At what point will we admit that technology is not enough? When will we discover that our well-documented processes are insufficient? Who will acknowledge that their leadership when it comes to governance isn’t working? It takes a strong person to admit these flaws in organizational behavior and tackle the hardest problems head on.
People, process, technology and governance are the building blocks of a good security program. Most clients I work with struggle in several of these areas, and everyone struggles in at least one. The lowest level of maturity I see is in building risk and security awareness, and infusing secure practices into the organizational behavior.
