Optimize Security Mitigation Effectiveness Using STRIDE

Organizations need to have an accurate view of security in order to function and grow without being exposed to too much risk.
However, the complexity of IT systems and the sophistication of threat actors makes it difficult for security leaders to have the best information about how secure the organization truly is. This blueprint enables security leaders to aggregate relevant information into one place and gain an informed and insightful view of information security.

Our Advice

Critical Insight

Simply meeting regulatory compliance is not enough for security.
Changes to the business are just as dangerous as malicious attackers. The business is changing every day and security measures need to evolve to keep up.
Your perception of security is only good as the information you collect.
Being able to show the business how well you are protected is critical to having support for security and being accepted as a business partner.

Impact and Result

Have a clear picture of:
- Identified critical data and data flows
- Organizational threat exposure
- Security countermeasure deployment and coverage
Understand which threats are appropriately mitigated and which are not
Generate a list of initiatives to close security gaps
Create a quantified risk and security model to reassess program and track improvement
Develop measurable information to present to stakeholders

Optimize Security Mitigation Effectiveness Using STRIDE Research & Tools

Start here – read the Executive Brief

Read our concise Executive Brief to find out how Info-Tech’s mitigation effectiveness assessment can drive a successful and insightful security program that is right-sized to the business.

Optimize Security Mitigation Effectiveness Using STRIDE – Executive Brief

1. Setup: Data and element classification

Establish a data and element categorization framework.

2. Data and element inventory

Identify valuable data and map where it flows.

3. Threat severity assessment

Appraise the organizational threat landscape.

4. Control maturity assessment

Catalog existing security controls and the threats they mitigate.

5. Outputs and interpretation

Interpret mitigation assessment results and identify security initiatives.

6. Implementation and maintenance

Integrate security initiatives into an actionable roadmap.

About Info-Tech

Info-Tech Research Group is the world’s fastest-growing information technology research and advisory company, proudly serving over 30,000 IT professionals.

We produce unbiased and highly relevant research to help CIOs and IT leaders make strategic, timely, and well-informed decisions. We partner closely with IT teams to provide everything they need, from actionable tools to analyst guidance, ensuring they deliver measurable results for their organizations.

What Is a Blueprint?

A blueprint is designed to be a roadmap, containing a methodology and the tools and templates you need to solve your IT problems.

Each blueprint can be accompanied by a Guided Implementation that provides you access to our world-class analysts to help you get through the project.

Authors

Cameron Smith

Wesley McPherson

Elliot Lewis

Contributors

Thomas DeLaine, Director Information Security, Comprehensive Health Services
Vincent di Giambattista, Director - Information Security and IT Compliance, Walgreens Boots Alliance
Robert Banniza, Senior Director – IT Center Security, AMSURG
Chuck Lankford, Chief Information Security Officer, Dallas Area Rapid Transit
Diana Sharkey, Manager – IS Management Partnership Services, InfoPartners
Joey LaCour, VP & Chief Security Officer, Colonial Savings
Sky Sharma, Government Liason and Subcommittee Advisor, AFCEA International
Keith Grey, Director of Infrastructure / Information Security Officer, Des Moines University
Matthew Langford, Chief Information Security Officer, University of Northern Colorado
Jarred White, Product Security Architect, AirWatch
Guillermo Mateo, Manager – Information Security and Compliance, Worthington Industries
Dwayne Healey, VP – Group Security, PaySafe Group
Cecil Greene, Chief Information Security Officer, National Cooperative Bank
Salina Olmsted, Senior Compliance and Security Analyst, Hagerty
Robert Hawk, Information Security Expert, xMatters
Eric Andresen, IT Security Manager, SSAB
Ian Parker, Head of Information Security, Risk and Compliance, Fujitsu UK and Ireland