How To Optimize Your Security Budget

In today’s DailyCyber Podcast I discuss two topics I keep hearing more about through my conversations with colleagues and through Cyber Security news:

CISO Dialogue: How to Optimize Your Security Budget

"There are many different approaches to managing a security budget, and CISOs organize and prioritize uniquely based on the company, industry, and threats. Three consistent areas of spending are identity and access management (IAM), global risk and compliance (GRC), and security operations,” Brett Wahlin CISO of Amazon Prime Video noting:

* IAM is always a mess because no one wants to deal with access management, passwords, access sprawl, and so on.  

* GRC is difficult because there are always new regulations to remain compliant with; privacy, in particular, is an ongoing challenge.

* With security operations, levels of effectiveness vary. Wahlin posed several questions for consideration. "Is it in-house? Are you outsourcing to an MSSP? How are you measuring effectiveness? It's an area where I often have to retool from a people, process, and technology standpoint."

Top Tips for New CISOs

Brett Wahlin concluded with a breakdown of the most important things he would recommend a new CISO look at, both budgetary and beyond:

* Look at the three most problematic areas: IAM, GRC, and SecOps. You can always find things to fix, and it will give you some quick wins.

* Know your industry and how your security program can help the company grow.

* You need to be able to constantly communicate the value you're bringing to the table — it's how you'll get budget and, more importantly, it's how you keep it.

* "Partnering with the business" is not just a catch phrase batted around at security conferences. Learn what it means for your company and be a good partner.

* Think like an architect: As you build a program, how do the different functions interact with each other? How do you plan to grow based on shared communication?

* Don't be afraid to pull something out if it's not raising the security bar for your company.  

https://www.darkreading.com/operations/ciso-dialogue-how-to-optimize-your-security-budget-/a/d-id/1338055

76.36% Believe Cloud Service Provider is Responsible for Security: CISO MAG Market Trends Report

From CISO Mag’s Cloud Security survey then found

76.36% said that cloud service providers (CSP) is entirely responsible for the security of the cloud

23.64% they said 40% in the article - stated the responsibility is on the cloud consumer  

Looking at these numbers you can tell that the “Shared Responsibility” as Amazon refers to it. Is not truly understood just by this survey alone.  

AWS defined a Shared Responsibility model that says “Security of the Cloud” is the responsibility of the CSP (Cloud Security Provider), but “Security in the cloud” is the responsibility of the customer. This model is gradually being accepted in the industry.

https://www.cisomag.com/shared-responsibility-model/

To learn more watch the video or listen to the podcast at www.DailyCyber.ca and comment below