I had a little back and forth with rybolov in the comments on my military post, and he introduced me to something called the Business Reference Model right out of some government publications and NIST 800-60.
Kicking ass, as only a Guerilla CISO can, he responded with two great blog posts showing how we can steal from this model and adapt it to the enterprise world. On the surface (haven’t had time to dig in yet) it looks like an interesting way to help align business priorities, data classification, and security priorities. While I’m not a fan of complex models, I’m a big fan of anything that can help bridge the language divide between the business and IT.
Reader interactions
One Reply to “Tying Security To The Business: Guerilla CISO Style”
Hi Rich
It’s a little complex the first time you use it, but then it gets fast. Thing is, most people never see how to use the BRM and 800-60 because it’s done for them by their CISO and spoon-fed to them in baseline security controls which is the subject of a continuation post from me coming out tomorrow morning.