Defensible Security
No one can afford perfect cyber-security protection – it gets ever more expensive to increase your level of protection. So what is the right balance between protection and cost? The province of British Columbia has answered this question with their Defensible Security Framework, a set of guidelines and tools to identify the minimum level of protection that an organization should attain.
How Much is Enough?

As cyber-attacks are predicted as “when”, not “if”, your organization is attacked, you will be judged by your Insurance company, your shareholders, regulators and the public based on how you prepared for and responded to a cyber-attack. Can you say that you met a defensible level of protection?
The Minimum
The province of British Columbia has developed a minimum framework for how to prevent attacks as well as what to do to stop the attack and recover your operations. The Defensible Security Framework helps organizations know where to best spend their limited security budget. The DSF includes explanations of the following requirements:
A defensible approach includes:
1. Control Groups:
- Security Prerequisites: Basic security measures that must be in place before implementing more advanced controls.
- Security Directives: Policies and procedures that guide the overall security strategy.
- Security Controls: Specific technical and administrative measures to protect assets and data.
2. Risk Management:
- Risk Identification: Identifying potential threats and vulnerabilities.
- Risk Mitigation: Implementing measures to reduce the impact and likelihood of risks.
3. Layered Defense:
- Multiple Layers of Security: Implementing various security controls at different levels (e.g., network, endpoint, application).
- Redundancy: Ensuring that security measures are resilient and can withstand attacks.
4. Continuous Monitoring:
- Real-Time Monitoring: Using tools to continuously monitor for threats.
- Incident Response: Having a plan in place to respond to security incidents quickly and effectively.
5. Compliance and Legal Considerations:
- Regulatory Compliance: Ensuring adherence to relevant laws and standards.
- Documentation: Keeping thorough records of security policies, procedures, and incidents.
6. Security Awareness:
- Training: Educating employees about security best practices.
- Simulations: Conducting exercises to test and improve security awareness.
7. Technology and Tools:
- Advanced Solutions: Using technologies like firewalls, IDS/IPS, and endpoint protection.
- Automation: Leveraging automation to enhance security operations.
8. Collaboration:
- Internal Collaboration: Working across departments to ensure a cohesive security strategy.
- External Partnerships: Sharing information with other organizations to stay informed about threats and best practices.
How Do You Rate?
It’s worthwhile to assess yourself using their Assessment Tool, which is a simple workbook that you can download from their web site here. It includes content like:
1. Executive Support
Objective: Review security threat landscape and request executive support.
Deliverables: 30 to 60 minute presentation to executive and/or agreement.
2. Roles & Responsibilities
Objectives: Document key roles, approve them, and communicate who is responsible and who is accountable for security.
Deliverables: One or more pages documenting key security roles (for management, employee, contractor and vendor) and who occupies them.
3. Critical Assets
Objective: Build, review, and update a list of key systems and data and the controls in place to protect them.
Deliverables: List of key systems and data, whether they hold sensitive data (include criticality), what security controls exist and the process to keep it current (e.g.. annually).
Next Steps
Some organizations hire a consulting firm like TMC to complete the assessment. The assessment will show you where you need to improve and after a year, your can reassess to verify your progress. Then of course, when the inevitable happens, the assessment can be part of your response to your Insurance company, your shareholders, your regulators and the public.
If you’d like to discuss a possible assessment, or to comment on this article, please email me at ellen.
This article was published in the
November 2024
edition of The TMC Advisor
- ISSN 2369-663X Volume:11 Issue:6
©2024 TMC Consulting