Who Will Dominate the Future of Assessments? Security Experts or Business Risk Advisors?
Scope (what’s covered) has everything to do with differentiating the Security Assessment Sale.
In case you missed Part I , Read it Here:
The One Thing That Set My Client’s Assessment Apart From 13 Competitive Quotes
I’ve been writing a series of articles on risk assessments over the past couple of months. If you’re in the security business (or trying to break in on this growing cash cow) it’s time to get on board with how assessments work; how they’re sold, what they’re for, how to get them read, and how to make them work for you inside the accounts you sell to.
In Part I, I covered Differentiating Yourself in the Sales Call. (Note: if you’re looking for a technical read, this is not it…
So, next, let’s turn to the scope, and how what you cover in your engagement has a lot to do with who buys it and who reads it.
If you want to grow your business, keep reading – the assessment is the best way (and one of the only ways) to get engaged with decision makers (the people writing the checks).
Your Client Is Wrong About Scope 97% Of The Time
I hear it all the time, “The client is always right.” No they’re not!!! Especially when it comes to security.
Remember (See my book, The House & The Cloud) your IT contacts are not liable. And your asset-owner contacts (who are liable) have very little understanding when it comes to security.
So don’t let the client dictate the scope.
In short, you can’t simply respond to an RFP and come up with a meaningful assessment project (I discuss RFP responses in detail in my book, From Vendor to Adviser).
Getting The Scope Right
When I bring up, Assessment. The first question I get is, which tools (scanners) do you recommend? I’ll cover the actual assessment process in a future article. But for now, set tools/scanners, etc. aside. There’s something far more important here to consider…
The typical approach to assessing risk is, Inside/Outside. But looking inside (trusted), and then out, is wrong thinking…
The truth is, your client doesn’t have and inside or outside anymore. Sure, your dream client has a perimeter, but half the office is on the road or working at home. They’re all outside on their mobile devices. Chances are these knowledge workers are going back and forth between personal (Facebook and shopping) and business, and on breaks their kids are playing Counter Strike or World of Warcraft (or surfing porn and gambling sites).
(And then there’s the 75% of employees who admit they steal from their employers – all inside…WSJ)
Wrong Thinking
Every paid assessment should cover perimeter devices, end nodes, and network architecture/segmentation & configuration. The obvious, so I won’t elaborate.
Yet, when I read a scope document, and it breaks the assessment down into: Internal, External, Network, Perimeter, and Servers/Storage…I get concerned.
This infrastructure-centric approach is for the super-techies, not business leaders.
I can already imagine the deliverable with it’s endless tables and network diagrams. The Red, Yellow, Green light ratings that appear on every assessment. If you’re looking to differentiate yourself, this won’t do it.
Price will be the deciding factor!!!
Rethinking Your Scope – Make It Attractive to Business Leaders
The business people (Asset Owners) are the ones who will be writing this check. So, what is it they need? In my book, The House & The Cloud I spell out exactly what the board is looking for (see page 195). It’s restated in Selling Assessments Part I.
This type of deliverable requires a different approach. The final outcome is a measure of risk (illustrated in the Impact vs. Likelihood Chart). 
START HERE – DIGITAL ASSETS: Think like a Disaster Recovery Specialist…
Where is the data? Which of these assets are most important, and what can’t they do without?
It’s a fact that most companies have no idea where their data actually is, or who has access to it. When people travel, work from home, or use cloud apps, knowing gets even harder. Ad-hoc data is everywhere.
Tools such as those provided by RiskIQ are designed to find data. In some cases that data is sitting on someone else’s server (such as a competitor or in a darknet chat room, for sale).
Digital assets, not hardware infrastructure, is what assessing risk is all about. So Consider the following:
ACCESS CONTROL – ACCESS TO DIGITAL ASSETS: People(and now robots) access data. Behind every data breach is a person. Some people have access, so they’re authorized. But not all authorized people are doing things they’re authorized to do.
Does your assessment include the people inside the organization? It should. Remember, “75% of internal workers admit they steel from their employer (as referenced earlier)”.
PEOPLE: Given all that’s just been said, be sure to include interviews (more details on this in my book, The House & The Cloud pg. 196).
DATA ASSET TRANSMISSION & STORAGE: Once you know where the data is, you want to know who accesses it, from where, when, and why. Data transmission and storage is part of a company’s workflow. So include in your scope, an analysis of assets as follows:
- Creation: Understanding who is creating assets, when, and where is important. Most end-users don’t see their data as valuable or desirable outside their department or work function (this is true even when it comes to medical data). More importantly, they fail to realize how much data they are actually creating, and how data aggregation and deep machine learning can extrapolate and derive all kinds of intelligence from their daily activities.
- Application: Data is then used by various applications, requiring transmission between applications, people, cloud services, etc. Are these application secure? Who has access, and who controls that data when applications are hosted in another country?
- Transmission: This includes all network, wireless (including bluetooth, etc.). Looking at transmission has to do with traffic and protocols. So include traffic analysis – what protocols are found? (e.g. Does IRC Chat traffic belong on this network? Probably not. Did you look for it?).
- Storage: All data gets stored at some point – even if it’s just in memory. Did you know copy machines store images of everything (and then those leased machines get placed in new businesses as your client upgrades)? And then there’s personal devices, personal email accounts, and the list goes on…are these considered part of the scope?
- Archival: Data retention policies are key here. Is this data encrypted and does it get deleted at some point (according to policy)? A subpoena at the wrong time, right after an unscheduled deletion, could raise some eyebrows. Are cloud service providers storing this data locally, or is it international – under some other country’s privacy laws? Who owns that data? What if the cloud provider goes out of business or is acquired?
- Destruction: Then there’s data disposal. Do the end-users understand the difference between hitting the delete key and deleting a file? In most cases, no!
TRUE SECURITY (ALL THREE ASPECTS): Security can be looked at several ways. The CISSP ISC2.ORG common body of knowledge looks at 7 (and this varies over time) major disciplines. Most security professionals recognized three pillars:
- Confidentiality
- Integrity
- Availability
All three should be considered in the scope. I’ll provide more detail on approach in a future writing…but be sure to cover all three.
SOCIAL ENGINEERING: Social engineering is part of just about every cybercrime incident (probably all of them). However, it’s rarely part of the assessment. Again, go back to the purpose – identifying risk. The amount of risk a company has, has a lot to do with how susceptible it’s end-users are to a ruse.
Testing them is one way to uncover weaknesses – such as an email phishing test. In any case, some thought should be given to their current security awareness program, policy (covered below), and security culture.
POLICY: I’ve heard security experts say, all security breaches are the result of some policy not being followed, or not existing. I don’t know if that’s always true, but it does carry some weight.
Most policies are written to satisfy some compliance officer, not guide the daily activities of end-users, who create, use, and store digital assets all day long. Include a review, not only of the written policy, but how it’s used and enforced.
WHAT ABOUT AUDITS: This is not an audit, so don’t treat it like one. Audits are about being compliant (get your compliance offering going with HIPAA here) against some standard or law. They don’t measure risk.
So take time to educate your buyer on the difference. The goal should be to comply with the law, and then make sure things are secure. One does not satisfy the other.
Reference an Approach (NIST)
Finally, security can be differently by different people, so just what does it mean to be secure? Or to assess risk?
Having certifications such as the CISSP (ISC2.ORG) or GIAC (SANS.ORG) can go a long way in proving to your buyer that you understand security.
Security engineers are not required to have their PE or Engineering Certificate, or be authorized by a board in the way doctors or lawyers are. While I am not in favor of more big government oversight (like what we’re seeing in the ever-frustrating world of healthcare), pointing to a standard or framework (such as NIST) is powerful when selling.
Most sales people (your competition) are not going to be able to articulate what standards/frameworks (such as NIST) mean. So take some time and educate yourself on what I call, The Wall Street Journal Version of NIST (or whatever standard your firm will follow.) You can check out my recent article on Understanding NIST here. (CLICK).
And the Winner Is…
Do you want to win your next sales opportunity????
Assessments open doors and allow you to prove your value…however,…
Assessing Risk is a business function. Like Disaster Recovery/ Business Impact Analysis (which are really just one of the security disciplines) it is the executive team that needs an understanding of their exposure and impact/likelihood…the odds they’ll suffer a loss.
And this explains why high-end consulting firms like PwC and KPMG have long been welcomed in the board room, while resellers and most hardware manufactures continue to hit the down button when getting on the elevator.
© 2017, David Stelzl
P.S. Get the entire security sales approach here (The House & The Cloud) – the only book out there with a clear methodology for selling high-margin security business.
What’s The Point of Your Security Assessment?
Three Things You Can Do To Earn A Seat At The Table
