2012 Security Resolutions

[#1]

1) Step Up Your Risk Management Game

Go beyond the 'find and fix' mentality and begin to measure and manage by counting what matters. Work with other groups towards mutual goals and to share results both good and bad.

Finally, use metrics as a weapon of mass budget allocation and a tool to move budget dollars to where they're needed most.

- Tim Erlin, Director of Product Management

2) Understand IPv6 and All its Security Implications

We've all been avoiding the implications of IPv6 because haven't really needed it, but now we do. Set aside some time to really understand IPv6 because the impact on security is enormous and it's not something that can be integrated in a rush.

Become knowledgeable enough be to explain IPv6 security issues to upper management so you are prepared to fight for the necessary budget allocation before IPv6 issues become an emergency.

- Andrew Storms, Director of Security Operations

3) Start Thinking Like a Cyber Criminal

Imagine you were part of an organized crime unit, and your criminal organization has targeted your company for a cyber attack. What information would you try to steal? What information could be used to make money?

This mental exercise can help you defend your network and your data. Use the same thought process to evaluate cyber attacks originating from nation states and 'hactivists' because each of these groups may target different kinds of information for different reasons.

Understand each group and the data that could be valuable to them so you can make it more difficult for them to carry out any of their strategies on your network

- Tim 'TK' Keanini, CTO

4) Move Toward Continuous Monitoring of Security and Compliance Controls

Security is a business process that should be maturing in all organizations and 2012 is the time to move closer to a continuous view of your security and compliance controls. Maximize your use of automation and technology in 2012 to provide reports and alerts for material deviations from internal policies, provide baseline measurements and goals, and reduce hands-on intervention in routine security processes.

Security talent is a scare resource. Take advantage of the talent you have by having them focus on real risks. Automation can also provide excellent data that compares the performance of your security initiatives to your peers.

- Elizabeth Ireland, VP Marketing