A Maturity Model for Enterprise Security

When we sit down with our enterprise customers the discussion usually hinges on two questions: where is your enterprise security program today, and where do you want it to be tomorrow?

For many companies, the answer is pretty straightforward – they want to improve their overall security posture, reduce risk, and lower costs. But how do they get there?

We believe that with enterprise security, as in many other industries, you can measure the cost and effectiveness of your security program, as well as build a strategic roadmap for future planning, by relying on a maturity model that takes into account the real-world experiences of other organizations.

We look at maturity in four stages – Reactive, Compliant, Proactive and Optimized:

REACTIVE: In this stage, quite simply, an incident occurs and the organization tries to react. These businesses are usually doing as much as they can with little security budget to meet their most basic threat needs. However, not only is overall risk higher, but reactive management of security can yield much higher IT cost over time.

COMPLIANT: Here, an organization is beginning to define security policies and processes in order to meet external compliance mandates like PCI, SOX, FISMA or HIPAA. There is some standardization at this stage, but usually still at a very high cost (capital or resource), because technologies are disparate and security processes are still nascent.

PROACTIVE: At this point, the business begins to look at the efficiencies gained from centralized security management. Processes are usually more mature and the organization generally has a handle on compliance regulations. Cross-product integration is increasing, but all the security technologies and processes aren’t leveraging one another, and costs remain high given the sheer number of point tools in play.

OPTIMIZED: Here the various security technology dots, if you will, become connected. Risk awareness, management and policy definition are fully centralized and compliance is automated. Threat intelligence is updated in real-time and correlated, while information from one sensor technology can benefit another. This company has combined multi-layered defenses, with threat intelligence and centralized management, leading to greater IT protection and significantly lowering the overall cost of security.

This is just a snapshot of how we characterize the stages of enterprise security maturity. We’ll be diving deeper into each of the stages and the elements of what it means to plan for an optimized security program in future posts, but in the meantime – where do you see your security organization today?

Tags: Compliance, IT, Maturity Model, Optimized