Background Information: This post is for some research I’m working on for a course I’m taking at the University of Advancing Technology as a Network Security student. I’m researching some implementation frameworks for security. One article we’re using for reference in the class is https://buildsecurityin.us-cert.gov/bsi/articles/best-practices/deployment/574-BSI.html. One of the implementation frameworks mentioned in this article is called Security Knowledge in Practice or the SKiP method. Now, one of the reasons I chose to look into this one further is because of how the previously mentioned article talked about it. One of the first things the article brings up about this method is vendors and the search for that appliance that does it all. The article makes a note to mention the security implications bringing in a bunch of appliances to do some service for you can have, including introducing their own poorly (sometimes) configured services that introduce more vulnerabilities, only now directly tied into the enterprise security measures. Anyway, I’ve always thought that security should be accomplished by hardening what exists first, before trying to find something that claim it will bring security with it. That said, I have nothing against appliances, though I generally prefer open source solutions as I’m more of a hands-on tech and actually enjoy the DIY aspect that comes with open source. That and the fact I can look at the code myself if need be in order to fix or adapt the solution to my needs.
Question: Now, this assignment is more of a discussion based assignment which doesn’t fit in line with the Q&A type sites out there, so I’m going to try and ask a specific question in order to comply with the posting rules, but anyone who wants to share their experience with implementation frameworks would be most welcome. Now, I have no doubt about the effectiveness of SKiP, but some of it struck me as very similar to most other approaches. Secure what you have and then enter the prepare, detect, respond, and improve cycle that most all security frameworks seem to follow. So my question is how necessary is it to even follow something that’s roughly the same cycle as most other frameworks? Wouldn’t sticking to the basics and keeping it simple work just as well? Granted the cycle has to be learned somewhere, but does it really need a name to make it effective? Or are these fancy frameworks just ways to appease the higher ups with a step by step process regardless of how cookie cutter it is?
I appreciate any feedback.