Relevant Impact Building an Enterprise Security Program Tech Security ConferenceMinneapolis April 10, 2014

a few thoughts about all this security…

Most North American Enterprises and Government Agencies have experienced a breach…

Meet John, a successful, seasoned information security practitioner

His understanding of regulation, best practice and technical subjects allows him to solve any issue his organization may face.

… he was asked to be CISO

Build a security program guaranteeing effective protection and compliance of the organization at all times.

“It’s about the data. Security professionals have to start taking a data view of their organizations. It’s all around ‘Where is the data?’ and ‘Who is supposed to do what with it?’ which, in a huge corporation, is a huge challenge.” Marlene N. Allison, Worldwide Vice President of Information Security, Johnson & Johnson

Appropriate Content Control = Web Proxy + Filtering + SIM DDoS Prevention = Redundant links + Specialized Routers + HA Applications Privacy Compliance = DB Controls + Policies + File Inventory + DLP + SIM + Ticketing System + Enterprise Policies + Training Program…

Then the inevitable… Technology Changes Old clients New vendors

The auditor said policy violations had been “ENABLED” by bad technology, chosen through a flawed process that was based on poor logic.

Frustration set in as he tried to go back to the drawing board… ….then the unexpected.

He was notified that the organization may have an APT in the environment…

John thought about his predicament…

…and had an epiphany.

“This shouldn’t be my problem...”

…an effective security program starts with a strategy and must be aligned to the business.

Creating an Effective Security Program Strategy 1. Impact based approach 2.Establish business context 3.Develop strategic services

An impact approach identifies scenarios relevant to organizational assets Impact Based Approach

Risk Context Business Attributes Overall likelihood of loss Likelihood of threat materialising Likelihood of weakness exploited Negative Outcomes Threats Loss Event Positive Outcomes Opportunities Beneficial Event Overall loss value Asset value Negative impact value Overall benefit value Asset value Positive impact value Overall likelihood of benefit Likelihood of opportunity materialising Likelihood of strength exploited

Risk & opportunities are assessed with owners focusing on impact and enablement CBA B C BC CC LowMediumHigh Likelihood Business Impact Low Medium High A Beyond our risk appetite B Warning C Within risk appetite

How do you develop a security program that focuses on what is important to the business? Establishing Business Context

Identify business relations and owners impacted by threats to information assets Customers Suppliers Partners Others… Your Organization

Working with the business owners abstract requirements into measurable “assets”

Establishing understood metrics created by owner’s appropriate accountability, managing to impact can be facilitated Enterprise Level Strategic Business Attributes Profile Change Program Business Attributes Profile Project Business Attributes Profile Operational Processes and Systems Business Attributes Profile

How can you map required functionality for any security service to a continually changing, improving environment until the end of your operational days? Developing Strategic Services

Based on identified impacts to the attributes, a multi-tiered control strategy can be used to define security services the organization required

Enterprise security architecture builds traceability and justifications for services, processes and technologies implemented.

John had been asked to build a security program guaranteeing effective protection and compliance of the enterprise at all times.

He used: An impact-based approach to assess risk & opportunities with owners. Enterprise Security Architecture techniques to articulate the complete business requirements and prioritize the program. Enterprise Security Architecture processes to build tractability to and justify implementations of security services.

Lessons Learned Threat-based approaches will not work long term Impact based accountability is key Enterprise Security requires an Enterprise Strategy Strategy must drive services and the technologies in a traceable, justified manner

Great things to think about… Does your organization have clear definition and executive ownership over business impacts? Are there clear linkages from the security program metrics to business performance? Does your organization have a strategic view of the services your Security Program is delivering the organization?

Patrick M. Hayes Managing Director THANK YOU