When I or my team members meet with CISOs, sometimes we need a simple set of questions to assess how they’re doing in security. I worked with a bunch of our experts here to get to a core group, and thought I’d share.
Ones that get the CISO really to think: am I secure? We organized these along the dimensions of People, Data, Applications and Infrastructure. Why? Cause if you think about People, the Data they Access, the Applications they use and the Gear they’re on (Infrastructure) then you have a decently holistic view of their security posture.
Key Questions To Ask Your Chief Security Officer
So here are some key questions I’ve been asking our customers to assess where they stand, they’ve gone over very well!
People
|
1.To what extent have you rolled out an identity program?
2. How do you know what authorized users are doing?
3.What is your plan to automate identity and role-based management? |
Cross Domain
1.What is your plan to assess your security risks?
2.How do you detect threats and report compliance across domains?
3.Do you have a log retention and audit capability?
4.Which processes do you use to handle incident response and disaster recovery?
5.How do you involve key internal and external stakeholders in security matters?
|
Data
|
1.In what ways have you classified and encrypted sensitive data?
2.How do you know if sensitive data leaves your network?
3.How do you monitor (privileged) access to data? |
Applications
|
1.How secure is your application development process?
2.How do you regularly test your website for vulnerabilities?
3.What is your approach to test legacy applications for potential exposures? |
Infrastructure
|
1.How do you promptly patch connected devices?
2.In what ways do you monitor in- and out-bound network traffic?
3.How are you building security into new initiatives (such as cloud, mobile and the like)? |
Scroll to view full table
What do you think? Are there any key questions missing?
General Manager, IBM Security