Four Essential Steps to Managing Modern Security

The Security Management Cycle

Nearly every modern security framework can be broken down into four, distinct phases: Intelligence, Protection, Response, and Recovery. Each function as a failsafe for the one before
it, so in a sense, managing security means managing failure. For example, if an organization falls short on responding to a threat, it should be able to effortlessly pivot toward prioritizing recovery. This cascading effect allows flexibility in the face of evolving security incidents and
limits disruption.

While these four steps might sound simple enough, they do require consistent practice to implement correctly. It’s also important to understand the role each plays as subcomponents of two, larger stages, Proactivity and Reactivity. Understanding the security management cycle wholistically can make the difference between a hardened, resilient organization and a
vulnerable one.

Proactive Security

Security and Intelligence represent the first two phases of the Proactivity stage. In lay terms, this is where security practitioners work to thwart adversaries before they act. Placing a weighted emphasis on Intelligence and Protection makes organizations harder targets and reduces their likelihood of falling victim to bad actors.

Intelligence

Proactivity starts with good intelligence gathering, which can mean everything from researching open-source data on known threats, creating predictive profiles on potential adversaries, conducting threat assessments, and similar forms of due diligence. Any intelligence an organization gathers should be socialized internally, to ensure staff can operationalize the data into actionable security strategies. Additionally, organizations must also share intelligence outwardly to ensure an optimal security posture. Open lines of communication with vendors, partners, and even competitors are incredibly important, and a prime example of why is the September 11, 2001 attacks on the United States. American intelligence agencies unanimously agree that each had a piece of data from which the others could have benefited, and had they shared information more openly and consistently with one another, the attacks on the Twin Towers and World Trade Center very well could have been averted.

Protection

The second phase in proactive security management is protection. Shoring up defenses in advance of any attack will make it more difficult for adversaries to break through and wreak havoc.

Good protection has multiple, cross-cutting facets. For example, solid fences work well as a physical security barrier, while credentialling and facial recognition serve as reliable access control tools. Protection in all its forms helps to ensure operational, economic, and social stability in the face of potential hazards.

Reactive Security

Organizations should devote the bulk of their planning energy to the Proactivity stage. But what happens when a cunning adversary manages to break through anyway? Here, the Reactivity phase comes into play, which serves as an inflection point for organizations to move from planning and preparedness activities to those focused on response and recovery.

Response

The third phase in security management – and first in the Reactivity stage – is response. As the name implies, response is the phase in which an organization acts to report, stall, or stop an active threat, and the nature of these actions depends on a few key factors. First, the impacted entity must assess the scope of the attack, be it cyber, physical, or operational. From there, they should consider the quickest avenues to mount an offense that will limit further damage to their people, money, or infrastructure. Response is never a one-size-fits-all activity, and for that reason, every organization should take time to train staff through tabletop of functional exercises that practice their specific parameters.

Recovery

Regardless of whether an impacted organization manages to stop an active threat from causing prolonged chaos, there will almost certainly still be a price to pay. Thorough damage assessments can reveal the extent of an attack’s impacts and direct decision-makers on how best to restore normal operations. Some recoveries are costly. Others are time-consuming. No matter the scale, organizations should document their recovery journey to help inform future iterations of their protection plans.

Advance Planning is Paramount

Unfortunately, once a threat penetrates an organization’s barriers, the only hope is to limit damages – not stop them outright. The best chances at prevention are possible only throughout the Proactivity stage of security management, and as such, is where organizations should commit the bulk of their resources and attention. Staying one step ahead of an adversary is the only surefire way to remain fully unscathed. Many firms, agencies, and standards bodies are beginning to lean toward security models that promote built-in proactive intelligence and protection measures, such as the U.S. Government’s Secure by Design initiative, which calls on software developers and tech companies to consider security risks throughout their development cycle, as opposed to after the fact. This sort of approach to proactive security management will help keep communities safe and secure, and
adversaries on their toes.

Stay Protected with Help from Experts

All organizations are susceptible to attacks, although very few have the resources to plan for every eventuality, in-house. Companies like Chameleon Associates can help. We offer external training to the private sector, governments, nonprofits, and individuals who need a cost-effective curriculum that will set them up for success.