Building a Security Function From Nothing

課程簡介

Somebody has just made you responsible for security at a company that has never had anybody responsible for security. There is no team. There is no budget line yet. There is a list of things people believe are true, an insurer or a customer who triggered your hire, and roughly nine directors who each own a system and none of whom report to you. The hardest part of this job is not technical, and pretending otherwise is the most common way a first security hire fails in year one. You will spend more of the ninety days establishing what you are allowed to decide than you spend looking at anything. The technical work is not the constraint. The constraint is that you can recommend, and somebody else has to act, and they are busy. Across four modules you find out what the company actually has rather than what it says it has, and build an ownership register that starts completely empty and gets filled by asking humans, one row at a time. You write the one page that says what this function will do and what it will not do, and take it to your sponsor for one signature. You work out the three things worth buying with a first budget, the argument for hiring nobody yet, and how to survive forty-five minutes with a finance director. Then you build a ninety-day plan with real dates and write the first board update on one side of paper. You will also learn to distrust your own progress. The activities that demonstrate a security function exists are rarely the ones that reduce risk, and the quiet unglamorous fix that would have prevented the incident is invisible to everybody above you unless you deliberately make it visible. Nothing in this segment produces a policy, a risk register or a gap assessment. Those belong to the segments that own them, and this one tells you when to start them rather than doing them for you. Every figure in it is ranged and dated and is illustrative, because the real numbers depend on your industry, your country and your year.

1. 01 第一週，改變之前

   3 堂課程·1h 45m

   第一週的本能是修復某些東西，因為修復東西是你擅長的事，也是在這個沒人認識你的建築裡讓你感到有用的原因。第一週花在修復上的每一小時都是在沒有地圖的情況下度過的一小時，而你破壞的第一件東西將是任何人對你第一個月唯一記得的東西。

2. 02 營運模式

   3 堂課程·1h 41m

   你對任何事都沒有權限，卻要對一切負責，任何熱情都無法彌補這個差距。能彌補的方法是寫下誰決定什麼，讓一個地位夠高的人同意，然後長期堅持這個做法，直到人們停止提問。

3. 03 第一份預算

   3 堂課程·1h 50m

   第一份預算很小，它被監看，你如何使用它決定了是否會有第二份預算。最常見的錯誤是購買一個需要一個人來運行的平台，這會將你唯一的預算轉變為一項永久義務和一個沒人看的儀表板。

4. 04 九十天，向上報告

   3 堂課程·2h 19m

   在第九十天，某個人會悄悄地決定聘用你是否是個好主意。那個決定是根據他們看到的東西做出的，而不是根據你做過的事，這兩者是不同的集合。這個模組的工作是讓默默無聞的工作變得可見，而不是把高調的工作變成計畫。

常見問題

我將在 Building a Security Function From Nothing 中學到什麼？

You are the first and only security person in the company. No budget, no team, and the people who own the systems do not report to you. This segment is the first ninety days: what exists, what you can prove, what you do first, who decides, what you refuse, and what you put in front of a board.

我需要事先具備經驗嗎？

建議在開始 Building a Security Function From Nothing 前具備一些先備知識。

Building a Security Function From Nothing 需要多長時間？

Building a Security Function From Nothing 包含 4 個單元和 12 堂課程。你可以按自己的進度學習。

我如何取得存取權限？

Building a Security Function From Nothing 包含在任何付費訂閱方案中。