The Four Stages of Information Security: A Comprehensive Framework for Defense
“We…are at war!” Those were CISO James Shira’s first words at our PwC all-hands meeting in Tampa in 2018. His dramatic opening wasn’t hyperbole but an acknowledgment of the relentless battle security professionals face every day. Having spent over two decades protecting information systems at organizations like Lockheed Martin and Lucent Technologies, I’ve experienced this digital battlefield firsthand.
The Origin of the Four Stages of Information Security
During that memorable meeting, Shira shared that he’d been reading Sun Tzu’s “The Art of War” and applied those ancient military principles to develop what he called the “Four Pillars of Information Security.” My only disagreement with his excellent framework was semantic. These components work better as sequential stages rather than concurrent pillars, since each builds upon the foundation established by the previous one.
In the years since, I’ve applied and refined this approach across numerous organizations. Today, I’ll walk you through these Four Stages of Information Security and show you how they can transform your organization’s defense posture against evolving cyber threats, such as Ransomware Attacks.
Stage One: Identify the Attack Surface
The first stage in improving information security is comprehensive discovery. You simply cannot protect what you don’t know exists.
Your attack surface encompasses all potential entry points where unauthorized users could access your systems—hardware, software, networks, and even human operators. This stage requires meticulous IT Asset Management (ITAM) to create a complete inventory of your digital environment.
Your attack surface inventory should include:
This stage forms the critical foundation for everything that follows. Security gaps will inevitably remain exposed to potential attackers without a comprehensive view of your attack surface.
Stage Two: Reduce the Attack Surface
After mapping your complete attack surface, the next stage involves strategic reduction. In my assessments, organizations typically discover they have far more entry points than necessary, creating excessive vulnerability.
This stage focuses on eliminating unnecessary attack vectors through:
Sometimes, surprising vulnerabilities emerge during this process. I’ve seen this firsthand. At a previous job, one of my employees decided he didn’t like having to enter credentials to use the WiFi at work. To solve his “problem,” he went to Best Buy, bought a WiFi access point designed for home use, and plugged it directly into our staff network. This unauthorized device created an entirely new, unsecured access point that bypassed all our security controls, allowing anyone to discover the WiFi and gain unchallenged access to our staff network.
What surprised me most wasn’t just that he would do this in the first place, but that he actually complained when I informed him of the security breach he had created. His laziness had introduced a significant vulnerability that could have compromised our entire organization. Never underestimate how someone’s desire for convenience can undermine your security measures.
Your organization could be under attack right now. While you read this sentence, automated bots are scanning your network, looking for vulnerabilities. Sophisticated ransomware groups are analyzing your industry for their next target. Former employees might still have access credentials they shouldn’t.
By systematically reducing your attack surface, you can focus your limited security resources on protecting what truly matters, rather than spreading them thinly across an unnecessarily large digital footprint.
Stage Three: Harden the Attack Surface
The third stage involves strengthening the necessary access points that remain after reduction. This hardening process makes it considerably more difficult for attackers to exploit legitimate entry points.
Effective hardening strategies include:
Building on my WiFi access point example from Stage Two, if our network had been hardened with proper device authentication, the unauthorized access point would have been prevented from connecting to the network in the first place, regardless of having correct passwords.
Hardening also means securing legitimate BYOD (Bring Your Own Device) policies. Without proper controls, employee-owned devices can introduce malware and other threats into your environment. By implementing device registration, health checks, and conditional access policies, you significantly reduce this risk.
Stage Four: Raise the Cost of an Attack
The final stage focuses on making attacks so resource-intensive and difficult that adversaries are likely to abandon their efforts or move to easier targets.
Most attackers follow the path of least resistance. If breaching your defenses requires extraordinary effort, time, and resources, all but the most determined attackers will look elsewhere. This stage implements strategies that:
Advanced security controls can deter even the most sophisticated attackers. However, the infamous SolarWinds attack reminds us that determined adversaries will find alternative paths when direct attacks are too costly. Rather than attempting to breach each target organization individually, the attackers compromised the software supply chain—inserting malicious code into trusted software updates that were then distributed to thousands of organizations. This demonstrates why the Four Stages of Information Security must extend beyond your immediate environment to include third-party relationships and supply chain considerations.
Implementing the Four Stages of Information Security
For organizations looking to apply this framework, I recommend these practical steps:
- Start with a comprehensive inventory: Use automated tools and manual verification to document your entire technology environment.
- Prioritize reduction opportunities: Focus first on eliminating the most prominent security risks, such as unused services and unnecessary access points.
- Establish hardening standards: Create security baselines for each type of system in your environment, from servers and workstations to network devices and applications.
- Layer your defenses strategically: Implement complementary security controls designed to work together, creating multiple obstacles for potential attackers.
- Test your defenses regularly: Use penetration testing and red team exercises to identify weaknesses in implementing the Four Stages of Information Security.
Conclusion
The Four Stages of Information Security provides a methodical approach to strengthening your organization’s security posture. By systematically identifying, reducing, hardening, and elevating your defenses, you create a significantly more resilient environment against cyber threats.
Remember that information security is not a one-time project but an ongoing process. Threats evolve, new vulnerabilities emerge, and your environment changes over time. Regularly revisiting each of the four stages ensures your security controls remain effective against current threats.
Implementing this framework transforms your approach from reactive firefighting to strategic security management, making your organization a much harder target in an increasingly dangerous digital world.
