of 23
8/12/2019 The Security Policy Management Maturity Model - AlgoSec
1/23
The Security Policy ManagementMaturity Model
8/12/2019 The Security Policy Management Maturity Model - AlgoSec
2/23
Our Speakers
Eric Ogren
Principal Analyst
The Ogren Group
Nimmy
VP Stra
AlgoSe
8/12/2019 The Security Policy Management Maturity Model - AlgoSec
3/23
We Need to Evolve!
8/12/2019 The Security Policy Management Maturity Model - AlgoSec
4/23
Comple
8/12/2019 The Security Policy Management Maturity Model - AlgoSec
5/23
Modern Threats
8/12/2019 The Security Policy Management Maturity Model - AlgoSec
6/23
peed of Business
8/12/2019 The Security Policy Management Maturity Model - AlgoSec
7/23
The Security Management Maturity Mode
Level 1 -Initial
Level 2 -Emerging
Level 3 -Advanced
Le
8/12/2019 The Security Policy Management Maturity Model - AlgoSec
8/23
Using the Maturity Model
AssessEvaluate
Implement
8/12/2019 The Security Policy Management Maturity Model - AlgoSec
9/23
Poll
8/12/2019 The Security Policy Management Maturity Model - AlgoSec
10/23
Level 1 - Initial
Limited understanding of why each rule is in place
Change management is manual; many changes mustbe redone
Limited visibility of impact to network traffic
Time-consuming audits
Rules are rarely deleted for fear of breaking somethin
Manual risk analysis of the firewall policy
8/12/2019 The Security Policy Management Maturity Model - AlgoSec
11/23
Recommendations for Level 1
1. Review (or create) documentation for fi
2. Get an accurate picture of your networkyou understand what your policy is actu
3. Define your ideal change management
4. Establish regular projects to clean up fir
router rules and ACLs
5. Review risk analysis and compliance pro
6. Assess benefits of automation
8/12/2019 The Security Policy Management Maturity Model - AlgoSec
12/23
Level 2 - Emerging
Automated monitoring and alerting of policy changes
Real-time, up-to-date topology visibility
Automated compliance reporting
Automated policy optimization and risk analysis
No overly permissive rules (E.g. ANY) Change management still manual and error-prone
with teams working in silos
8/12/2019 The Security Policy Management Maturity Model - AlgoSec
13/23
Recommendations for Level 2
1. Make sure security and network teams
and agree on change management proc2. Measure the time required for each ste
change request to identify bottlenecks
3. Conduct reconciliation between request
changes made to identify out-of-proces
4. Assess the value of automation as part o
firewall- and network-aware change pro
8/12/2019 The Security Policy Management Maturity Model - AlgoSec
14/23
Level 3 - Advanced
Automated change process improves business agility
Continuous compliance Out-of-process changes are discovered and already
works change requests are automatically closed
Basic documentation and limited visibility of
application connectivity needs (E.g. spreadsheets)
Poor communications with business stakeholders and
application owners
8/12/2019 The Security Policy Management Maturity Model - AlgoSec
15/23
Recommendations for Level 3
1. Review processes for documenting application c
needs
2. Assess gaps between application and network te
to the security and network infrastructure
3. Review processes for decommissioning applicati
related unused firewall rules
4. Examine options for making business owners ow
and vulnerabilities in their applications
5. Assess tools which provide application-centric ap
managing the network security policy
l i i
8/12/2019 The Security Policy Management Maturity Model - AlgoSec
16/23
Level 4 - Visionary
Fast and efficient security provisioning of business
applications
Application, security and operations teams are
aligned
Secure decommissioning of applications; removing
rules no longer in use
No application outages due to firewall
misconfigurations
View of risk from the application perspective
If h d hi f h ld j
8/12/2019 The Security Policy Management Maturity Model - AlgoSec
17/23
If you have made this far you should enjo
1. Improved application availability
during a data center migration2. Faster service delivery
3. Alignment across IT, security and
business
4. Tighter security policies to improagainst cyber-attacks
5. More time, resources and budge
on strategic initiatives
8/12/2019 The Security Policy Management Maturity Model - AlgoSec
18/23
Poll
8/12/2019 The Security Policy Management Maturity Model - AlgoSec
19/23
The AlgoSec Security
Management Suite
M i S it t th S d f B i
8/12/2019 The Security Policy Management Maturity Model - AlgoSec
20/23
BusinessApplications
Managing Security at the Speed of Busine
AlgoSec Security Management Suite
Application Owners Network Operations
Faster SecurityProvisioning for
BusinessApplications
Align Teams forImproved Agility
and Accountability
Gain TotalVisibility and
Control of yourSecurity Policy
Th Al S S it
8/12/2019 The Security Policy Management Maturity Model - AlgoSec
21/23
FirewallAnalyzer
Security PolicyAnalysis & Audit
FireFlow
Security PolicyChange Automation
BusinessFlow
Business ApplicationConnectivity Mgmt
BusinessApplications
The AlgoSec SuiteApplication Owners
AlgoSec Security Management Suite
Network Operations
8/12/2019 The Security Policy Management Maturity Model - AlgoSec
22/23
Q&A and Next Steps
Download the Security Policy
Management Maturity Model @www.algosec.com/maturitymodel
Download the Security Change
Management ebook @
www.algosec.com/securitychanges_ebook
Evaluate the AlgoSec Security
Management Suite @www.algosec.com/eval
http://www.algosec.com/maturitymodelhttp://www.algosec.com/securitychanges_ebookhttp://www.algosec.com/evalhttp://www.algosec.com/evalhttp://www.algosec.com/securitychanges_ebookhttp://www.algosec.com/maturitymodel8/12/2019 The Security Policy Management Maturity Model - AlgoSec
23/23
Connect with AlgoSec on:
www.AlgoSec.com
Managing Security at the Speed of Busines
http://www.algosec.com/http://www.algosec.com/http://www.twitter.com/algosechttp://www.facebook.com/AlgoSechttp://www.youtube.com/algosechttp://www.linkedin.com/company/algosec