This is a great whitepaper you can download for free at Microsoft written by IT Security Guru Roger Grimes. Here is the Executive Summary:
"Many companies do not appropriately align computer security defenses with the threats that pose the greatest risk to their environment. The growing number of ever-evolving threats has made it more difficult for organizations to identify and appropriately rank the risk of all threats. This leads to inefficient and often ineffective application of security controls.
The implementation weaknesses described in this white paper are common to most organizations, and point to limitations in traditional modeling of and response to threats to computer security. Most of the problems occur due to ranking risk inappropriately, poor communications, and uncoordinated, slow, ineffectual responses.
This paper proposes a framework that can help organizations more efficiently allocate defensive resources against the most likely threats to reduce risk. This new data-driven plan for defending computer security follows these steps:
-
Collect better and localized threat intelligence
-
Rank risk appropriately
-
Create a communications plan that efficiently conveys the greatest risk threats to everyone in the organization
-
Define and collect metrics
-
Define and select defenses ranked by risk
-
Review and improve the defense plan as needed
The outcome is a more efficient appropriation of defensive resources with measurably lower risk. The measure of success of a data- and relevancy-driven computer security defense is fewer high-risk compromises and faster responses to successful compromises.
If such a defense is implemented correctly, defenders will focus on the most critical initial-compromise exploits that harm their company the most in a given time period. It will efficiently reduce risk the fastest of any defense strategy, and appropriately align resources. And when the next attack vector cycle begins, the company can recognize it earlier, respond more quickly, and reduce damage faster."
Grimes mentions end-user security awareness training as one of the top things any company can do.
Here is the download, a "Stu's Warmly Recommended":
https://gallery.technet.microsoft.com/Fixing-the-1-Problem-in-2e58ac4a
