TMC's Advisor

The Advisor is published by TMC

Defensible Security

No one can afford perfect cyber-security protection – it gets ever more expensive to increase your level of protection. So what is the right balance between protection and cost? The province of British Columbia has answered this question with their Defensible Security Framework, a set of guidelines and tools to identify the minimum level of protection that an organization should attain.

By Ellen Koskinen-Dodgson

Ellen Koskinen-Dodgson is an IT and Telecommunications Management Consultant, electrical engineer, author, speaker, media resource and Expert Witness. She is the President and Managing Partner of TMC IT and Telecom Consulting Inc.

How Much is Enough?

As cyber-attacks are predicted as “when”, not “if”, your organization is attacked, you will be judged by your Insurance company, your shareholders, regulators and the public based on how you prepared for and responded to a cyber-attack. Can you say that you met a defensible level of protection?

The Minimum

The province of British Columbia has developed a minimum framework for how to prevent attacks as well as what to do to stop the attack and recover your operations. The Defensible Security Framework helps organizations know where to best spend their limited security budget. The DSF includes explanations of the following requirements:

A defensible approach includes:

1. Control Groups:

2. Risk Management:

3. Layered Defense:

4. Continuous Monitoring:

5. Compliance and Legal Considerations:

6. Security Awareness:

7. Technology and Tools:

8. Collaboration:

How Do You Rate?

It’s worthwhile to assess yourself using their Assessment Tool, which is a simple workbook that you can download from their web site here. It includes content like:

1. Executive Support

Objective: Review security threat landscape and request executive support.

Deliverables: 30 to 60 minute presentation to executive and/or agreement.

2. Roles & Responsibilities

Objectives: Document key roles, approve them, and communicate who is responsible and who is accountable for security.

Deliverables: One or more pages documenting key security roles (for management, employee, contractor and vendor) and who occupies them.

3. Critical Assets

Objective: Build, review, and update a list of key systems and data and the controls in place to protect them.

Deliverables: List of key systems and data, whether they hold sensitive data (include criticality), what security controls exist and the process to keep it current (e.g.. annually).

Next Steps

Some organizations hire a consulting firm like TMC to complete the assessment. The assessment will show you where you need to improve and after a year, your can reassess to verify your progress. Then of course, when the inevitable happens, the assessment can be part of your response to your Insurance company, your shareholders, your regulators and the public.

If you’d like to discuss a possible assessment, or to comment on this article, please email me at .

This article was published in the November 2024 edition of The TMC Advisor
- ISSN 2369-663X Volume:11 Issue:6

©2024 TMC Consulting