1) DON'T PRIORITISE SECURITY OBJECTIVES OVER THE BUSINESS

The objectives of any security programme must be aligned with objectives of the business. Where this doesn't happen, there's an increased chance that security actions will interfere with operations and subsequently undermine security's reputation. In these circumstances its more likely that security processes will be ignored, security issues won't get reported for fear of more security measures and vulnerabilities will grow. Thankfully this is easily overcome by security professionals involving other areas of the business when making decisions and building consensus before implementing security measures.

2) AVOID UNNECESSARY SECRECY

There are times when elements of a security strategy need to be kept secret to remain effective: e.g. during an ongoing investigation or when people knowing about security measures would enable them to be circumvented. However, when entire security programmes are needlessly shrouded in secrecy it leaves other parts of the organisation questioning the effectiveness of security. Security professionals need to share as much information as possible with other parts of the business and employees to build trust and develop a culture of security.

3) DROP THE MACHO IMAGE

There's no way to avoid it, security has a macho image in the mindset of most people linked to the fact that many security professionals tend to be former military or police. Clearly we want the skills that these backgrounds bring, but security professionals need to recognise that this isn't always a useful image because it makes them less approachable. They need to make an effort to breakdown barriers which can be done by having non-work related conversations and generally making an effort to be known as a person and not just referred to as "security". It is often during non-work related conversations that trust is built and can even lead to useful information being passed on.

4) FOCUS ON PROACTIVELY IDENTIFYING THREATS

A security programme that isn't dedicated to identifying over the horizon threats can't be surprised when they arrive on their doorstep. The amount of media coverage on cyber threats means that businesses are heavily focused in this area but there's a danger that non-technical threats could be overlooked. This is why an effective threat identification capability needs to be holistic and cover a wide spectrum. The priorities for identifying threats should be driven by findings of risk assessments and concerns from within the business (Tip: business priorities will shift frequently so conduct periodic engagement). During the early stages of establishing a threat identification capability, gather as much information as possible from as many sources as possible. Once this is analysed you'll quickly discard the unreliable sources which will increase the time you can allocate to analysis and improve the quality of output (Tip: periodically review your information sources to weed out ones that have run dry and identify new sources of information).

5) CREATE A PATH FOR CAREER PROGRESSION

If you fail to develop your workforce through training and give people more responsibility they're going to get bored and stagnate. The lazy ones will stay, but the good ones will leave in search of a greater challenge and ironically, these are the ones you most want to keep because their new ideas and drive to do things better can be harnessed to enhance your security programme. Be sure to map out a development route for people that join your team. Given the everchanging security threats in the modern world, it shouldn't be hard for you to identify new skills that your team could be trained in.

6) ENSURE YOUR INCIDENT RESPONSE PLANS ARE FIT FOR PURPOSE

Creating incident response plans takes diligence, research and time. Don't try to rush it because you'll either miss something or they'll lack sufficient detail to be of use. When creating the plans, first start by taking time to game play how an incident might manifest and unfold. Consider how the incident might have indirect consequences outside of the area immediately impacted, e.g. media interest and political involvement. Then consider your constraints, e.g. resources, legal boundary,  skills. To reduce chances of being caught out by a real-life incident, prioritise completing plans for the ones which are most likely to occur.