The Art of Doing Less: Maximizing Value in Times of Scarcity

The RSA Conference: Does it Lead to Better Risk Management?

The RSA Conference is a large event that provides a platform for cybersecurity vendors to showcase their products and services. However, with millions of dollars spent on the show floor, the question arises whether it actually leads to better risk management or risk reduction. In this article, we will examine ways to help cybersecurity teams provide functional value to their organizations, instead of focusing on unnecessary expenses.

Defense-in-Depth, Not Expense-in-Depth

The traditional approach to cybersecurity involves installing multiple security products and continuously adding more without considering the necessity of each product. However, rather than adding more, a better approach would be to remove unnecessary tools and optimize processes. It is important to assess whether certain security solutions are still relevant with the move to the cloud or whether they are specific to legacy applications.

While deciding to remove a security tool, it is important to maintain defense-in-depth, not expense-in-depth. This means that fewer things should be done at an extremely high level of quality and assurance, instead of scattering security expenses thinly.

Confidence in Defense Strategies

If you notice something unexpected in your security program, could you determine whether the tooling, data, or intelligence is off? The key to validating defense strategies is through regular testing, like red-teaming, and performing validation tests. Having the ability to detect “instrumentation failure” and other security threats quickly can be crucial to prevent future cyber attacks.

Consequently, an organization must measure and test the efficiency and efficacy of its security tools to build confidence in its defense strategies. The goal should be to do less with less, but maintain a high-quality defense mechanism.

Conduct a Business Value Assessment

The value of security tools is often difficult to quantify. Therefore, conducting a business value assessment can help rank all the “things” and determine what requires the most attention. This includes finding out how much they can harden the environment, how important their protection is, and the rate of detection and response acceleration. Additionally, look for tools that develop default ways of being more secure without requiring a change of workflow. Once the assessment is complete, narrow the focus to what is essential.

Make the Business Care

The security of an organization’s data and applications is not solely the responsibility of its cybersecurity team. It should be a shared responsibility with business units that develop and use security tools. Force the business to care about security by involving them in the decision-making process. Another step includes regularly asking C-suite members what they consider to be the company’s biggest cyber risks, as well as what they regard as the crown jewels. It is important to align resources and commitments to focus on less but achieve a larger impact.

Cybersecurity as a Driver of Value

To operate with the highest ROI, one must regularly review the status of security tools and assess how they are working for the organization. Instead of viewing money spent on security as an indicator of its strength, organizations must use their security budget to promote sustained growth by investing in solutions and processes that suit their needs. A collaborative approach to allocating resources can lead to better outcomes.

Final Thoughts

In conclusion, doing less with less does not mean compromising security. Rather than scatter security expenses thinly across many products, it is important to streamline processes, perform regular assessments, and collaborate with other business units to assign roles and responsibilities. By using cybersecurity as a driver of value, organizations can build confidence and maintain a high-quality defense strategy.