The Business Model of Security » isc2 http://businessmodelofsecurity.com Demand Driven Security Program Management Wed, 31 Jul 2013 18:39:41 +0000 en-US hourly 1 https://wordpress.org/?v=4.0.38 Defining Security Strategy http://businessmodelofsecurity.com/bmos/introduction/defining-security-strategy/ http://businessmodelofsecurity.com/bmos/introduction/defining-security-strategy/#comments Tue, 02 Mar 2010 11:50:40 +0000 http://competitivecompliance.com/?p=123 When developing your security strategy, it is important to recognize the limitations on your team. In this case, choosing what to do is often less important than choosing what NOT to do. This deck is used to drive conversation around the choices we make as security practitioners in what we choose to tackle, and what […]

The post Defining Security Strategy appeared first on The Business Model of Security.

]]> When developing your security strategy, it is important to recognize the limitations on your team. In this case, choosing what to do is often less important than choosing what NOT to do. This deck is used to drive conversation around the choices we make as security practitioners in what we choose to tackle, and what choose not to do in our daily quest to mitigate and manage risk.

The post Defining Security Strategy appeared first on The Business Model of Security.

]]> http://businessmodelofsecurity.com/bmos/introduction/defining-security-strategy/feed/ 0 Language of Risk http://businessmodelofsecurity.com/bmos/introduction/language-of-risk/ http://businessmodelofsecurity.com/bmos/introduction/language-of-risk/#comments Sat, 27 Feb 2010 03:29:01 +0000 http://competitivecompliance.com/?p=116 Why is “The Language of Risk” so important right now?  What are the drivers for Business and Security to speak the same language?  The answer is change: massive, fundamental change in both camps. Technology has moved to center stage as a partner in business enablement, and has brought along its associated risks.  IT and IT […]

The post Language of Risk appeared first on The Business Model of Security.

]]> Why is “The Language of Risk” so important right now?  What are the drivers for Business and Security to speak the same language?  The answer is change: massive, fundamental change in both camps.

Technology has moved to center stage as a partner in business enablement, and has brought along its associated risks.  IT and IT Security see massive changes daily in the very nature of the capabilities and services they provide.  Transformative changes and their resulting risks and benefits impact the business enterprise overall.

What changes?  EVERYTHING. This is a paradigm shift far greater than that of changing from mainframes and terminals to desktop computing. Potential anarchy lurks, and security risks change hourly.  IT Security can no longer manage risk in a vacuum.  The risks to IT Security are the risks to the enterprise, period.

It is imperative now for the Language of Risk to be a common element between Business and IT Security.  Each of these transformative changes in IT brings the potential for competitive advantage, cost savings and economies of scale.  The security risks bring potential for financial ruin, loss of reputation and regulatory fines.  Technology evolves, but it is past time for IT Security and Business to define what is essential, the security and availability for the resources required to do business.

We need a common lexicon.  We need “The Language of Risk.”  Let’s talk.

Here is the opening set of slides from the (ISC)2 2010 Security Leadership Series on Competitive Compliance which outlines how thinking like the business leads to improved communication between parties on risk.

The post Language of Risk appeared first on The Business Model of Security.

]]> http://businessmodelofsecurity.com/bmos/introduction/language-of-risk/feed/ 0