1. Evolving the Cyber Security Program
Michael Watson
Chief Information Security Officer
ISACA
3/12/2015 1

2. Overview Program Overview Existing Structure
Information Security Challenges
New Concepts

3. CoVA IT Infrastructure
Computers
59,374 PCs
3,356 servers
Mailboxes
58,948 accounts
Data storage
1.5 petabytes
Mainframes (2)
IBM
Unisys
Communications
55,000 desk phones
6,100 handhelds (PDAs)
11,000 cell phones
Networks
2,039 circuits
Data Centers (2)
CESC
SWESC
Printers
5,311 network
22,000 desktop
2,247 Locations

4. Information Security in the Commonwealth
VITA is tasked with security governance of all three branches of Commonwealth Government.
VITA controls the infrastructure of the executive branch agencies. Agencies remain responsible for application management.

5. COV Information Security Program
IT Security Audit Program
Sensitive systems audited every 3 years
Sensitive systems list provided by the auditor
Risk Management Program
Business impact analysis
Risk assessment
Vulnerability and intrusion detection data
Assessment and audit analysis

6. Our Current Posture How well have we reviewed our environment?
What are the consistent issues in our environment?

7. 2014 Information Security Audit Program

8. Sensitive System Review Status

9. 2014 Findings by Control Family

10. Challenges

11. Evolution

12. Risk and Executive Support

13. Culture and Funding

14. Future Program Changes
Threat Management
Incorporate vulnerability and intrusion detection information
Automate information sharing

15. Future Posture
What are we doing to mitigate our most significant risks?
How does a new threat impact our landscape?
Are we monitoring the business’s current areas of concern?
Are we dedicating the resources to maintain our risk posture and address identified risks?

16. Questions? 16