October 29, 2014 By Lisa Chavez 3 min read

Your chief information security officer (CISO) just decided your company needs the latest and greatest security tools for patching, checking system health and advanced threat protection. The target date for completion? Yesterday. However, it has been several years since you’ve had to manage a tools rollout. Your company needs to deploy a new security tool. Where do you start? The following is a list of activities to consider when planning your security intelligence tool deployment:

1. Know Who Your Stakeholders Are

Identify the senior management stakeholders who are representing users of the tool and obtain their commitment to supporting its successful deployment and adoption. Without their support, it is often difficult to obtain staff members and prioritize their work to complete the required tasks. It can also be a challenge to persuade people to use the tool. It is important to obtain formal, written signoff from stakeholders indicating they agree with the results for all tasks.

2. Perform a Thorough Evaluation of the Tool

Insist that you be given the time and resources for a hands-on evaluation of the product. You need to assess how it will perform and scale in your environment and whether it will support your business processes. If possible, perform a pilot with real users. Pay close attention to the reporting capabilities and determine whether the default reports are sufficient or can be easily enhanced.

3. Disclose the Power of the Tool and Discuss Any Associated Risk

Document and communicate the level of access the tool allows its administrators to have on managed systems. Many security tools have agent software that runs with “root” or “administrator” access, which allows application administrators to have an elevated level of access.

4. Define the Device Types in the Scope of Your Deployment

Document what is in and out of scope, including specific device types, operating systems, application names, network devices and backup systems. Be sure to include details such as the types of hardware models and software versions.

5. Create a High-Level Plan

Create a list of project milestones, the staff needed and the estimated costs. Make sure the stakeholders agree to support the plan and that funding and staff are available before you proceed.

6. Agree on Exit Criteria

Exit criteria are a list of functions that must be enabled, activities that must be completed and requirements that must be satisfied before the tool rollout can be declared complete. They demonstrate that the tool is in a deployed state that meets business requirements. Be sure that the criteria are specific, including factors such as the percentage of devices to which tool agents are deployed, the list of security rules configured and the names of reports being produced.

7. Create a Formal Project Plan With Dates

Develop separate plans for each tool and type of device. Clearly distinguish between server, desktop, network and mobile, and ensure distinct projects are run for each. If you try to commingle the projects, the plan will become very complicated, especially when specific tasks that are applicable to each type of tool or device are discovered.

8. Assign and Commit Resources

Make sure people are available and committed to do the work and that any required equipment, physical space or other resources have been procured and are ready for production.

9. Determine the Baseline for the Device Inventory

Create an inventory of all devices in scope, and don’t deviate from this during the deployment. If you must deviate due to the installation of new devices — or the removal of old ones — use a formal change management process to update the inventory list. This list is extremely important when determining whether the exit criteria have been met for the project, so manage and control changes carefully.

10. Begin the Security Intelligence Rollout

Deploy the solution to any test and development systems first. Then, go from the least to most critical production devices. Address any issues promptly and formally adjust and communicate any changes to the plan that are needed.

I hope this post has helped you plan for your next tools rollout. Please tweet me @LisaChavez111 if you have any suggestions on how to make this security intelligence process easier for others.

More from Intelligence & Analytics

X-Force Threat Intelligence Index 2024 reveals stolen credentials as top risk, with AI attacks on the horizon

4 min read - Every year, IBM X-Force analysts assess the data collected across all our security disciplines to create the IBM X-Force Threat Intelligence Index, our annual report that plots changes in the cyber threat landscape to reveal trends and help clients proactively put security measures in place. Among the many noteworthy findings in the 2024 edition of the X-Force report, three major trends stand out that we’re advising security professionals and CISOs to observe: A sharp increase in abuse of valid accounts…

Web injections are back on the rise: 40+ banks affected by new malware campaign

8 min read - Web injections, a favored technique employed by various banking trojans, have been a persistent threat in the realm of cyberattacks. These malicious injections enable cyber criminals to manipulate data exchanges between users and web browsers, potentially compromising sensitive information. In March 2023, security researchers at IBM Security Trusteer uncovered a new malware campaign using JavaScript web injections. This new campaign is widespread and particularly evasive, with historical indicators of compromise (IOCs) suggesting a possible connection to DanaBot — although we…

Accelerating security outcomes with a cloud-native SIEM

5 min read - As organizations modernize their IT infrastructure and increase adoption of cloud services, security teams face new challenges in terms of staffing, budgets and technologies. To keep pace, security programs must evolve to secure modern IT environments against fast-evolving threats with constrained resources. This will require rethinking traditional security strategies and focusing investments on capabilities like cloud security, AI-powered defense and skills development. The path forward calls on security teams to be agile, innovative and strategic amidst the changes in technology…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today