Information Security: Risk Management or Business Enablement? Mike Childs Vice President Rook Security

Agenda Why Should We Care? The View from the Top Risk Management or Business Enablement Case Study

Why Should We Care?

Data Breaches

// Source of Data Breaches Source: Verizon Business Data Breach Report Verizon Business 2013 Data Breach Report Verizon Business 2013 Data Breach Report

// Timeline of a Breach In 60% of cases, attackers are able to compromise an organization within minutes. Source: Verizon Data Breach Report 2015

How are breaches identified? Only 3% of breaches were detected with common security controls Source: Verizon Business Data Breach Report

The View from the Top

Business View Of Information Security Two Factor Authentication takes too long! How does this fit into our business strategy? What is the Return on Investment? You can’t impact our network latency! Isn’t that too difficult for our clients? Why do we have to change our passwords every month?

Risk Management or Business Enablement?

Question Why Not Both?

Key Business Drivers For Risk Management Regulatory Compliance Maintain Continuity Prevent Financial Loss Detect Unauthorized Access

Key Business Drivers For Business Enablement Protect Brand Reputation Contractual Obligations Third Party Vendor Audits Expanded Business Opportunities

Case Study

Healthcare Services Company Develop an Information Security Strategy Focus on how to protect the business and its data Develop strategy based on the risk to sensitive data Align regulatory compliance standards with information security strategy Develop and implement policies, standards, and procedures to support the Information Security Strategy Integrate policies, standards, and procedures into regular business processes Develop and Test an Incident Response Plan Plan should include detecting, responding to and limiting the effects of an information security event

Questions? Mike Childs Office: 888.712.9531 x711 mike.childs@rooksecurity.com www.rooksecurity.com