4 Phases of Cybersecurity Maturity

There is a natural phase progression of cybersecurity leadership for small and medium businesses, and it also applies to even larger companies in sectors just adopting digital technology in the workspace and moving to secure those connected assets. These maturity levels evolve over time and have certain benefits. They also have certain drawbacks which compel continual improvement and investment that leads to progressing into subsequent phases. It's a natural tension that exists that eventually pulls organizations forward. Now, I can often very quickly size up a company's cybersecurity posture, goals, strengths, weaknesses, and challenges by simply recognizing where on this evolutionary scale they exist from a maturity perspective. So let's dive into these phases to understand why and how cybersecurity programs evolve. First, let's start with Phase 0. Phase 0, sadly, is characterized by fear, uncertainty, and doubt. Often small and medium-sized organizations, they're in denial and they tell themselves, oh well, they're not big enough to be a target, or nobody would be interesting and interested in attacking them. And they have apprehension in going down the path of applying security, thinking, "Oh well, the attackers are so good, it just won't matter," right? Or they procrastinate and, and they fear that it's too complex, too difficult, and in almost all cases they fear that it's too expensive, even though in reality none of those things are the case. But for small and medium companies that, that find themselves in this space, their overall security level is basically nonexistent. They are extremely easy targets for attackers to go after. And when attacks do happen, it tends to be a very high impact to the organization. And so the executives, the owners, they're really taking on the full burden of liability for not even following basic cybersecurity practices and ignoring the risks. This is not where you want to be. And for companies that do experience losses and attacks and survive them, that tends to push them out of this phase and go into the next one. And this Phase 1 is really where many companies actually start, especially those in highly regulated fields. They start and build a cybersecurity program with the explicit intent of meeting regulatory requirements. So we call this phase regulatory satisfaction. And again, it's about minimum compliance and little liability protection. And there are basic risk targets that are established, but those are really defined by those regulations and the governing bodies around them. But here's the problem: simply being compliant with those regulations doesn't actually make you secure. So these companies then, even though they're compliant with the regulations, they still get attacked, they still get impacted, and they're left often wondering why. Wait, you know, I, I shouldn't have been, you know, attacked because I was compliant. Well, that's such a low bar that getting past the, the security controls around compliance is pretty easy for attackers. So Organizations tend, when they're going down this road for the first time, they tend to put a non-security experienced executive or project manager, often reporting under legal or IT or some product team, in charge. And they simply don't have the experience. And their goals, again, are defined by let's just meet the minimum controls, or whatever looks to be meeting the minimum controls. And their goal is really just to establish those to satisfy regulatory requirements. And those requirements would probably also include some type of audit or certification, but again, it's probably less than basic. The actual security level is low, and unfortunately, again, it does result in breaches and compromises and impacts and losses. Organizations realize pretty quickly that they do need advanced security products, services, so that they can scale to address the rapidly evolving technical vulnerabilities, block basic attacks, and monitor for compromises. The good thing about this particular kickoff point, if you will, that many organizations go into is it's relatively low cost, and there are many vendors and products and, and guidance sources that can assist companies to meet those minimum regulatory requirements. But at the end of the day, because there aren't experienced people there, the organization won't really know the difference if the program is done well or not. They're looking for that binary answer, "Yes, we're compliant," and nobody really will care as long as it appears to meet regulatory standards. That's really the goal. Again, unsurprisingly, the overall security level for an organization that has this level of maturity is low. These organizations are still easy for targets to pursue and attack and expect that there will be a high degree of impact for successful attacks. And from a liability perspective, yes, you've met the, the regulatory requirements, so you have some protection overall. It's probably a moderate risk of liability. Because you're still going to see attacks, you're still going to see damage, you're still going to have customers' potential data exposed and have to deal with all that. There can still be lawsuits and all sorts of challenges, but this tends to be the entry point for many organizations. But then they move, they evolve on, and the next phase is really this— it's technical aptitude. Moving out of the first phase, they realize they need more technology, really from a scalability capability, and that's so that they can set risk targets based upon an organization's appetite. This is really expensive though when you're talking about the skills necessary and the technology necessary to establish a good technical defense. The leaders that they tend to bring in are pretty adept at applying a variety of different security solutions. They're technical in nature. These technical solutions can provide a myriad of prevention and detection functions, but again, budgets will soar and the complexity increases as technology has to constantly be maintained, monitored, and updated based based upon new threats. Eventually, the realization is that process is needed to make the tech more sustainable, more comprehensive, to drive consistency of security oversight and management throughout the organizations. Leaders, again, in this space that are brought in tend to be very technically savvy. In many cases, they can be a technologist, they can be an engineer, or a security architect that truly understands what the environment is from a technical perspective that needs to be protected, and the different technical solutions that you could bring in. But cybersecurity is more about more than just technology. It tends to be a combination of technology and processes and behaviors. So this only really covers one area. And the downside, again, to this is all that technology and all that expertise That costs a lot. So overall, moving from Phase 1 to Phase 2 here, the costs increase significantly. The talent, tools, and services are expensive, and they increase over time. And there are many vendors and products, and some less ethical than others, and they tend to be less effective than others, but they're willing to make a sale. So there's lots of different tools to play with., and technology to apply. The real key is to choose which one fits well. Now, the organization at this phase will have a much better understanding of the vulnerabilities in their environment and be able to greatly improve the posture against technical attacks. Overall risks and long-term sustainability will remain, well, it'll remain vague, as the sustainability of the comprehensiveness and consistency is weak without out properly supporting policies and processes. The overall security level here, we've moved up to a moderate. Interdicting those technical attacks, protecting and patching the, the environment, the operating environment, is hugely important. So that gives us a boost in the overall security level. From an attacker's perspective, this is kind of a moderate class target to go after. You know that they're gonna have some weaknesses, but in many cases they're gonna be mostly patched, so you're probably gonna go after the people versus the technology. Again, that the weakest link, or pursue the, the path of least resistance. There's a moderate degree of impact for successful attacks because again, at least the environment is resistant to lateral movement and, and a little bit better in detection and so forth. So that inhibits the, the growth and the impact of attacks that are successful. From a liability perspective, you're probably at a moderate to low risk. That can be justified because you're bringing in more sophisticated technical controls and putting them in place. So this actually is a good environment, and many, many medium and even large organizations They're here, and they're kind of stuck here for a little while until the forcing function of annual budgets that are increasing, you know, 15 to 20% year over year, and executives realize, wait, this, this, this isn't working. And the sustainability as the environment changes, it's just not there. It's not consistent, especially on the behavioral side. That tends to push organizations into the next phase, which is process proficiency. Now, this is where you are addressing that comprehensiveness and consistency because you have an ability to measure and maintain risk adherence over time. It does add cost and friction, but adding an element like a GRC team or an experienced cybersecurity professional that can oversee the regulatory technical solution, integration of corporate policies, good audits, employee training. Now you're talking about bringing that technical, behavioral, and processes in place to address the risks, which also satisfy the regulatory requirements. So this is pulling together everything that we've seen before and adding the process around it that gets integrated so that there is consistency over time, that there is handoff, there aren't single points of failure, there is clear responsibility. And with that, there can be clear goals. All that chaos is basically reined in because you do have that higher degree of predictable consistency based on those processes. But again, it adds more cost and more friction with users and customers and, and those who are managing the environment because, well, let's face it, People don't like reading and following policies, and it can get complex when you're integrating those policies into production environments and the process to build and maintain product solutions and your computing infrastructure. That slows things down, especially when you have those checkpoints and those reviews and those audits, and it can create friction. Now, even with this, this great cost increasing year Every year, really, incidents are still gonna occur. You're not impervious. Now you're in a better position. What really is needed moving forward is a more efficient and effective way to protect the organization that meets the expectations of the board, the C-suite, the employees, business partners, and customers. But in this phase, right, what we see are the costs go up because you're adding that process. But the benefit is better behavioral security aspects, which greatly reduce risk, and I mean greatly reduce risks, and more consistency over time for those controls and applicable, or, and how they're applied across the organization. And risks can now be managed in a strategic manner with the institution of proper metrics that look beyond just the technical risk vectors. So this expands what organizations can see and therefore manage. And policy and process oversight is— it requires additional resources. And again, as we talked about, it creates more friction for operations. But overall, the security at this level is now strong. Attackers will find difficulty in compromising these organizations, and only those with motivations that specifically target the organization will really be a serious concern. Low degree of impact would be expected as attacks are often reported and thwarted early in cooperation with security-savvy employees. And again, those robust processes come into place to be able to respond quickly, and it reduces those impacts even further. From a liability perspective, we're at an even lower risk because we're combining those technical, behavioral, and process controls that represent a pro and powerful combination to prevent and minimize loss. But again, the costs are high, and so is the friction that such an expansive system of controls introduces to potentially impact production schedules, consume critical resources including talent, and increase the support demands for oversight. That drives some organization into the fourth area, the fourth level of maturity, and that's strategic threat analysis. In this area, it's really about getting insights to predict and prioritize the most likely threats, and that drives efficiency and effectiveness. It allows agility and focus on the most important areas. It is proactive to deliver higher resource utilization and greater ability to protect and recover from the most likely attacks. This is pro level, where continuous evaluation of threats drive the proactive reorientation and investments of security resources. Now, to get here, a highly experienced and successful CISO really needs to lead and build this organization. It takes their knowledge and insights to create such a sustaining capability, and expectations in this area as well as goals are clearly defined with the board and the C-suite. Risk assessments look at the threats to determine the most likely targets, methods, and areas of unacceptable residual risk. You know, Frederick the Great said, "He who defends everything defends nothing." And when we look at some of the other phases, specifically in the technical phase, where the goal tends to be squash all vulnerabilities, protect everything, That's really what they're trying to do. They're trying to protect everything, and they're trying to do it equally. Well, Frederick the Great had it right. If you're not prioritizing, you're wasting your resources, and really you're not doing yourself justice. So this phase addresses that. Organizations in this area are able to allocate and prioritize their resources, making them highly effective and efficient. Now, the enemy here is characterized as part of this process. The most likely attacks are predicted and resources allocated for highly effective and efficient defense. Strategic planning allows for tuning of security to meet current and future risks while taking into consideration the tradeoffs of cost and friction. So this is where you have additional dials to turn to balance the risk, the cost, and the friction. And ultimately, we see that the most likely risks can be predicted and security controls allocated more efficiently to address them. The cost level really starts to either level off or decrease, while the risks are also lowered because they can be managed better according to the goals. Satisfaction for security tends to improve across the organization, from board to, to new hires, with clear executive goals and attainable objectives that are rationally tied to budget line items, and they're relevant for the different business groups within the organization. Well-defined, a communicated cybersecurity strategy that again shows the benefits to each business unit has the ability to gain unilateral support, and that's huge for a security organization, getting all of the different business units to get behind them, to understand the value, to be part of that discussion and help tune those dials so that they're bought in. This builds a strong culture of security-savvy employees. This can be fostered and empowered to do great things, not only to avoid issues and prevent them, but also detect and help respond to security incidents. That truly is— a security-savvy workforce is truly one of the most powerful tools any organization can have. Now, risks are easier to manage across third parties, customers, and other groups, especially when changes to the IT infrastructure occur, because again, you've got this bigger picture that ties everything before it into place. And the cybersecurity program can integrate these risks and expand the oversight to include company products and services, Traditionally, cybersecurity is really only looking at the infrastructure, but when you get to this level and the effectiveness, the efficiency, you can expand beyond that. And strong cybersecurity across the infrastructure and products is then well positioned to pursue opportunities to add to the company bottom line. And that's music to executives' ears because security can improve competitive advantages. It can raise ASP. It can drive upsell in product tiers. At this level, the overall security for an organization achieving this, it's superior. All but the most elite attackers would be discouraged in their attempts to compromise and cause significant harm or loss. Impacts of successful attacks tend to be quickly minimized and recovery is swift. It's in alignment with executive and board expectations. Now let me reiterate that. The executives and boards, because they understand those dials, they understand they're accepting a certain level of risk and certain bad things are going to happen. And when they have that expectation, when that does occur, it's not a catastrophe. It's something that the CISO has predicted. It's something that the organization has already accepted as part of their risk. And again, only until you get to this level and can have those conversations and can show that and have those discussions does everybody get on board. And there's a much higher degree of comfort and confidence in the security organization even when an incident occurs. In most cases where this is well implemented, The risks and costs of security go down, and that's key. It makes it financially sustainable. The overall impact and friction to the business, it's minimized. Uh, cybersecurity can be seen as a teamwork effort. It's not just one group, it's everyone's responsibilities. That makes a significant difference. Obviously, the fourth phase is the most desirable, but it's also the most difficult to achieve. Not many organizations have reached this level, with most stuck in phase 2 or 3. But as costs, attacks, the friction rises, there becomes a need for a better cybersecurity capability. And I cannot emphasize this enough, the need for top-tier CISOs to successfully achieve this level of proficiency is huge. It requires def leadership, great depth of cybersecurity risks, technologies, and processes, as well as a superior level of communication and even a little bit of luck. The work necessitates precision in a world of ambiguity. It is possible, and when done well, becomes a living per— work of risk management art, which wisely benefits and balances the risks, costs, and friction of cybersecurity. As the world rushes, in some cases haphazardly, to embrace and rely upon the powerful and wonderful benefits of digital technology, we must have an equally adept level of capabilities to protect them from growing cyber risks. So let me know what you think, and if you admire a particular organization that, that has achieved the highest phase of maturity. Please click the like button below if you found this insightful, and subscribe to the Cybersecurity Insights channel for more best practices, rants, and strategic viewpoints.