10 best practices for bolstering security and increasing ROI

There is nothing easy about government security operations. Most chief information security officers struggle with countless manual processes, numerous disconnected tools and a shortage of properly trained talent. However, the increasing number of widely publicized breaches, the growing complexity of regulations pertaining to the protection of personal data and the uptick in ransomware attacks have made agencies' top executives acutely aware of the dangers posed by inadequate security.

As a result, those executives have become more willing to approve spending on security operations -- but the increased spending has often not provided the type of returns that agency leaders and financial officers expected. So now CISOs are being asked to provide proof that the money spent -- or that they are asking to be spent -- will lead to greater effectiveness, more efficient operations or better results when the agency is attacked. 

If calculating the return on security investments could mirror predicted ROI for return on a new piece of equipment, the task would be simpler. However, security operations represent both tangible and intangible benefits, complicating the issue. For example, if the goal is to determine whether automation improves incident response, it is relatively easy to measure the ROI in terms of wages. It is less straightforward to quantify the benefits of lowering employee turnover, boosting worker productivity or reducing the stress levels of security analysts. Assigning a dollar value to an agency's reputation can be tricky as well.

Fortunately, when it comes to enhancing security operations while also increasing ROI, there are some steps that CISOs can take to achieve their goals. Consider following these 10 best practices:

1. Articulate the purpose. It is important to clearly spell out the purpose of the security investment, providing a well-defined analysis of what will be accomplished and why the activities are important. This helps decision-makers discern whether the proposed initiative will be worth the money, time and effort. Securing the support of non-technical C-suite executives by clearly articulating the initiative's goals can help ensure success.

2. Dovetail with other projects. Look for opportunities to enhance security operations as an add-on to other projects. For example, if the IT department plans to upgrade the network to support VoIP, see if upgrading the security network could be performed as an add-on to the IT project. This reduces the cost -- compared to having two separate projects -- and increases the ROI on both projects. Naturally, security risks may make it impossible to delay a project, but unless the need is immediate, incremental additions to other planned projects are often feasible.

3. Automate and orchestrate. Strive for security orchestration and process automation. The current threat landscape is vast, complex and constantly changing. Even a well-staffed security operations center cannot keep pace with the volume of alerts, especially with the ever-increasing number of duplicates and false positives. Use automation for threat hunting, investigations and other repetitive tasks that consume too much of analysts' time.

4. Create an integration plan. Build a security operations and analytics performance architecture (SOAPA) integration plan. Consolidate security technologies, reduce the number of vendors and build a platform that unifies the tools for detection and response across a common architecture.

5. IT and security synergy. Tear down the walls between IT and security operations. Too often, IT and security teams pursue different goals and use diverse tools to fulfill their missions. Improve collaborative efforts -- such as using SOAPA -- to enable data sharing, task prioritization and process automation.

6. Leverage analytics. Adopt advanced analytics. Machine learning and artificial intelligence are delivering truly innovative solutions. CISOs should research these two fields carefully to determine which analytics tools best fit their agencies, taking into account the organization's strengths and weaknesses related to skills, personnel and risks.

7. Start small. Be willing to take small steps when necessary. Instead of insisting on an all-or-nothing approach, consider pilot projects to prove the benefits and costs associated with an initiative. 

8. Go beyond compliance. Articulate the difference between compliance and security. Too many CEOs and other decision-makers believe their organization is secure if it complies with existing regulations. However, regulations change frequently to react to new threats. When new guidance is written, it may be several months before organizations must comply with them. In the meantime, organizations can be in full compliance, but they can still be vulnerable to attacks.

9. Shoot straight. Honesty is always the best policy. CISOs who oversell a new technology and then discover that it is more expensive and less effective than expected risk having their credibility challenged in the future. 

10. Measure and course-correct. Make sure to put the right metrics in place to measure progress. Based on data collected, periodically make changes to the strategy or continue on the course. This will create a feedback loop for all cybersecurity strategies.

In today's world, implementing security initiatives is often tough. Justifying these initiatives in terms of dollars and cents can be just as challenging. However, by following the above top best practices, CISOs can make significant progress toward fulfilling their goals for security operations.