A modern security organisation
Nov 25th, 2021 by Jesper Kråkhede
A last business post for the year, and it ties together the two previous ones.
Many security organisations are built on old competence areas. Network security, server security, application security, compliance. Each with its own manager, budget and priorities. It made sense when the threats followed the same lines. They don´t anymore.
Look at the big events this year. Ransomware that moves from a laptop to the domain controllers in hours. Attacks through service providers. And now Log4j, a vulnerability that can be anywhere in your environment at once. None of them fits in one box.
A modern security organisation is built around the whole. A security architecture function that owns the big picture. A detection and response function that sees and acts across all layers. Identity at the centre, because that is where every attack eventually goes. And a governance function that connects the risks to the business and handles compliance, as a result of good security rather than a goal of its own.
It also needs the mandate to cut across the IT organisation. Security that has to ask five different teams for permission will always be too slow.
For management this is not just a reorganisation. It is deciding that security is something you manage as a whole.
The attackers think in systems. So should you.