Structured Security Model

Introduction:

Having worked with risk and security matters for banking, pharmaceutical, financial, gaming, retail, and exchange entities, I found only one security expert who can answer security coverage satisfactorily as compared to the garden variety of security models out there, mostly covering only fragments of the big picture. That security expert worked in a financial institute with a US$1 billion dollar yearly security budget around early 2000.

Combining what I have learned from the aforementioned expert and my own exposure to security as IT auditor, technical lead, solution architect, and protection measures implementer dealing with standards like Big 4’s, ISO, PCI-DSS, SOC1, SOC2, FDA, IEEE, Aviation and others, I would like to propose a more comprehensive security model, which I will label as S2M (Structured Security Model) for ease of reference.

Disclaimer: Like many other subjects in life, security is something that the more you know, the less you think you know. So, I am definitely not claiming myself as a security expert. Just chipping in what I know. Use the concepts here at your own risks and costs.

S2M in a Nutshell

S2M is comprised of 5 key concepts:

1. Security is On-going

Because things change unavoidably, and new security holes will surface and need to be filled. As technology advances, so are the hackers’ weapons, and hence the needs for on-going defense…