In today’s era, there is a need for project management skills in the Cybersecurity world. Every Project management team should have a few essential processes in place to ensure the overall security program efforts.
The security management program is a complex systematic process, dealing with all aspects of a company’s activities, starting from personnel employment and termination to vendor management, from security equipment implementation and secure software development to business continuity management, from data backup to event monitoring and cyber incident response.
Organizations, like LIFARS, are providing Project Management as service (PMaaS) to assist you to successfully plan and deliver time-constrained high- profile security projects.
Plan of Action and Milestone
A lot of security professionals have no experience of working in specific formal frameworks, so a Plan of action and milestone (POAM) can be an unfamiliar term.
POAM is a document that identifies tasks needing to be accomplished. It details resources required to accomplish the elements of the plan, any milestones in meeting the tasks, and scheduled completion dates for the milestones. POA&Ms should be updated to show progress made on current outstanding items and to incorporate the results of the continuous monitoring process. The term plan of action and milestones comes from the National overall information security plan (ISP).
NIST guidance states that each federal civilian agency must report all incidents and internally document remedial actions and their impact.
“Agency POA&M must reflect known security weaknesses within an agency including its components or bureaus and shall be used by the agency, major components and program officials, and the IG as the authoritative agency management mechanism to prioritize, track, and manage all agency efforts to close security performance gaps”
Work Breakdown Structure
Work Breakdown Structure (WBS) is a deliverable-oriented hierarchical decomposition of the work to be executed by the project team to accomplish the project objectives and create the required deliverables. A WBS is the cornerstone of effective project planning, execution, controlling, monitoring, and reporting. The WBS is a foundational building block to initiating, planning, executing, and monitoring and controlling processes that are used to manage projects.
A work breakdown structure (WBS) lets project managers plan their work more efficiently. A project is characterized by time-limited activities and is assigned fixed time frames and costs. When it is finished, a project must fulfill the stakeholder needs it was designed to address. The project management has to plan for the schedule, the fixed costs and the functional completeness of the project and assign responsibilities. The WBS helps make this planning consistent and provides for effective project execution.
How do POAM and WBS CONTRAST?
While both the POAM and WBS make the project manageable by breaking the larger modules into small pieces. In healthy and mature security programs, the additional layers of decomposition are usually simple tasks for qualified security professionals. The level of decomposition in WBS is based on the extent to which the project will need to be managed unlike the POAM, where the level of decomposition is done for the complete project life. If additional visibility into the progress is needed, additional decomposition is recommended.
A WBS doesn’t have a time component, predecessors or dependencies. Hence in this scenario, POAM’s is better than WBS. It is usually observed that while developing a WBS, one can focus on the deliverables and nothing but the deliverables. It allows an uncluttered focus on the work that often gets lost in a project schedule whose focus is time and dependencies.
Purpose of WBS and POAM’s
The main purpose of a WBS is to reduce complicated activities to a collection of tasks. This is important for the project manager because she can oversee the tasks more effectively than complex activities. Tasks must be measurable and independent, with clearly defined limits.
While each company’s POA&M is likely different because it includes information about weaknesses and gaps according to NIST 800-171 standards, as well as the risk posture for each respective gap and any mitigating steps the company intends to make. The purpose of NIST 800-171 includes the necessary information about each system in your environment that processes, stores, and transmits Controlled Unclassified Information. This information includes security configurations or capabilities that are currently, or intended to be, implemented, and each capability is expressly tied to specific security requirements and controls.
Proactive and Reactive approach to cybersecurity
While managing a project with either Work breakdown structure or Plan of Action and milestone, we are following either a reactive or proactive. Our behavior is reactive when we take action in response to an unanticipated adverse event that has already happened. Not to mention the consequences and damage mitigation, reactive approach limits our vision to only a revealed vulnerability leaving us exposed to a host of other risks.
It even does not allow eliminating this one known vulnerability, because we consider it from the victim’s perspective, not the attacker’s one, and can easily be mistaken in our countermeasures. On the contrary, being proactive means thinking ahead of events and from a much broader perspective.
It is advised to use a proactive approach to cyber security processes and management in a Long run. While a proactive systematic approach requires more time and resources than purchasing new security equipment, it empowers companies with a more clear understanding of their security problems along with a rational justification of investments into security solutions.
There are many time-tested standards and best practices of company security management, with the primary being NIST, PCI DSS, ISF SoGP, ISO 27000, OWASP, ITIL, and some others. However, being adopted imprudently, these standards may be too complex and raise concerns among business owners to be bogged down in bulks of documentation and organizational processes.
To Successfully Manage and Deliver Your Cybersecurity Projects:
Contact One of Our Cybersecurty Project Managers Today!
