For context, I am a one person security team as a ISM. Other IT departments are Network, Systems, and Customer service that are under a completely different direction. There has a small about of push-back when I speak on access management roles/responsibilities and separation of duties. What are some opinions on what is the best take on access management ownership with AD and Entra ID, and other services?
If you are having resistance about it, I think the first step is to engage higher organization levels showing evolved risks. If you get green sign of them next steps are: 1) training teams about security and risks; 2) review organization's security policy; 2.1) maybe create a standard about IAM's administration; 3) implement IAM policy
There is no formula about which team should do what, each organizations has its own way of working. It isn't a question of organizational chart, it's a question of resposibility. The most important thing is to ensure teams are aware of the their roles in the security implications.
For 1-10-60 Response Time Framework by Crowdstrike, is there a document that I can reference? How are the incidents tracked? Is it using the mean value of all the incidents (MTTD, MTTI and MTTR) or each incident needs to comply to 1-10 and 60?
What are the key steps to transition a Chief Information Security Officer (CISO) into a Business Information Security Officer (BISO) role while preserving advisory responsibilities and avoiding being treated as a PMO?
What’s the top cybersecurity challenge concerning your organization right now?
We would like to know what is the best advanced threat detection / prevention security control that provides the most bang for buck for a large organisation that wants to enhance its security posture to better detect and mitigate advanced threat actors.
Main goals are to reduce dwell time, enrich alerts, reduce SOC engineer incident response time, illicit targeted threat intelligence to compliment 3rd party Threat Intelligence providers
If you are having resistance about it, I think the first step is to engage higher organization levels showing evolved risks. If you get green sign of them next steps are:
1) training teams about security and risks;
2) review organization's security policy;
2.1) maybe create a standard about IAM's administration;
3) implement IAM policy
There is no formula about which team should do what, each organizations has its own way of working. It isn't a question of organizational chart, it's a question of resposibility. The most important thing is to ensure teams are aware of the their roles in the security implications.