Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite

I'm curious if people have different views on this and why.

Update based on comments:

Defend enterprises.

Quotes:
"Long-time blog readers should know that I don't rely on tools to defend my enterprise. I rely on people first, followed by tools, then processes", Richard Bejtlich

“The Enterprise Information Protection Paradigm,” Dan Geer’s [...] because it drives unification of people, process and technology.

"Surviving Security: How to Integrate People, Process, and Technology" by Amanda Andress

share|improve this question
2  
Defense of what exactly? You might want to consider adding some more information ;-) – Ivo Flipse Jan 12 '11 at 9:40
1  
As Ivo said, I think this is such a broad question which could be answered in so many different ways. From experience I haven't ever seen two organisations do this with the same mix :-) – Rory Alsop♦ Jan 12 '11 at 11:05
5  
The bare minimum of questions to answer before asking this one is (1) To protect what? (2) Against what threats? (3) With what level of residual risk as acceptable? – user502 Jan 12 '11 at 15:10
1  
I agree with all of the comments, this is (at revision 3) a very vague question. Not all enterprises need defending in the same way: you still need to be more specific about the assets and attackers you're considering. – Graham Lee Jan 13 '11 at 9:42
2  
I suggest refining it to a much more specific kind of enterprise. Big product manufacturers have very different requirements than big web service providers or large non-profits or consulting firms or grocery store chains or government entities. And enterprises with 10000 employees are looking for rather different answers than those with 100. – nealmcb Jan 16 '11 at 3:25
show 2 more comments

2 Answers

up vote 2 down vote accepted

It depends. It all depends upon what you are protecting, what your budget is, and many other kinds of context.

That said, if it were me, I'd start with people. Tools and technologies are worthless without people. If you don't have the right people to execute your security strategy, you're hosed. Once you have people you trust, they can advise you on where tools and technologies and process would help, and you can do the cost-benefit analysis for each to determine whether to adopt them.

share|improve this answer
up vote 3 down vote

"Defense In Depth", as a philosophy, would suggest that you would integrate information security throughout the organization: in all functional areas, technology solutions, and business practices. That said, such an approach has to be balanced. Ultimately, the effort is going to be dependent on the organization in question. The military, for instance, integrates "opsec" (operational security) to virtually all aspects of its operation, while a restaurant likely has no clue about security beyond what they're told to do by their card processor.

So, in the end, its going to vary on a LOT of factors.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.