Visibility. Intelligence. response Information Security: Risk Management or Business Enablement? Mike Childs Vice President Rook Security

Agenda  Why Should We Care?  The View from the Top  Risk Management or Business Enablement  Case Study

Why Should We Care? 3

Data Breaches

// Source of Data Breaches Source: Verizon Business Data Breach Report Verizon Business 2013 Data Breach Report

// Timeline of a Breach Source: Verizon Data Breach Report 2015 In 60% of cases, attackers are able to compromise an organization within minutes.

How are breaches identified? Source: Verizon Business Data Breach Report Only 3% of breaches were detected with common security controls

The View from the Top 8

Business View Of Information Security How does this fit into our business strategy? Why do we have to change our passwords every month? You can’t impact our network latency! What is the Return on Investment? Two Factor Authentication takes too long! Isn’t that too difficult for our clients?

Risk Management or Business Enablement? 10

Question 11

Key Business Drivers For Risk Management  Regulatory Compliance  Maintain Continuity  Prevent Financial Loss  Detect Unauthorized Access

Key Business Drivers For Business Enablement  Protect Brand Reputation  Contractual Obligations  Third Party Vendor Audits  Expanded Business Opportunities

Case Study 14

Healthcare Services Company  Develop an Information Security Strategy  Focus on how to protect the business and its data  Develop strategy based on the risk to sensitive data  Align regulatory compliance standards with information security strategy  Develop and implement policies, standards, and procedures to support the Information Security Strategy  Integrate policies, standards, and procedures into regular business processes  Develop and Test an Incident Response Plan  Plan should include detecting, responding to and limiting the effects of an information security event

Questions? Mike Childs Office: x711