What (Actually, Measurably) Makes a Security Program More Successful?
summary
Survey of 4,800 respondents (analyzed down to ~150 qualified responses) uses multivariate statistics to link 25 practices to 11 measurable outcomes. Top correlates with overall success are proactive tech refresh and a well-integrated tech stack; detection, timely incident response and prompt disaster recovery also show strong effects. Preventive/protect controls are less predictive than detect/respond/recover. Effects vary by size and industry; an interactive Security Outcomes Matrix shows which practices move which outcomes.
AI-written summary · about
chapters (9)
- 0:00Intro
- 1:29What Makes a Successful Security Program?
- 2:19Security Outcomes: What does "success" look like?
- 4:24Outcomes Matrix: Effect of various security practices on outcomes
- 5:21RSAConference2021
- 8:36Wait a sec - Did Cisco influence these findings?
- 9:43Options for achieving a modern, integrated tech stack
- 12:08NIST Cyber Security Framework
- 17:25Success factors evolve as the business grows
related talks
46mWhat (Actually, Specifically) Makes Security Programs EVEN MORE Successful?
01h 00mImproving the Chances of Success in Secure Software Development
53mMetrics that Matter.Confidence & Resilience in Your Security Program
59mKeynote: Measure Security Effectively
53mOver a Decade of Software Security: What Have We Learned
39mProactive Security, less buzzword, more action
30mCybersecurity Silver Linings
35mMetrics That Matter: How to Choose Cloud Security KPIs for Your Business