"Security Management" "Maturity" "Model"
A few days ago I twitted this picture:
![RSA model for security management "maturity"](https://ithipster.com/uploads/images/00/00/06/2017/03/01/99b3cd.jpg "RSA model for security management "maturity"")
with a comment: guess what's wrong with this picture (hint: EVERYTHING).
Not everyone got the joke, so I think it deserves an explanation (sorry).
At a first glance it makes some sense and reflects quite common real world situation: first you start with some «one size fits all» «common sense» security (antivirus, firewall, vulnerability scanner, whatever). Then you get requirements (mostly compliance driven), then you do risk analysis and then voila, you get really good and start talking business objectives. Right?
Wrong.
It is a maturity level model. Which means a each level is a foundation for the next one and cannot be skipped. Does it work this way? No.
Actually you do some business driven decisions all the time from the very beginning. It is not a result, it is a foundation. You may do it an inefficient way, but you still do. With risk analysis. It may be ad hoc, again, depending on the size of your business and your insight into how things work, but from some mid-sized level you simply cannot stick to «checkbox mentality», you need to prioritize. Then you come with checklists and compliance requirements as part of your business risks.
The picture is all upside-down and plain wrong. I understand they need to sell RSA Archer at some point there and that's why they see it this way, but it does not constitute an excuse for inverting reality.
with a comment: guess what's wrong with this picture (hint: EVERYTHING).
Not everyone got the joke, so I think it deserves an explanation (sorry).
At a first glance it makes some sense and reflects quite common real world situation: first you start with some «one size fits all» «common sense» security (antivirus, firewall, vulnerability scanner, whatever). Then you get requirements (mostly compliance driven), then you do risk analysis and then voila, you get really good and start talking business objectives. Right?
Wrong.
It is a maturity level model. Which means a each level is a foundation for the next one and cannot be skipped. Does it work this way? No.
Actually you do some business driven decisions all the time from the very beginning. It is not a result, it is a foundation. You may do it an inefficient way, but you still do. With risk analysis. It may be ad hoc, again, depending on the size of your business and your insight into how things work, but from some mid-sized level you simply cannot stick to «checkbox mentality», you need to prioritize. Then you come with checklists and compliance requirements as part of your business risks.
The picture is all upside-down and plain wrong. I understand they need to sell RSA Archer at some point there and that's why they see it this way, but it does not constitute an excuse for inverting reality.
0 comments