originally featured on CSO Online
August 23rd, 2017
Ed Snodgrass, CISO
Maturity is an interesting word. We’ve heard it throughout our lives and it’s had different meanings in different contexts. As a child, we heard it from our parents regarding “growing up” or “being more mature”. We may not have entirely understood it then, but our parents knew that developing maturity would be important for friends, colleagues and peers to take us seriously.
As we grew older, we began to understand the concept of maturity and that it could be compared closely to wisdom. We began using what we learned through experience and started applying that knowledge to our decision-making process.
Today we hear the word maturity frequently in the workplace. We see it used in processes, methodologies, rating scales, etc., and from a technology and process standpoint, maturity can be applied to cybersecurity as well, although its applicability and benefit isn’t always readily apparent.
Case in point. Recently, over lunch, I was attempting to explain the purpose and benefit of cybersecurity maturity to a business colleague. Based on his skeptical expression, it was clear to me that I wasn’t succeeding. He fully understood compliance and the implications of non-compliance, but wasn’t grasping the value of maturity and how it was relevant in the security space.
I thought about what was personally important for me to secure, and the answer was easy – my family. I then thought about an area where compliance comes into play and how it is typically used to determine effectiveness – home fire safety. Using that as an example, I asked him to rate his family’s level of home fire safety on a scale of 1-5. “4-5,” was his response. “I have the best smoke alarms money can buy. I have one on each floor and in each bedroom, as I’m required to by code. In addition, I have a fire extinguisher in the house and one in the garage.”
From a compliance standpoint, we both agreed that his score of 4-5 was likely accurate, and one could say that he had gone above and beyond the minimum standard. I then challenged him to look at it from a maturity perspective, using a series of ad-hoc questions as a baseline:
- Do you test your smoke alarms?
- Do you have a regular schedule for replacing the batteries or do you replace them only when the alarm tells you to?
- Do you have a family communication and logistics plan that you can put into action if an alarm sounds in the middle of the night?
- Do you practice the plan?
- Does everyone in your family know where the fire extinguishers are?
- Does everyone in your family know how to use the fire extinguishers?
- Is there a pre-determined family assembly area outside?
As he considered each question, I then asked, now that he’d added a maturity measurement to compliance, what would he rate his family’s level of fire safety? “Probably a 1-2,” was his concerned reply.
While this may be a simple example, it begs a question. Traditional compliance and operational data is important, but does it provide adequate context to truly evaluate capability? Using the fire safety example above, it doesn’t appear to. My colleague had all the required detection mechanisms in place, including some additional preventative measures, but any significant capability for his family to respond effectively to a fire simply wasn’t there.
The same question can be asked of a cybersecurity organization, and a growing number of security leaders are adopting maturity as a metric to analyze and determine their team’s strategic capabilities because the hundreds of individual controls, while critical, only represent a point in time.
Cybersecurity maturity, used as a performance metric, offers additional insight into how the security organization is operating. It can be used to analyze compliance and operational data at the process or function level. Trends can be discovered, monitored and adjusted for. An enterprise security training program may have all the right features in place, for instance, but the open rate of phishing emails by employees isn’t decreasing over time. Do the components of the training program need to be adjusted or does the content? Or, does the challenge lie within another function or process outside of the training program? The use of maturity to analyze the capabilities of those processes can likely answer those questions.
In today’s evolving threat landscape, effective metrics are critical to security success. Controls and operational data are required to run the organization today. Strategic KPIs, such as maturity, are also required to measure, profile and plan the security organization’s capabilities for both today and tomorrow. Performing a cybersecurity maturity assessment on the security organization will likely yield valuable insights. There are excellent sources available that show where to begin and how to demonstrate the value of measuring cybersecurity capabilities and effectiveness. (An example can be found here).
Ultimately, the best smoke alarms money can buy are powerful tools in the event of a fire, but only if everyone has the capability and maturity to respond effectively.
Interested in learning more about security program performance and leveraging the value of cybersecurity maturity? Download the white paper titled “Roadmap to Success“.