Cybersecurity is not a new issue! Dr. Edgar Frank Codd, an IBM researcher, wrote a paper that described the fundamental model of the relational databases that today underpin virtually every major company’s operations. The paper outlined the need for the ‘shared data banks’ to have the attributes of data consistency, integrity, security and privacy. This paper was published in 1970, but its goals are just as relevant today!

Cyber Stress Factors Media coverage (D)evolving workforce Hyper-connectivity People, people, people Cyber talent shortages Legislation, Regulation, Contracts These drivers vary by industry, region and corporate culture

Lessons (to be) Learned Access restrictions Authorization enforcement Segregation of duties Vendor management Root cause analysis Risk-based oversight Is this Déjà vu all over again?

Use of Frameworks is Expanding Source: NIST Cybersecurity Framework 4 Extends the classic security life cycle functions to include Identify The model is more proactive - Business and Governance are key risk aspects The model includes analytics, supply chain risk management, continuous monitoring An emerging imperative is enhancing the role of Internal Audit in risk management ISACA has released an implementation guidance document as part of CSX Other frameworks include COBIT 5 and ISO/IEC 27000

Cybersecurity Roadmap Adopt a risk and control framework Assess your risk profile and appetite Inventory your capabilities and people Define a cyber security strategy Develop an integrated oversight plan Periodically report, review and revise Be pragmatic to create change that is evolutionary and less disruptive

Take on the Challenge for Change The journey begins with each of you: Take a fresh look at your role Become an active participant Be bold - challenge the status quo Increase IA/IS/IT transparency Make audits more meaningful Cybersecurity improvements often need to occur one person at a time

Closing Thoughts Cyber threats constantly change the game Data breaches will continue to focus on finding and exploiting the weak links Perfect security isn’t possible, so flexibility, agility and resilience must be the priority Audit should be playing a stronger role in evaluating the adequacy of risk management A strong partnership between IT, Security and Internal Audit can make a real difference Be prepared, individually and organizationally, instead of being paranoid!

Contact Info: Michael Gerdes Director, Information Security COE Experis