https://www.sikich.com

A Risk-Based Approach to Maximizing Security Control Investments

Jeff Strachota

Mar 27 2018

2 min read

Buying the latest and greatest, best-of-breed security solutions without employing a risk-based approach to security is not a sound strategy for an information security program. Without having a mapping between the capabilities of the new security tool (security control) and the risk faced by the organization, a return on investment (ROI) will rarely be achieved. Even worse, there is a strong possibility that the information technology (IT) risk will not be sufficiently addressed by implementing the new tool.

As part of the many risk assessments Sikich performs each year, we often find that organizations that have made significant investments in security tools either have only partially deployed the technology or haven’t deployed the technology at all. Many of the high-profile breaches of the last decade occurred despite early indications malicious activity in system and audit logs. This has contributed to an increase in investments into security information and event management (SIEM) solutions. Organizations that make sizable investments into SIEM technology oftentimes find that the tool is overly complex, or they don’t have the expertise to configure the technology in a manner that allows them to address risk as needed. In these scenarios, it’s likely that the organization evaluated the risk, but didn’t factor in the costs associated with operating and maintaining the control.

The threat landscape is different for every organization. Some organizations may reside in industries, or provide products or services, that make them high-value targets for malicious actors. Thus, they may need the advanced threat intelligence capabilities that a SIEM solution can provide. Other organizations may face compliance standards (e.g., the Payment Card Industry Data Security Standard (PCI DSS)) that dictate requirements related to daily log review. The Sikich risk assessment process is designed to help clients evaluate risk that is specific to their business and identify controls that are appropriate, cost-effective, and commensurate with the level of risk.

When deciding to make an IT investment in a new security solution, it’s critical first to identify risk appropriately and understand how the risk can negatively impact organizational assets. Then, through risk response, the organization can implement the correct, most cost-effective control based on its understanding of its business and the risks it faces.

If you have any questions regarding a risk-based security strategy or would like us to help with your business’s risk assessment process, contact us at any time.

This publication contains general information only and Sikich is not, by means of this publication, rendering accounting, business, financial, investment, legal, tax, or any other professional advice or services. This publication is not a substitute for such professional advice or services, nor should you use it as a basis for any decision, action or omission that may affect you or your business. Before making any decision, taking any action or omitting an action that may affect you or your business, you should consult a qualified professional advisor. In addition, this publication may contain certain content generated by an artificial intelligence (AI) language model. You acknowledge that Sikich shall not be responsible for any loss sustained by you or any person who relies on this publication.

About the Author

Jeff Strachota

Jeff is a Manager at Sikich who not only has experience defining standards, implementing security procedures and overseeing compliance management efforts, but also excels at working with clients to help understand and integrate service offerings while maintaining the continuity of business functions. He has an extensive understanding of managed and cloud services, as well as associated technologies, including Cisco, Microsoft, Citrix and VMware applications and devices. Jeff is well versed on the Payment Card Industry Data Security Standard (PCI DSS) and the Statement on Standards for Attestation Engagements No. 16 (SSAE 16), having spearheaded compliance initiatives for Service Organization Control (SOC) and PCI DSS assessments. No matter the project, Jeff is able to utilize his diverse technical skillset to both address business requirements and help manage risk. Jeff is a Certified Information Systems Security Professional (CISSP), Payment Card Industry Qualified Security Assessor (QSA), Payment Application Qualified Security Assessor (PA-QSA) and VMware Certified Professional (VCP). He also holds a Certified in Risk and Information Systems Control (CRISC) certification and a Global Information Assurance Certification (GIAC) in Security Essentials (GSEC).