The Security Dashboard Visualizing IT and Business Risk Information Security Decisions October 6, 2004

Panelists Pete Lindstrom, Spire Security Shon Harris, Logical Security Bill Boni, Motorola Moderator: Andy Briney, InfoSecurity

What’s a Security Dashboard?

Dashboard Wish List 1. Simplifies the management of operational and IT security activities. 2. Correlates data from multiple sources and turns it into actionable information. 3. Maximizes technology investments by integrating with existing products. 4. Measures compliance with accepted practices, internal standards and government regulations (ISO 17799, GLBA, HIPAA, Basel II). 5. Tracks vulnerabilities and remediation status. 6. Prioritizes remediation activities by business impact. 7. Maintains historical information for trend analysis. 8. Maintains prioritized remediation action plans. 9. Facilitates communication between the Business, Information Security, Operations, Audit/Compliance and Risk Management. 10. Produces a meaningful management console/dashboard. Source: Steve Katz

In a Nutshell… Asset discovery and management Vulnerability remediation Threat correlation and assessment Compliance/policy management Reporting/audit Prioritizes risks, remediation workflow Treats operational risk as a lifecycle

How realistic is Andy’s wish list? 1.It’s real: I’m running a management system that does most of this 2.Likely to happen, but not for a few years 3.Unlikely to happen in the near future 4.What you’re asking for is impossible. 5.I dunno enough about this to have an opinion.

Now, for a dose of reality DASHBOARD OBSTACLES Poorly conceived and executed risk analysis models and processes Constantly changing risk environment Evolving (immature?) technologies Immature communications protocols and standards: No lingua franca Poor understanding of relationship of technical risk to business risk