SF - 1.09.0 - weaknesses
As previously mentioned, none of these security frameworks can be recommended without reservation. All of them have weaknesses, and the weaknesses tend to be similar for every security framework. Keep these weaknesses in mind as you consider the various security frameworks, and consider which one may help you to improve your security posture, in your particular situation. Remember, at all times, that none of these is perfect.
One of the most common limitations in all security frameworks is that of the limitation of the content of the framework. Security frameworks are built by people, and people tend to think that what they face, in terms of security protection and vulnerability and threat, is the most important. No security framework addresses all areas of security.
You would think that the checklist type frameworks have the advantage in this area, since they are grouping lists of security controls, and therefore touch on a wide variety of processes and threats. However, remember also that those frameworks that concentrate on the principles of security require you, in your work, your enterprise, and your situation, to address the specifics of the security problems you face, and the protections that you need. Therefore, in a sense, those frameworks concentrating on principles, rather than individual controls, have the advantage in requiring you to address the specifics that you face.
One of the problems that you will come across frequently, if you explore a range of security frameworks, is that of the definition of secure. Or, not so much the definition, as the emphasis that a particular security framework may put on one type of security over another. This may not correspond with your particular needs. I remember one particular meeting, where two people, sitting next to each other, faced wildly divergent security requirements. In the case of one, absolute confidentiality was crucially essential. This particular enterprise dealt with very detailed aspects of businesses, and sometimes businesses that were in competition with each other. Any breach of confidentiality would have been catastrophic to the trust relationships necessary with their clientele. On the other hand, this particular agency was a government office, and therefore speed of the processes, and availability of responses, was not necessarily something that anyone expected. Next to him was someone who dealt with emergency management. Nobody wanted to actually broadcast details of an emergency, but, given emergency communications, they did have to do so on occasion. So confidentiality was a rather minor consideration for them. But, dealing with emergency management, and particularly emergency communication, this particular office was absolutely vital, and it was absolutely crucial that, when someone picked up the phone and called them, somebody on the other end actually answered the phone, and relatively quickly. Availability was absolutely crucial. Therefore different frameworks may approach the different types of security, and the different requirements of different types of security, in very different ways. Ensure, when you are considering a security framework, that it matches your emphasis on your need for your particular type of security.
I have mentioned best practice, and a number of the security frameworks concentrate on this idea of best practice. Sometimes they present themselves as a best practice in terms of security frameworks. The thing is, how do you define best? Are you talking about the most common practice with the widest variety of enterprises? Are you talking about something that will address the widest range of threats? As previously noted, none of the security frameworks will address all the threats that you may encounter. Be very careful when a security framework mentions best practice. Definitely do not simply accept this as the one that you need, without regard for any other. Perhaps the best practice is simply to ignore all mentions of best practice.
Security frameworks (SF) series:
Introduction and ToC: https://fibrecookery.blogspot.com/2026/06/security-frameworks-sf-0000-intro-and.html
No comments:
Post a Comment