Selling Security to the Business Peter Frøkjær ADP Global Security Organization In:dk.linkedin.com/in/froekjaer/  : / How Security communicate with the Business How to add value to the business How to build a Global Security Organization How Security communicate with the Business How to add value to the business How to build a Global Security Organization

2 What is ADP?  Payroll Services, Human Resource Management & Benefits Administration  Dealer Management System & Digital Marketing Solutions

3 Security as a Business Enabler  The way Security interact with the business has changed.  Today, however the time where the default answer from Security was “No” has changed. We are now primarily Influencing and motivating the Business as a key Player.  We are now supporting Business Decisions, providing Security Services, ensuring Compliance and adding Business Value by Political Influence. To be a Successful Influencer, we need to understand the Business Strategy. We are responsible to design our communication to fit the recipients!

4 How should Security navigate in a global Enterprise? –Build a Global Security Organization (and Business Security Org.) : –Integrate into the Business. –Integrate into IT, and other critical processes.

5 Communicate with the business  The Language Of The Boardroom: RI$K!!  Security MUST learn the language of the Business. geert-hofstede.com/countries.html Expect the unexpected You don’t know what you don’t know. Jungian theory on personality types Understand and Adapt to Personalities and Personality Types. Understand and Adapt to Cultural differences.

6 Communicating with the Business BU Requests and Consumes Consulting & Services GSO Provides Consulting & Services GSO Drives Projects, Program & Policies

7 An example of: Influence by motivation EU Data Protection proposals - Administrative sanctions  Fines of up to 250,000 EUR or 0.5% of annual worldwide turnover (mechanisms for requests or non- response)  Fines of up to 500,000 EUR or 1% of annual worldwide turnover (incomplete information, not transparent, right to be forgotten, form/format)  Fines of up to 1,000,000 EUR or 2 % of annual turnover (no legal basis, no representative, security provisions, breach reporting)

8 Add value to the Business: Monitor Security events and detect Fraud RSA and other Anti- Fraud Command Centers Protect and ensure: Integrity of the Brand Client Assets Personal Info Compliance DLP Event Enrichment Location Identity Division Business Data Value Asset Value Geo Info Regulation CIRC NCC SCC ThreatsIncidentsAssets GRC Aggregation Enterprise Reporting

9 Add value to the Business: Securely implement Business Enabling technologies F5 Internet Firewall PDAN Firewall DB Firewall PDAN Firewall App Web PDAN SSL Offload Adoptive Authentication Web Application Firewall Load Balancing Mobile access Web Services New Innovation Event Enrichment Location Identity Division Business Data Value Asset Value Geo Info Regulation CIRC NCC SCC Threats Incidents Assets GRC Aggregation Enterprise Reporting

10 Thank You – Q&A AV Auth WAF DLP AD WLAN DPI URL FW IDS Event Enrichment Location Identity Division Business Data Value Asset Value Geo Info Regulation CIRC NCC SCC ThreatsIncidentsAssets GRC Security Events Eng. HR Legal Sales VPN MDM uVM SB AI Aggregation Enterprise Reporting