Lee Brotherston - Defensive Security Handbook, 2nd Edition

As with many other departments, there are virtues in having the correct staff on the correct teams in regards to security. Open cross-team communication should be a primary goal, as without it the security posture is severely weakened. While smaller organizations may combine several of the following teams, or have a lack of them all together, this remains a good goal to populate a security department.

Executive team

A chief information officer (CIO) or chief information security officer (CISO) will provide the leverage and authority needed for businesswide decisions and changes. An executive team will also be able to provide a long-term vision, communicate corporate risks, establish objectives, provide funding, and suggest milestones.

Risk team

Many organizations already have a risk assessment team, and this may be a subset of that team. In the majority of organizations, security is not going to be the number-one priority. This team will calculate risks surrounding many other areas of the business, from sales to marketing and financials. Security may not be something they are extremely familiar with. In this case they can either be taught security basics case by case, or a security risk analyst could be added to the team. A risk framework such as NISTs Risk Management Framework (RMF) or the Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE) Framework can assist with this.

Security team

The security team will perform tasks to assess and strengthen the environment. The majority of this book is focused toward this and the executive team. They are responsible for daily security operations, including managing assets, assessing threats and vulnerabilities, monitoring the environment for attacks and threats, managing risks, and providing training. In a large enough environment, this team can be broken up into a variety of subteams such as network security, security operations, security engineering, application security, and offensive security.

Auditing team

It is always a good idea to have a system of checks and balances. This is not only to look for gaps in the security processes and controls, but also to ensure the correct tasks and milestones are being covered. As with the Risk Team, this may be a subset of a larger group.

However it is entirely possible that a Small to Medium Business (SMB) may combine one or (unfortunately due to things like budget constraints/etc) all of these roles into one. In those cases we definitely comisserate with you, as it happens all to often. As the company grows, and hopefully the security program also grows, these separate roles can then be planed and adequately filled.