How to Turn Data Gap Analysis into Success

How to Turn Data Gap Analysis into Success

• The gap analysis process provides a comparison of the security program versus the security compliances as per the industry.
• The comparison would help you identify the vulnerabilities and risks existing in the system/network.
• Most importantly, a data gap analysis would show you what you should be doing by giving you the right pathway and controls to move ahead.

Some stats on the cyber security front due to execution of Gap Analysis:

• Only 14% of small businesses are prepared to defend themselves against cyber attacks.
• A new organization gets hit by ransomware every 14 seconds.
• Malware attacks cause an average loss of 50 days in time for businesses.

How to Conduct a Data Gap Analysis In 4 Easy Steps

Step 1: Choose an industry-standard security framework

• The framework would provide you with the best practices with the help of which you can estimate your own security program.
• One of the most common frameworks is the ISO/EIC – 27002 standard.
• This standard covers the most promising approaches for key security areas which includes risk assessment, change management, access control, physical security, and even more.
• If you have an in-house security team, you may execute the gap analysis yourself. However, even with the in-house support, it may be in your best interest to have an independent third party by your side.
• They will evaluate your security plan by catching the gaps that might get overlooked by the in-house team.
• Moreover, some industry compliance measures (i.e., HIPAA, PCI, etc.) demand a legitimate cyber security center consultant. This is to provide an extra set of eyes to ensure that security standards comply with state and federal regulations.

Step 2: Evaluate people and processes

• After the selection of framework and execution of assessment, begin with gathering information about your systems. Start operating interviews to learn more about the organization’s key goals.
• Security experts must conduct in-depth interviews with your company’s key stakeholders and specific departments.
• The learning objective is to understand your organization’s IT environment, business charts, policies and processes, application inventory, and other necessary details.
• This would further help the security analyst to discover which security policy is in place and where the grey area is to fix and take the organization to the next step in a secured manner.
• It’s the job of the security analyst to figure out the errors caused by humans in order to decrease the threats to data.
• Moreover, as much as the cyber security expert would know about your network access and controls, the easier it would be to build the right data gap analysis.

Step 3: Data gathering

• Data gathering calls for only one goal and that is to learn how well the current security program performs within the technical architecture.
• It is advisable to compare the best current securities against the best practice standard (i.e., ISO 27002 or NIST 800-53).
• If you consult a third party to perform the gap analysis, they should benchmark your organization’s security program against its best practices throughout the data gathering process.
• For the execution take a sample of network devices, and applications to determine gaps and vulnerabilities.
• Then, review automated security controls, evaluate incident response procedures, communications protocols, and log files.
• The collection of such data would aid in providing a clear image of the technical environment along with the overall security effectiveness.

Step 4: Analysis

• This is the final step that calls for an in-depth analysis of the security program.
• This includes areas of strength and areas where improvement is most needed. The results come with a score – graded zero to four – that, in non-technical terms, assesses your organization’s security program.
• When we conduct a gap analysis for our clients, our expertise and technical stack allow us to see the links between findings and results from the gap analysis process.
• We provide this in an assessment report which would further aid you with the remediation plan.
• This works like a security roadmap to consider risks, budget requirements along the deadline to complete the recommended security improvements.

Frameworks of Gap Analysis

SWOT Analysis

• SWOT is used very commonly by businesses across the globe.
• It stands for Strengths, Weaknesses, Opportunities, and Threats.

McKinsey 7Ss Framework

• McKinsey work on this framework which has seven categories namely, strategy, structure, systems, shared values, skills, style, and staff.
• The initial four are considered as hard and the later ones are considered soft.
• Hard elements are easier to identify whereas soft elements are less tangible.
• Anyone can use and apply this framework to begin the closing of gaps to achieve security.

Nadler-Tushman Model

• Tushman framework consists of 3 parts namely, Input, Transformation process, and output.
• This is further based on four elements namely, work, people, structure, and culture.
• The objective of this dynamic model is to identify the gaps based on how the work of one element affects the others.

Fishbone Diagram

• The Fishbone framework is used to identify the current state based on the cause-and-effect diagram.
• This framework segregates the issue into six categories namely, environment, machines, materials, measurement, methods, and people.

PEST/PESTLE Analysis

• PEST or PESTLE analysis stands for political, economic, social, technological, legal, and environmental.
• This analysis would help you to analyse threats through four concerning areas – political, social, and technological.
• This is considered the clearest framework to detect current problems.

The Final Word

• You may uncover risks that can be fixed quickly with the installation of a security patch, or vulnerabilities that require a more robust solution.
• However, this is safe to say that this robust solution is not enough. Performing a gap analysis every now and then would ensure that your staff, network, and security controls are efficient and cost-effective.