Cyber Security Operating Models and Cyber Effectiveness

Cyber Security Operating Models and Cyber Effectiveness.

Operating Models for Cyber Security

An operating model involves all the resources available to an organization to operate: it is used to express how companies deliver value to stakeholders and customers, it beneficiaries, and how organizations are structured to operate day-to-day.

As such, operating models are an expression of the effectiveness and efficiency of the use and allocation of resources to achieve stated aims and objectives.

When it comes to cyber security the common aims and objectives often include:

  • Keeping the name of the CEO and the company out of the limelight for having been 'compromised'
  • Staying ahead of the attacks and vulnerabilities to achieve the above
  • Engaging risk-appropriate controls to accelerate digital transformation projects

These are a few of the common objectives for cyber security.

Others are those normally associated with its measures, such as rates of patches applied, numbers of data loss/compromise events, and number of unresolved cyber event sequences among others.

Cyber Effectiveness

Much like any other business function, cyber security has objectives that are measured using metrics that are sometimes confused with Key Performance Indicators (KPIs) to assess whether objectives are achieved or not.

There is some very interesting data we will be publishing, and some very interesting stories about KPIs, cyber security, cyber effectiveness that will be revealed and told on another day.

But for today, the focus is the shape of operating models for cyber security.

Cyber Security's Operating Models

There are just three basic cyber security operating models, all three of which are aligned by outcomes, and each of which has measurably unique differences from the other.

We've named the three operating models after where cyber efforts and operations are predominantly focused in organizations, as follows:

  • The Eco Stack Defense (ESD) operating model
  • The Cyber Domain Automation (CDA) operating model
  • The Operational Data Intelligence (ODI) operating model

We will be explaining these three models in upcoming research publications.

Cyber Effectiveness and Operating Models

Across these three very different operating models for cyber the outcomes - the measures and metrics - of cyber security performance are truly very different.

We've noticed over the years a consistency to cyber effectiveness - as measured by core cyber security outcomes - with some organizations experiencing consistently better outcomes, some consistently poorer results, and most organizations operating between these two polar opposite experiences.

An effective cyber security operating model should at a minimum keep the name of the CEO and the organization out of the press and social networks. But it should go beyond that to optimize the allocation and use of resources in managing cyber-related business risks from the uses of digital.

Upcoming Research: Cyber Operating Models, Cyber Effectiveness, and Cyber Spend

We will be revealing some of the data from our research to shine a light on differences between operating models, cyber effectiveness and cyber spend in the coming months to providing insight into decision-making about Cyber.

In addition, we will be focusing on some of the notable differences in practices that are aligned by outcomes across the organizations - and that are linked to the cyber operating models employed - including:

  • Organizational structure and strategy
  • Cyber spend, spend allocations and budget centers
  • Operating responsibilities and decision-making
  • Risk management objectives and processes
  • Talent and talent management
  • Sourcing, vendor and third-party management
  • Security architectures and force multipliers
  • Controls automation tools

This is but some of the upcoming coverage planned for the coming year that will illustrate the interrelationships between cyber security operating models, cyber effectiveness, cyber spend and spend allocation.

We hope to provide illumination for your path and journey toward becoming more effective.

Related research

2018 Cyber Security Spend Report

Broad Spectrum Security Force Multipliers and Market Adoption

Bots Change Security

Featured Research

2018 Cyber Security Spend Report

The 2018 Cyber Security Spend Report focuses on global spend today through the coming five years. Did you know that global spend on cyber security is: More than $103 billion today Will exceed $130 billion by or before 2022 Today’s top two spend categories account for almost 50 percent of spend by enterprises today. The

Innovative Digital Business Models

Is your company making money using some of the innovative digital business models of the future, today? If not, it is important to understand what some of the new digital business models are, what they are best used for, who should consider using them, why they are important, and when they should be used. Not