Planning as a flow
Lean thinking comes from manufacturing, and Agile from software development. Both have proved useful in security, because they ask a question security programs rarely ask: of all the effort that goes into this process, how much produces value?
Looking at cyber risk management as a flow of work shows where it is slow, and also why.
The five wastes
- Waiting. The security team waits for resource teams to complete assessments, and resource teams wait for recommendations.
- Overprocessing. Data is collected that nobody can act on.
- Defects. Controls are implemented without a shared understanding of the business need, and the work has to be redone.
- Transportation. Information goes back and forth between teams. A provider of shared services answers the same question separately for every team that asks.
- Knowledge. Security expertise stays with the security team, and business context stays with the resource teams.
Five practices that remove them
- Cross-functional collaboration. Security specialists and resource owners work together, with a shared understanding and joint ownership of the outcome.
- Value stream optimization. The goal is a better security posture, and a completed assessment is only a step toward it.
- Continuous feedback loops. Ongoing dialogue and small improvements replace infrequent, heavy assessments.
- Just-in-time knowledge. Security expertise is delivered at the moment a decision is made.
- Empowered teams. Teams have the authority, tools and knowledge to make security decisions for their own resources.
What the security office gains
Moving tactical work to resource teams frees the security office from much of it. The office can spend its time on strategic work that raises the whole program, and resource teams gain ownership of the security of what they run.
Agile and lean design is one of the five principles of participation. The Five Principles of Participation sets it beside the other four.