4

I'm curious if people have different views on this and why.

Update based on comments:

Defend enterprises.

Quotes:
"Long-time blog readers should know that I don't rely on tools to defend my enterprise. I rely on people first, followed by tools, then processes", Richard Bejtlich

“The Enterprise Information Protection Paradigm,” Dan Geer’s [...] because it drives unification of people, process and technology.

"Surviving Security: How to Integrate People, Process, and Technology" by Amanda Andress

Improve this question
8
  • 2
    Defense of what exactly? You might want to consider adding some more information ;-)
    – Ivo Flipse
    Jan 12, 2011 at 9:40
  • 1
    As Ivo said, I think this is such a broad question which could be answered in so many different ways. From experience I haven't ever seen two organisations do this with the same mix :-)
    – Rory Alsop ♦
    Jan 12, 2011 at 11:05
  • 5
    The bare minimum of questions to answer before asking this one is (1) To protect what? (2) Against what threats? (3) With what level of residual risk as acceptable?
    – user502
    Jan 12, 2011 at 15:10
  • 1
    I agree with all of the comments, this is (at revision 3) a very vague question. Not all enterprises need defending in the same way: you still need to be more specific about the assets and attackers you're considering.
    – user185
    Jan 13, 2011 at 9:42
  • 2
    I suggest refining it to a much more specific kind of enterprise. Big product manufacturers have very different requirements than big web service providers or large non-profits or consulting firms or grocery store chains or government entities. And enterprises with 10000 employees are looking for rather different answers than those with 100.
    – nealmcb
    Jan 16, 2011 at 3:25

3 Answers 3

Reset to default
3

It depends. It all depends upon what you are protecting, what your budget is, and many other kinds of context.

That said, if it were me, I'd start with people. Tools and technologies are worthless without people. If you don't have the right people to execute your security strategy, you're hosed. Once you have people you trust, they can advise you on where tools and technologies and process would help, and you can do the cost-benefit analysis for each to determine whether to adopt them.

Improve this answer
3

"Defense In Depth", as a philosophy, would suggest that you would integrate information security throughout the organization: in all functional areas, technology solutions, and business practices. That said, such an approach has to be balanced. Ultimately, the effort is going to be dependent on the organization in question. The military, for instance, integrates "opsec" (operational security) to virtually all aspects of its operation, while a restaurant likely has no clue about security beyond what they're told to do by their card processor.

So, in the end, its going to vary on a LOT of factors.

Improve this answer
0

Let's start with this quote from Tate (who asked the StackExchange question), "Long-time blog readers should know that I don't rely on tools to defend my enterprise. I rely on people first, followed by tools, then processes", Richard Bejtlich

This is about right. It's almost exactly right. The one thing I would change is that tools and processes must be strategized simultaneously, and that you can scale the process with extra people (starting with at least one, though, of course!).

For example, let's say that you're trying to start a Pen Test program. You need one full-time tester. That tester must work through a process value chain (or chains). Those value chains consist of techniques (e.g., whitebox, graybox, and blackbox) and sub techniques (e.g., mobile, web, network, et al). A tool (or tools) can be mapped to each sub technique. When you need to scale, you simply add more people.

A recent Cloak & Swagger episode on YouTube made several comments that cover this question. The discussion around people vs. tools starts around 47 minutes in, but the best part is Ali's formula of "what orgs can afford" (starting around 55 minutes in) where he mentions that we can only afford people + 1 in tools.

I enjoy both of these ideas. In the book, "IT Security Metrics", the authors (Lance Hayden, et al) discuss staffing to incidents using a Poisson distribution, as well as other methods for outsourcing, and finally even include a huge piece on defining processes with people integration -- all covered in chapter 9. This is another source worth checking out.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .