In Tripwire’s recent survey of IT professionals and executives, respondents reported high confidence in both the value and the application of basic, foundational security controls—accurate and complete hardware and software inventory, system hardening through secure configurations and patch and vulnerability management—in their enterprises.
From the perspective of the Council on CyberSecurity, this is excellent news!
First of all, this result is very consistent with the ongoing message of the Council and the Top 20 Critical Security Controls. The “basics” really matter because they provide great cyber-defense value in terms of stopping the kinds of attacks seen today.
The value of foundation controls is established by any large-scale analysis (private sector or government) of cyber incidents – the vast majority of cyber problems seen today result from basic flaws in management, configuration, processes and “hygiene..
Secondly, the survey results hints at better agreement between what security and IT professionals see as valuable, as well as what corporate executives see. When these views get out of alignment, we see unfocused security programs, poor communications between executives and technologists, massive waste of resources and energy, and tension between operations and security professionals.
At the Council on CyberSecurity, we strongly believe that improving this ecosystem alignment is essential to scalable enterprise security.
Even better, when basic security controls are well planned, they are specific, implementable, automatable, track-able and reportable. And they can come with significant management and operational benefits, including better visibility and management of resources and lowered costs, such as minimizing ‘breakage and lower recovery times, etc.
Of course, “foundational” controls are just that – foundational and necessary to cyber success, but not complete.
There is still plenty of work to be done even if you have an effective, ongoing program of basic security controls. But in our experience, you must get a solid security foundation in place, or you will waste much of your money, technology and – worst of all – the time and energy of your people.