Making Security Assurance More Business-Focused

In a fast-moving environment filled with evolving cyber threats, leaders want confidence that business processes, projects and supporting assets are well protected.

Many organizations aspire to an approach that directly links security assurance with the needs of the business, demonstrating the level of value that security provides. However, there is often a significant gap between ambition and reality. Improvement requires time and patience, but organizations do not need to start at the beginning. Most already have the basics of security assurance in place, meeting compliance obligations by evaluating the extent to which required controls have been implemented and identifying gaps or weaknesses.

Taking a business-focused approach to security assurance is an evolution. It means going a step further and demonstrating how well business processes, projects and supporting assets are really protected, by focusing on how effective controls are. It requires a broader view, considering the needs of multiple stakeholders within the organization.

Business-focused security assurance programs can build on existing compliance-based approaches by:

• Identifying the specific needs of different business stakeholders
• Testing and verifying the effectiveness of controls, rather than focusing purely on whether the right ones are in place
• Reporting on security in a business context
• Leveraging skills, expertise and technology from within and outside the organization

A successful business-focused security assurance program requires positive, collaborative working relationships throughout the organization. Security, business and IT leaders should actively engage with each other to make sure that requirements are realistic and expectations are understood by everyone involved.

The need for change

Security assurance means different things to different organizations, resulting in a range of approaches and practices being adopted. Despite their differing approaches, organizations face common challenges that are driving a need for change.

The purpose of security assurance is to provide business leaders with an accurate and realistic level of confidence in the protection of ‘target environments’ for which they are responsible. This involves presenting relevant stakeholders with evidence regarding the effectiveness of controls. However, common organizational approaches to security assurance do not always provide an accurate or realistic level of confidence, nor focus on the needs of the business. Security assurance programs seldom provide reliable assurance in a dynamic technical environment, which is subject to a rapidly changing threat landscape. Business stakeholders often lack confidence in the accuracy of security assurance findings for a variety of reasons.

Common security assurance activities and reporting practices only provide a snapshot view, which can quickly become out of date: new threats emerge or existing ones evolve soon after results are reported. Activities such as security audits and control gap assessments typically evaluate the strengths and weaknesses of controls at a single point in time. While helpful in identifying trends and patterns, more regular reporting is required to keep pace with new threats.

There is often ambiguity over what the security assurance function delivers and the way it aligns with other functions in the organization, such as risk management, compliance and audit. This lack of alignment can lead to poor communication, stemming from failures at the governance and leadership level, adversely impacting the capacity to provide consistently reliable evidence about the effectiveness of controls.