{"id":1973,"date":"2013-09-19T20:13:51","date_gmt":"2013-09-19T12:13:51","guid":{"rendered":"http:\/\/www.upgrademag.com\/web\/?p=1973"},"modified":"2013-09-23T14:00:52","modified_gmt":"2013-09-23T06:00:52","slug":"rsa-report-reveals-composition-of-forward-leaning-security-program","status":"publish","type":"post","link":"http:\/\/www.upgrademag.com\/web\/2013\/09\/19\/rsa-report-reveals-composition-of-forward-leaning-security-program\/","title":{"rendered":"RSA report reveals composition of forward leaning security program"},"content":{"rendered":"

A new research report released by RSA, The Security Division of EMC, from the Security for Business Innovation Council reveals the composition of a forward leaning security program \u2013 starting with building a next-generation information security team to the lifecycle management of cyber risks in today\u2019s global enterprises.<\/strong><\/p>\n

\"EMC\"<\/a>The last 18 months have seen big changes in the overall requirements for success for information security teams against a backdrop of a hyper-connected business environment, evolving threat landscape, new technology adoption, and regulatory scrutiny. In response to this changing environment, essential activities and responsibilities of enterprise information security teams are very much in transition.<\/p>\n

The latest report titled, \u201cTransforming Information Security: Designing a State-of-the Art Extended Team,\u201d<\/em> argues that information security teams must evolve to encompass skill sets not typically seen in security, such as business risk management, law, marketing, mathematics, and purchasing. The information security discipline must also embrace a joint accountability model in which responsibility for securing information assets is shared with the organization\u2019s line of business managers and executives who are beginning to understand that they ultimately own their own cyber risks as a part of business risk. Many of the advanced technical and business-centric skills needed for security teams to fulfill their expanded responsibilities are in short supply and will require new strategies for cultivating and educating talent, as well as leveraging the specialized expertise of outside service providers.<\/p>\n

To help organizations build a state-of-the-art extended security team, the Council drafted a set of seven recommendations, which are detailed in its new report.<\/p>\n

    \n
  1. Redefine and Strengthen Core Competencies<\/strong> \u2013 Focus the core team on increasing proficiencies in four main areas: cyber risk intelligence and security data analytics; security data management; risk consultancy; and controls design and assurance.<\/li>\n
  2. Delegate Routine Operations<\/strong> \u2013 Allocate repeatable, well-established security processes to IT, business units, and\/or external service providers.<\/li>\n
  3. Borrow or Rent Experts<\/strong> \u2013 For particular specializations, augment the core team with experts from within and outside of the organization.<\/li>\n
  4. Lead Risk Owners in Risk Management<\/strong> \u2013 Partner with the business in managing cybersecurity risks and coordinate a consistent approach. Make it easy for the business and hold them accountable.<\/li>\n
  5. Hire Process Optimization Specialists<\/strong> \u2013 Have people on the team with experience and certifications in quality, project or program management, process optimization, and service delivery.<\/li>\n
  6. Build Key Relationships<\/strong> \u2013 Develop trust and influence with key players such as owners of the \u201ccrown jewels,\u201d middle management, and outsourced service providers.<\/li>\n
  7. Think Out-of-the-Box for Future Talent<\/strong> \u2013 Given the lack of readily available expertise, developing talent is the only true long-term solution for most organizations. Valuable backgrounds can include software development, business analysis, financial management, military intelligence, law, data privacy, data science, and complex statistical analysis.<\/li>\n<\/ol>\n

    Art Coviello, EVP of EMC and executive chairman, RSA, The Security Division of EMC, said:\u00a0\u201cFor this transformation to be successful security must be seen as a shared responsibility that requires active partnerships to manage the inherent risks to the business in the ever-evolving threat landscape. It is imperative that organizations can develop a security team with the right expertise needed to get the job done.\u201d<\/p>\n

    Bob Rodger, group head of infrastructure security, HSBC Holdings plc., said:\u00a0\u201cThe core security team\u2019s expertise should be primarily focused on delivering consulting, providing direction, driving strategy, identifying and explaining risks to the business, understanding threats, and moving the organization forward \u2013 not be encumbered by the day-to-day routine operational activities.\u201d<\/p>\n

    The Security for Business Innovation Council is a group of top security leaders from Global 1000 enterprises committed to advancing information security worldwide by sharing their diverse professional experiences and insights. The Council produces periodic reports exploring information security\u2019s central role in enabling business innovation.<\/p>\n","protected":false},"excerpt":{"rendered":"

    A new research report released today by RSA, The Security Division of EMC, from the Security for Business Innovation Council reveals the composition of a forward leaning security program \u2013 starting with building a next-generation information security team to the lifecycle management of cyber risks in today\u2019s global enterprises.<\/p>\n","protected":false},"author":6,"featured_media":189,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19,18],"tags":[98,669,668,667],"class_list":["post-1973","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-headlines","category-white-papers","tag-emc","tag-rsa","tag-security-for-business-innovation-council","tag-transforming-information-security-designing-a-state-of-the-art-extended-team"],"_links":{"self":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts\/1973","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/comments?post=1973"}],"version-history":[{"count":0,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts\/1973\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/media\/189"}],"wp:attachment":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/media?parent=1973"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/categories?post=1973"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/tags?post=1973"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}