Enterprise risk management INFO 312 AUTUMN 2015 UNIVERSITY OF WASHINGTON INFORMATION SCHOOL WEEK #5B OCTOBER 28, 2015

Quick Reminders Please actually read the speaker’s bio and the website of the program they are responsible for, and base your questions on that material. I do not consider “What is largest threat you face?” (or variants of that question) to be a real question since I will already have asked it . Going forward, if your question is too generic, I’ll only give you .5 point for it. Your group presentations: I have not given any group a perfect score, but I have not given low grades either. If you are looking for a perfect grade, you will have to provide analysis of your event or unusual recommendations that I’ve not yet seen in the presentations (see #4 on Assignment). I know that 20 minutes is not a long time, so you might consider which are the most salient points you wish to make, and where/when in your presentation they are made so that you each get a chance.

NIST CYBERSECURITY FRAMEWORK Technology, the Great Enabler Convenience v. Security

History Most elements of the new framework in place a year after the president issued his executive order in 2013 that called for the development of a voluntary risk-based Cybersecurity Framework: “to maintain a cyber environment that encourages efficiency, innovation and economic prosperity while promoting safety, security, business confidentiality, privacy and civil liberties.” Voluntary means “no new regulations on business” at least from White House “NIST” is National Institute of Standards and Technology

Framework core structure

Function and Category Identifiers

Sample category with references

Risk-based approach

Privacy & civil liberties & infrastructure Though a methodology requested by the president, not much to be found on how to incorporate individual privacy and civil liberties. 16 critical infrastructure sectors in the US, in which both the public and private sector operate (though 90% owned by the private sector, regulation is present in each of the sectors, often from regulatory agencies) Each sector contains both physical assets that need to be protected as well as virtual assets that have increasingly come under attack from hackers and from nation state players, no matter what the size of the organization or its cyber sophistication level. Of the 16 sectors, my focus is usually on banking and finance, energy, technology, communications, emergency services and public health. Your final paper could look at a company or agency in any critical infrastructure sector, or at the sector in general in terms of its risk mgmt.

Questions? asearle@uw.edu abbast@uw.edu