Podcast: Security Program Roadmap

This episode of True Colors of Cyber Security is all about the basics of building a security program roadmap. 

We’re talking about why organizations build security roadmaps and an approach on how to build one while simultaneously getting management-level buy in. 

This episode goes over the steps a security team needs to take in order to make a customized roadmap based on an organization’s current state and offers some tips on conducting effective assessments. 

Take a listen to the first episode of our cyber security basics segment and hopefully get some insight onto what it takes to make the most of your security program roadmap. 

Enjoying True Colors of Cyber Security? Want us to tackle a specific topic to cover in our new segment? Let us know and share it with someone you think might benefit from it! 

Transcription Below: 

This is True Colors of Cybersecurity, powered by CISOSHARE in Southern California to be enjoyed globally. We discuss the unspoken truth in the cybersecurity industry. Check out our other episodes at cisoshare.com forward slash cyber dash security dash podcast.

Welcome back to another episode of True Colors of Cybersecurity. It’s been a while since the last episode, but we are back with even more cybersecurity content. Everything’s a little bit different these days since everyone’s working out of the office.

But as always, my name is Celine and I will be your host for today’s episode. We’re actually back with a new segment all about cybersecurity basics. Instead of interviewing a member of our team, I’ll be walking you through a high level definition of different aspects of security.

Today we’re talking about what needs to be done to build an effective security program roadmap and what an effective approach looks like. So what is a security program roadmap? Essentially it’s a strategy for implementing and executing security projects with the long-term goal of improving an organization’s security program posture. A security program roadmap is usually created with a few high level organizational objectives in mind and then trickles down to the projects that need to be executed in order to meet those objectives.

One of the best ways to approach a security program roadmap is from the top down and the bottom up. This means educating leadership early in the roadmap development process and getting their buy-in. Maintaining a list of findings and recommendations of projects and programs of work makes it easier to work into your top level objectives with management.

These objectives can be formed while working with a security team to drive the programs of work for the roadmap forward. The basis of a successful security program roadmap begins with an assessment. This can be conducted with an organization’s internal resources or outsourced to another provider.

The key to a good assessment is doing it with the right scope and with a security architecture in mind, not only best practices. The goal is to cover the entire environment and all the different areas in it. Best practice assessments are meant to be all encompassing, but you want to make sure you take a look at the actual health of your security architecture.

‘

This means evaluating the preventive and detective safeguards you have in place and how well they work together. This provides the technical information about where your organization has needs and gaps. Once the assessments are done, it’s time to aggregate the results from these assessments.

Doing this helps create the most complete view of your security program. It also provides metrics that your team can use to educate organizational leadership about the reason a roadmap is necessary. From there, it’s time to focus on the whys or the objectives of the roadmap.

This part of roadmap development is a critical part in getting buy-in from organizational leadership. The real magic happens not in the final presentation and approval of the roadmap, but in the discussions around forming these objectives. Once the roadmap objectives are clear, the security team can build out the details from there while keeping each project and program of work in clear alignment with the established objectives.

During this stage of roadmap development, make sure to include different execution options. These could be using just an internal team to execute strategic changes, outsourcing projects to another provider, or a combination of both. Once your team has completed the roadmap, the final step is to present the execution approach and budget to stakeholders and decision makers in your organization for approval, keeping in mind the total and operational costs for the roadmap as well as any normal day-to-day security activities.

If everything’s squared away, then your team is ready to start staffing and executing the projects in the roadmap. There are also a few things to keep in mind as you go through the steps to build a security program roadmap. When it comes to assessments, make sure that your team or external provider assesses the environment with improvements in mind rather than treating it like an audit.

If you’ve outsourced the assessment, it may be helpful to engage that group to build the associated projects for your security program roadmap. As you build your roadmap, it’s also important to remember that tactical items will still be there. While your team plans out strategic projects and tasks, the tactical day-to-day tasks and demands on your team won’t go away.

Don’t get caught up in tactical tasks and leave your strategic initiatives by the wayside. A roadmap is often a multi-year effort. It takes time and planning to balance implementing and executing strategy while maintaining your regular security program activities.

And that’s our episode on building a strategic security program roadmap. Hopefully you learned something new or considered something about building a roadmap that you might not have before. Let us know what you think about this shorter episode format for Cybersecurity Basics.