1. Strategy: If you don’t know where you’re going, you’ll never get there
Don Welch, Ph.D.
CISO

3. Agenda Introduction Risk Strategy Basics IT and Business Strategy
Strategic Analysis
Design Framework
Communicating the Strategy

4. Introduction

5. Why listen to me?

6. Cyber Security Environment

9. Foreign Intelligence

10. Criminals

11. Hacktivists

12. C-Level Leaders

13. Risk

16. Strategy 101

17. Strategy: Definition
High level plan to achieve one or more goals under conditions of uncertainty
WikiPedia

18. Strategy: Definitions
A pattern in a stream of decisions
Henry Mintzberg, McGill University

19. Strategy: Definitions
Planning and marshalling resources for their most efficient and effective use
Business Dictionary

20. Strategy: Definitions
Plan to achieve long-term goals
Guide for decisions at all levels
Efficient and effective resource allocation

23. Asymmetry and Adversaries

25. Strategic Environment Analysis
Threat
Asset
Impact
Attacker
Payoff
Capability

27. Constraints Funding Regulations and Laws Staff Time and Talent
Business Overhead
Political Capital
Accountability
Calendar Time

30. Coverage Matrix People Process Technology Identify Protect Detect
Respond
Recover

31. Example Nested Matrix Detect/Technology Near Real-Time Post Compromise
Network
Payload
Endpoint

32. Example Nested Matrix Protect/People Users IT Staff Security Mandatory
Optional

34. Written Plan
One Pager
< 10 Pages
Full Document

40. Information Security Strategy
Identify
Low
Protect
Moderate
High
Watch
High + (Restricted)
Recover
Respond