Only the actual execution of security measures (i.e. the actual deployment of security processes and the technology required to support them) will protect the business. And that\u2019s where many organisations \u2013 larger and smaller \u2013 have failed over the past decades in spite of colossal investments in cyber security: Security projects get deprioritised half way through or focus only on non-existent low hanging fruits; over time, people get demotivated and leave, nothing gets finished and half-baked \u201csolutions\u201d\u00a0proliferate<\/a>: According to a recent\u00a0survey<\/a>\u00a0by Cisco, the average organisation now uses 20 different security technologies.<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\n

Let\u2019s get this straight: This is plain governance failure and it has been plaguing organisations \u2013 large and small \u2013 around security for the best part of the last two decades.<\/p>\n\n\n\n

To avoid those mistakes, break that\u00a0spiral<\/a>, and target the management and governance roadblocks which have prevented progress in the past, most organisations need to act at three levels:<\/p>\n\n\n\n

First,\u00a0get a good understanding of your security maturity posture<\/strong>\u00a0to start with and set realistic timeframes around change. Change takes \u201cthe time it takes\u201d and there may be no quick wins.<\/p>\n\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Then,\u00a0be objective about the skills and resources you have to deliver change<\/strong>\u00a0and set realistic improvement goals. Jumping straight at ineffective \u201cvirtual CISO<\/a>\u201d solutions in the hope of making the problem disappear will not help if nobody is there to execute.<\/p>\n\n\n\n

Finally,\u00a0stay focused<\/strong>. Security transformation often involves a change in mindset which needs stability to develop and takes time to set in. Changing directions or priorities every time something happens in the business or elsewhere will simply kill any transformational momentum around security.<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

\u201cGood security governance\u201d \ud83d\udd12 is not a piece of useless consultant jargon. It is an essential protective layer for any organisation. It ensures a visible endorsement of security values from the top down, brings clarity around security roles, responsibilities and accountabilities across the whole organisation. <\/p>\n","protected":false},"author":529,"featured_media":9413,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[187],"tags":[570,350,430],"ppma_author":[3178],"class_list":["post-9412","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-bigdata-cloud","tag-governance","tag-security","tag-strategies"],"authors":[{"term_id":3178,"user_id":529,"is_guest":0,"slug":"jean-christophe-gaillard","display_name":"Jean-Christophe Gaillard","avatar_url":"https:\/\/www.experfy.com\/blog\/wp-content\/uploads\/2020\/04\/medium_b55e5afa-fb86-428a-a054-3be0451df2a4-150x150.jpg","user_url":"https:\/\/www.corixpartners.com","last_name":"Gaillard","first_name":"Jean-Christophe","job_title":"","description":"Jean-Christophe Gaillard\u00a0is Managing Director and Founder at Corix Partners. He is also a Non-Executive Director with\u00a0Strata Security Solutions<\/a>, a specialized cybersecurity firm. He has been co-president of the Cyber Security group of the\u00a0Telecom Paris Tech alumni association<\/a>\u00a0since May 2016. He is the author of \u201cCyber Security: The Lost Decade<\/a>\u00a0\u2013 A Security Governance Handbook for the CISO and the CIO\u201d, He contributes regularly to\u00a0The Digital Transformation People<\/a>,\u00a0Business 2 Community<\/a>, and\u00a0IoTforAll<\/a>\u00a0platforms, as well as the\u00a0Business Transformation Network<\/a>. He is an expert contributor on the\u00a0CIO Water Cooler<\/a>\u00a0and has previously published articles on\u00a0InfoSecurity<\/a>\u00a0Magazine, \u00a0Computing<\/a>, the C-Suite.co.uk,\u00a0Info Sec Buzz<\/a>\u00a0and the\u00a0IoD Director<\/a>\u00a0websites."}],"_links":{"self":[{"href":"https:\/\/www.experfy.com\/blog\/wp-json\/wp\/v2\/posts\/9412","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.experfy.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.experfy.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.experfy.com\/blog\/wp-json\/wp\/v2\/users\/529"}],"replies":[{"embeddable":true,"href":"https:\/\/www.experfy.com\/blog\/wp-json\/wp\/v2\/comments?post=9412"}],"version-history":[{"count":4,"href":"https:\/\/www.experfy.com\/blog\/wp-json\/wp\/v2\/posts\/9412\/revisions"}],"predecessor-version":[{"id":34126,"href":"https:\/\/www.experfy.com\/blog\/wp-json\/wp\/v2\/posts\/9412\/revisions\/34126"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.experfy.com\/blog\/wp-json\/wp\/v2\/media\/9413"}],"wp:attachment":[{"href":"https:\/\/www.experfy.com\/blog\/wp-json\/wp\/v2\/media?parent=9412"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.experfy.com\/blog\/wp-json\/wp\/v2\/categories?post=9412"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.experfy.com\/blog\/wp-json\/wp\/v2\/tags?post=9412"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.experfy.com\/blog\/wp-json\/wp\/v2\/ppma_author?post=9412"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}