Security Health

How Healthy is your Security Mindset?

At Pocket CISO, we find it helpful to think about organizational security the way we think about our own health. For example, are we eating a candy bar, a protein bar, or a chicken Caesar salad every day at lunch? All three meet our caloric needs, but our outcome is different depending on what we choose to eat.

The Security Health Model divides security efforts into three columns: Grassroots (someone somewhere is trying to do the right thing), Coordinated (there is a person or team dedicated to security - usually for regulatory or contractual obligations), and Embedded (security concept are understood across the organization and embedded into processes).

We then look at security from dimensions of an organization: Organizing Principle, Organizational Awareness, Culture, Technology, and Leadership.

For Grassroots:
Organizing Principal = Individuals or individual teams may take responsibility for security in their areas

Organizational Awareness = No common understanding of, or baseline for, security across org, leadership & board

Culture = Security seen as a "technical problem"

Technology = Security exists as configuration of networking, laptop, software tools

Leadership = No central cybersecurity ownership or leader

For Coordinated:
Organizing Principal = "Government regulations/customer expectations drive security measures, generally managed by a single team"

Organizational Awareness = Only the team responsible for security or compliance have a definition of security initiatives

Culture = Security seen as "compliance or specific team's problem"

Technology = Security tools are brought in as a response to outside pressures & may not be aligned with the business

Leadership = Security leadership exists in a silo, often focused on compliance

For Embedded:
Organizing Principal = Cybersecurity is integrated into organization-wide risk management toolset

Organizational Awareness = Security integrated into program and product initiatives

Culture = Security seen as core to enabling the business

Technology = Security tooling in place to support business alignment and risk management

Leadership = Security leadership enabled by and has direct access to C-Suite, Board