In this lesson,
we're going to discuss the concept of a gap analysis.
Now, a gap analysis is a process
of evaluating the differences
between organization's current performance
and its desired performance.
The goal of the analysis is to identify areas
where improvements can be made in order to bridge the gap
between the current and desired states.
Conducting a gap analysis can be a really valuable tool
for organizations
that are looking to improve their operations, processes,
performance or overall cybersecurity posture.
Now, there are several steps involved
in conducting a gap analysis.
The first step is to define the scope of the analysis.
This includes identifying the specific areas
of the organization that will be evaluated
and the desired outcome of that analysis.
The next step is to gather data
on the current state of the organization.
This can be done through surveys, interviews
or other forms of data collection.
Once that data has been gathered,
it should be analyzed to identify any areas
where the organization's current performance falls short
of its desired performance.
Once those gaps have been identified,
our next step is to develop a plan to bridge those gaps.
This can include changes to processes, systems
or other areas of the organization
that can help to improve the performance
or security of your systems and networks.
The plan should also include specific goals
and objectives as well as a timeline for achieving them.
For example,
if a company wanted to migrate their data storage
from their on-premise solution to a cloud-based solution,
they should consider how this might affect their security.
To ensure a smooth and secure transition,
your company might perform a comprehensive gap analysis.
This might begin
by evaluating your on-premise security measures,
which includes your firewalls, intrusion detection systems
and data access controls.
After documenting this current state,
you can then compare it to the desired security standards
for their chosen cloud provider
which might be AWS, or Azure.
Then the gap analysis can be used to highlight
that their existing data encryption methods are outdated
and they're not in line with the cloud's
more advanced encryption at rest protocols.
Additionally, their on-premise access controls
might not be able to be mapped directly
to the cloud's identity and access management
or IAM models.
So this is a gap that also needs to be addressed.
Now that the company knows their current state
their desired state, and the difference between the two,
they're now better equipped to plan their migration
while ensuring they've adopted
enhanced encryption techniques
and made the necessary modifications to their IAM policies
to create an overall more secure
and seamless migration into the cloud.
Now, in general, you're going to find
that there are two basic types of a gap analysis.
We have a technical gap analysis
and a business gap analysis.
A technical gap analysis in the world of cloud computing
would involve evaluating
an organization's current technical infrastructure
and identifying any areas
where it falls short of the technical capabilities required
to fully utilize their security solutions.
For example, an organization might find
that its current network infrastructure
is simply not fast enough to support data
and transit encryption or a full zero trust architecture,
or that its current security protocols are not robust enough
to protect the data being stored at rest,
inside of their cloud-based storage solution.
Once those gaps have been identified, now the organization
can develop a plan to address these issues
and upgrade its technical infrastructure as needed.
Now, on the other hand, we have a business gap analysis
that involves evaluating
the organization's current business processes
and identifying any areas
where they fall short of the capabilities required
to fully utilize their new cloud-based solutions.
For example, an organization may find
that its current data management processes
are not efficient enough to support cloud-based data storage
and sharing, or that its current budgeting
and forecasting processes are not accurate enough
to support cloud-based financial management.
Once the gaps have been identified
then the organization can develop a plan
to move its business processes forward
as needed to close that gap.
Now, let's take a look at a real world example.
At one of my formal organizations that I worked at,
we conducted a vulnerability assessment once per week
across the entire network.
This vulnerability assessment was designed
to uncover weak points in our digital infrastructure
and systems.
The assessment often found several software vulnerabilities
in our different servers,
some insufficient encryption for data in transit,
and a few times
we found outdated database configurations too.
Each week, my team and I were responsible
for looking over all the findings from the assessment
and then determining which ones were the highest priority
for us to fix because we never have enough time, money
or resources to fix all of them in any given week.
By understanding the seriousness of each finding,
we could then create a Plan of Action and Milestones,
known as a POA&M
and that would outline the specific measures
to address each vulnerability and allocate resources
and set up timelines for each of the remediation tasks
that we needed to perform.
This allowed us to prioritize the patching
of critical software vulnerabilities
and updating those database misconfigurations first.
At the same time, we now know what the level of security
is that we're trying to achieve
and our POA&M was an actionable way to get us
from our current state to our desired state
and this helped us continually close the gap identified
by our ongoing gap analysis
in terms of our vulnerability management programs.
So remember, a gap analysis really is a powerful tool
that can help your organization to improve its security
and its performance
by identifying areas where improvements can be made.
Whether you're looking to migrate into the cloud
or you simply want to improve the security of your systems
and networks,
a gap analysis can help to achieve the desired outcomes
and results for you.
By following the steps of a gap analysis, you can ensure
that you have a comprehensive plan in place
to bridge the gap between your current
and your desired states.