Big design up front
Traditional security planning resembles what software developers call big design up front: the attempt to map out every detail before work begins.
In security it has the same effects it has in software. It creates delays and bottlenecks, and it leaves blind spots, because the organization waits until it believes the picture is complete while its risks go unaddressed. Plans produced this way commonly take sixteen hours or more from each of several people.
Planning just in time
Agile thinking offers the alternative. A resource team produces a meaningful plan in about an hour, with what it knows now, and improves it as it learns more.
What makes an hour enough
- A narrowed starting point. A QuickPlan focuses the work on what the organization has chosen to prioritize, so the team does not face the whole model at once.
- Controls that already exist. What shared services provide is brought in, so the team does not document it again.
- Plain questions. The team answers questions about its own resource in everyday language.
- Risks suggested and ranked. Relevant risks and mitigations are proposed in order of impact, likelihood and exposure, and the team chooses among them.
- A plan assembled automatically. The plan is generated from the control inventory and the risks the team selected.
What a QuickPlan is
A QuickPlan is a workflow configuration. By default, a team would work through the organization's whole security model: every combination of impact, threat and vulnerability. A QuickPlan narrows that, and tailors the whole experience to a priority the organization has set.
A common first QuickPlan focuses on the organization's own cybersecurity policy. It gets breadth of coverage quickly. From there the organization iterates, in the Agile manner, and widens the scope as the practice matures.
Why it is not a shortcut
A plan built in an hour records what is currently known about a resource, including what is missing. It is more honest than a plan that claims to be complete, and more usable, because the next actions are plain.
The greater risk to security is the plan that is never started.
It grows
The first plan is a foundation. Each reassessment adds to it, and over time the plans become the organization's memory of how its resources are protected.
Five Kinds of Waste in Security Planning looks at where the other fifteen hours went.