deepseas-transforms

Here’s What Not to Do When Transforming Cybersecurity Programs

Let’s start by addressing what transforming cybersecurity programs does not look like. 

Unfortunately, DeepSeas is often introduced to organizations when they are under attack or immediately after a breach or serious incident has occurred. While those organizations are willing to work hard to transform, the truth is they often already had most of what they needed to prevent the incident in the first place. They just hadn’t started the transformation process.  

When cybersecurity leaders get a call at 3 a.m. about a breach, their teams often find religion instantly about transforming their program. We don’t want that to be you. The better — and less costly — way is to start transforming today, before your organization is a statistic with real and lasting reputational damage. 

Start Transforming

GET A RISK ASSESSMENT

How does the DeepSeas transformational framework and methodology get kicked off?  

DeepSeas will start by supporting your team in answering three simple questions.

1. “What is the status of our cyber program today?”  
2.  “What should our goals be?”
3.  “Why and how should we continuously transform our cyber program?”   

Our transformation framework at DeepSeas will guide you through these questions and prepare you for next steps through an effective methodology that prioritizes the most relevant and impactful actions. 

Through this process we’ll help you document: 

• The number of endpoints (mobile devices, client devices, partner devices, access points) that your organization has today
• Your organization’s current vulnerabilities
• Organizational knowledge and environmental visibility to these endpoints and what is happening on them
• A process that your organization will use to continuously learn, improve, and reduce your attack surface

As straight forward as these actions sound, over 80% of the organizations that come to DeepSeas (both large and small) for guidance don’t have these critical components documented, implemented, and working well within their organization.  

DeepSeas will help you build a transformational cybersecurity program using three ‘action phases’ that correspond to the areas covered below.

Phase one action: Gain Visibility.

Phase two action: Integrate and Operate Processes & Governance.

Phase three action: Optimize Your Program.

Now, let’s go a little deeper into each phase of transforming cybersecurity programs.

Start Transforming

GET A RISK ASSESSMENT

Phase One of Transforming Cybersecurity Programs: Gain Visibility  

In the visibility phase, we get a deeper ‘understanding of our denominator’ and really quantify your organization’s current cybersecurity impact. Only then we can prioritize, because an honest and in-depth understanding of where you are today is the best first step. Some of the issues confronted in phase one include:

• How many endpoints do you have? How do you find them? 
• Do you have a Security Information and Event Management (SIEM) tool in place?
• What log sources are going into your SIEM?
• What is your documentation process? 

While few organizations can answer all these questions in totality, the process will help you get close. And once you quantify your end points and manage them actively, you will be on the road to transformation.

Phase Two of Transforming Cybersecurity Programs: Integrate and Operate Processes & Governance 

Phase two is where we see many organizations using a situational or ad hoc approach. A good deal of the organizations that engage with DeepSeas have a response that is really a loose federation of organizations that come together to execute an ad hoc process. With DeepSeas guiding your cyber defense program’s transformation, you’ll realize the benefits of our systematic, repeatable, and reliable approach.

Here are some of the issues and questions we confront in phase two of transformation.

• How do you run your cyber threat detection and response today?

• What are the most likely attack vectors, techniques, procedures, and tools?

• How do you respond to an incident? What is your current playbook [do you have a playbook]? Is it documented and consistent? Is your team fully aware of response protocols?

• How do you manage workflows and how do you prioritize them? 

• Do you have service providers that need to be part of response? For instance, do you have a service provider managing your network?

• How do you source, harvest, tune, and deploy detections in your environment?  

Once we have a good understanding of the answers to these questions, the next questions are key:

• Are you updating? What is the frequency of updates?

• How can we infuse insight and past knowledge into the program to make security tighter based on prior cases and learning? 

Once we have documented understanding during the first two phases, we are ready to move into phase three – optimization. 

Phase 3 of Transforming Cybersecurity Programs: Optimize Your Program 

Phase three is where your organization will ultimately feel the benefit and impact of the substantial effort put forth in the earlier two phases. However, there is sometimes confusion in phase three. Some leaders think that taking steps toward optimization automatically leads to reductions in personnel — but that isn’t the intent of optimization or a foregone conclusion.  

Implementing the DeepSeas framework and solid detection technologies should enhance and focus the work of your current team, rather than reducing headcount. Phase three builds consistency and efficiency through a continuous improvement framework – which we’ve seen build cost savings and business benefits like reducing risk, achieving resiliency, and protecting reputation. 

The issues and questions we confront in phase three include: 

• Are we reporting and sharing improvements with stakeholders, including the board of directors, with quantifiable and relevant metrics? 

• Is automation and detection helping the team hone in on the real signal in the noise?

• Do we have KPIs captured around business risk, risk of business disruption, risk to data and operations, impact to insurance, etc.?

• Is our security team staff retention solid or shifting? Is the team continually learning new skills and capabilities by serving with world-class cyber professionals to achieve your mission?  

Start Transforming

GET A RISK ASSESSMENT

So, there you have it. This is the DeepSeas three-phase framework for transforming cybersecurity programs. Our crew at DeepSeas is here to help make it work hard for you and your organization.