How to construct an effective security controls evaluation | TechTarget
I once received an ad from a company that promised to lower home energy costs by conducting a free energy audit. The audit, it said, could be done over the phone -- no home visit -- and would require absolutely "zero questions asked" -- i.e., about our current energy use, heating and cooling systems, insulation or anything else.
It struck me as objectively ridiculous. How can you reach a fact-based, evidence-driven conclusion without at least measuring something?
I bring this up because I see CISOs promising something similar with their security strategies. Namely, they say they can manage their security controls in the absence of important contextual knowledge, without information about control efficacy -- let alone efficiency -- and, in some cases, without any operational performance data at all. Yet, just like the information-free "energy audit," this approach undermines decision-making. Missing information means we pay more for an outcome...
Copyright of this story solely belongs to techtarget.com. To see the full text click HERE
