Strategy: If you don’t know where you’re going, you’ll never get there Don Welch, Ph.D. CISO

Agenda Introduction Risk Strategy Basics IT and Business Strategy Strategic Analysis Design Framework Communicating the Strategy

Introduction

Why listen to me?

Cyber Security Environment

Foreign Intelligence

Criminals

Hacktivists

C-Level Leaders

Risk

Strategy 101

Strategy: Definition High level plan to achieve one or more goals under conditions of uncertainty WikiPedia

Strategy: Definitions A pattern in a stream of decisions Henry Mintzberg, McGill University

Strategy: Definitions Planning and marshalling resources for their most efficient and effective use Business Dictionary

Strategy: Definitions Plan to achieve long-term goals Guide for decisions at all levels Efficient and effective resource allocation

Asymmetry and Adversaries

Strategic Environment Analysis Threat Asset Impact Attacker Payoff Capability

Constraints Funding Regulations and Laws Staff Time and Talent Business Overhead Political Capital Accountability Calendar Time

Coverage Matrix People Process Technology Identify Protect Detect Respond Recover

Example Nested Matrix Detect/Technology Near Real-Time Post Compromise Network Payload Endpoint

Example Nested Matrix Protect/People Users IT Staff Security Mandatory Optional

Written Plan One Pager < 10 Pages Full Document

Information Security Strategy Identify Low Protect Moderate High Watch High + (Restricted) Recover Respond