Gartner’s Six Principles of Resilience for Digital Business Risk and Security

There are 6 main principles when talking about information security. These principles first introduced in 2016 by Gartner risk and security division.

Principles are:

• Principle No. 1: Stop Focusing on Check Box Compliance, and Shift to Risk-Based Decision Making
• Security is not the same old beast. Information security must be a top down approach and driven from identified business risk. Risk management and risk analysis is the first big step of any information security work.
• Principle No. 2: Stop Solely Protecting Infrastructure, and Begin Supporting Business Outcomes
• Information security is a business enabler. Security is there to help business achieve its goals and targets. The only way of having a successful information security architecture is to make sure it is aligned with business strategy.
• Principle No. 3: Stop Being a Defender, and Become a Facilitator
• Again, the aim of information security is to facilitate business to hit the targets. Of-course security is important, but if we are blocking business process, it is useless.
• Principle No. 4: Stop Trying to Control Information; Instead, Determine How It Flows
• Big shift in security mind set is moving away from local and limited controls and have a holistic approach looking at flows and process.
• Principle No. 5: Accept the Limits of Technology and Become People-Centric
• These days more and more attacks are result of lack of user awareness. Training people and using resources is as important as having technical controls.
• Principle No. 6: Stop Trying to Perfectly Protect Your Organization, and Invest in Detection and Response
• We all know it is impossible to have a complete safe environment. Threats and vulnerabilities are always there. Proper incident response plan and operation is crucial for any business.