In the not-so-distant past the prevailing concept for corporate cybersecurity was the application of the principle of least privilege, construction and maintenance of network firewall solutions, and stringent mail security. Cybersecurity has evolved as elevation of privilege and lateral attacks became common and it became obvious that networks were not the boundary they once were. Email became just one more SaaS service which must be secured. The common routine now is that bad people see opportunities to make money or do mischief which drives them to think of new ways to compromise environments. Malicious compromise is a profitable industry with constant innovation. This has resulted in a repeating cycle of new cybersecurity risks coming on the scene, security products and improvements needing to be identified and created, companies applying threat mitigations. In essence, innovation by bad people drives reactive security innovation by software companies and cybersecurity organizations. At this point, this cycle is generally understood by most as a fundamental truth of the state of security and the cloud.
Malicious compromise is a profitable industry with constant innovation.
While the cycle is understood by many there is a lot of work still needed to improve overall postures of organizations. The availability of security suites and tools are integral to that improvement, but security tools are only handy if the organization knows they need them, have people who can use them, and have processes in place to ensure they are used. In other words, security tools are only useful if the organization has the maturity to ensure cybersecurity is important. Assessing cybersecurity maturity is important whether you are gauging your environment, preparing your organization to do better, or considering a new group to work with.
I characterize cybersecurity maturity into three stages (or postures) an organization can be in. The security stages are Beginning, Forming, and Established. Let’s go over some characteristics of those stages in the lists below.
Beginning
- This stage benefits most from pervasive trends in new technology and security initiatives, and typically involves a lot of discovery effort to see the state of the environment.
- No established processes for identifying flaws/weaknesses in org and patching them to reduce likelihood of events.
- No established processes, plans, or dedicated owners for incident handling if an incident were to occur.
- Nonexistent to minimal planning for post-incident recovery to get the business back on its feet.
- Small or no dedicated team devoted to security preparedness and operations.
- No security specific tooling to alert the organization of potential problems.
- Potentially unaware of compliance obligations related to security and preparedness.
- Not meeting compliance obligations for data security and business continuity.
- Security controls and recoverability is put into place reactively during or immediately following an event or events (i.e. add MFA following an event)
Forming
- This stage is characterized by team building, product selection and use, and new initiatives to add security functionality and more secure service hygiene.
- Building/establishing processes to mitigate risks.
- Identified people and teams who are accountable for security preparedness.
- Dedicated people who are accountable to respond to incidents.
- Security teams typically formed from admins who are familiar with authentication and authorization technologies, application behavior, or IT operations.
- Endpoint (host, network endpoint) detections in use or beginning to be used.
- BYOD control in progress or established.
- In discovery mode to determine organization and/or industry specific compliance needs.
- Inventory efforts for line business resources and services (applications, data, automation) underway.
- Prioritization and documentation of business-critical configurations and services underway.
- Deployments of privileged identity and access management solutions started.
- Reactive end user training on security “does” and “donts”.
- Multi- factor authentication requirements are defined, and deployments are underway.
- SIEM use and analysis is routine.
- Beginning use of privileged access management and privileged identity management.
Established
- Established organizations are continually working to maintain and enhance the security of the business with dedicated experts, tools, and strategies.
- Security preparedness and incident response have established processes.
- Business interrupting events have established plans and action owners.
- Established code repositories and pipelines for security settings and resource configurations.
- Risk mitigation planning
- Deep understanding of the organizational compliance needs.
- Compliance needs met or plans on how to meet them underway.
- Uses advanced security aggregators for monitoring and risk mitigation. Microsoft Defender for Cloud, for example.
- Identity sourcing is cloud driven, and applications have standard security criteria they must adhere to.
- Governance reviews and automation for compliance.
- Routine privileged access management and privileged identity management.
- Established privileged access management processes and tooling where needed.
- End user training campaigns to continually bolster security by education and testing.
Organizations in the Beginning stages are those which are most likely to experience a sudden and profound revelation on the need for better security. The cause of the revelation often being the result of an audit which didn’t go well, something malicious which interrupts business services, or perhaps a security breach. As of the time of this writing, this stage is typically comprised of small to medium sized businesses (1000 or less seats) as the result of many larger organizations getting wise to the problems already.
In the Forming stages, there are plans or the beginnings of plans on what it will take to establish sufficient visibility and control. There is an awareness and investment into security at executive levels, albeit the investments are newer. In this stage, things will begin mobilizing to make the business secure and, while it is possible that an event could still occur, if an event occurs the organization has dedicated responders who and tools to deal with it. Most enterprise organizations are at least in the Forming stage at this point-in many cases after unfortunate event(s) to prod things along.
Those who are in an Established stage still have risks related to business interruptions and compromise. This is the stage all should be striving to achieve. Having reached the Established stage doesn’t mean the work is done, instead it means that breaches or business interruptions are likely to occur, and if they do occur the blast radius will be reduced and recovery fast.
It should be expected to see the organization mature faster in some areas and slower in others. However, if things are going well there will be a linear progression toward greater maturity and thus greater security and resilience. There is not a defined path to cybersecurity maturity, nor is there a clear indicator when an organization is mature. These are things which are subjective and must be assessed by the organization and against the business priorities.
Since there is not a defined path it should be expected that it will take time and effort to gain security maturity in an organization. It won’t happen overnight. Think of it as steering a cruise ship-turns are wide and slow and take time. And, to push the analogy further, you have to have the right crew to have the ship do what you want.
What is the cybersecurity maturity of your organization? A better question is, where do you need to invest to get security where you need it to be?
The Road to Take 