What's the benefit of using a specific implementation framework vs using the generic steps presented in most developed security frameworks?

Question

Background Information: This post is for some research I’m working on for a course I’m taking at the University of Advancing Technology as a Network Security student. I’m researching some implementation frameworks for security. One article we’re using for reference in the class is https://buildsecurityin.us-cert.gov/bsi/articles/best-practices/deployment/574-BSI.html. One of the implementation frameworks mentioned in this article is called Security Knowledge in Practice or the SKiP method. Now, one of the reasons I chose to look into this one further is because of how the previously mentioned article talked about it. One of the first things the article brings up about this method is vendors and the search for that appliance that does it all. The article makes a note to mention the security implications bringing in a bunch of appliances to do some service for you can have, including introducing their own poorly (sometimes) configured services that introduce more vulnerabilities, only now directly tied into the enterprise security measures. Anyway, I’ve always thought that security should be accomplished by hardening what exists first, before trying to find something that claim it will bring security with it. That said, I have nothing against appliances, though I generally prefer open source solutions as I’m more of a hands-on tech and actually enjoy the DIY aspect that comes with open source. That and the fact I can look at the code myself if need be in order to fix or adapt the solution to my needs.

Question: Now, this assignment is more of a discussion based assignment which doesn’t fit in line with the Q&A type sites out there, so I’m going to try and ask a specific question in order to comply with the posting rules, but anyone who wants to share their experience with implementation frameworks would be most welcome. Now, I have no doubt about the effectiveness of SKiP, but some of it struck me as very similar to most other approaches. Secure what you have and then enter the prepare, detect, respond, and improve cycle that most all security frameworks seem to follow. So my question is how necessary is it to even follow something that’s roughly the same cycle as most other frameworks? Wouldn’t sticking to the basics and keeping it simple work just as well? Granted the cycle has to be learned somewhere, but does it really need a name to make it effective? Or are these fancy frameworks just ways to appease the higher ups with a step by step process regardless of how cookie cutter it is?

I appreciate any feedback.

Answer 1

You're familiar, I hope, with the first rule of Information Security club; don't roll your own crypto. Turns out that this rule has wider implications; you really shouldn't roll your own security frameworks either.

A well established framework has had a lot of smart people looking at it for gaps, and on a more practical level it's been deployed in the real world a lot and has brought benefits. (I don't actually think SKIP is a well established framework, but that's not really the point to your question.)

Also, it's not a criticism of a framework that it is reminiscent of other frameworks - good security practice is good security practice. SKIP seems to be an attempt to apply a PDCA process to vendor supplied equipment; naturally it's going to look a lot like other frameworks based on PDCA.

In addition, using a standard framework makes it much easier (and hence cheaper) to do external audits, because you can hire an auditor who already knows the framework.