Skip to main content
UploadLanguage (EN)Support
BusinessMobileSocial MediaMarketingTechnologyArt & PhotosCareerDesignEducationPresentations & Public SpeakingGovernment & NonprofitHealthcareInternetLawLeadership & ManagementAutomotiveEngineeringSoftwareRecruiting & HRRetailSalesServicesScienceSmall Business & EntrepreneurshipFoodEnvironmentEconomy & FinanceData & AnalyticsInvestor RelationsSportsSpiritualNews & PoliticsTravelSelf ImprovementReal EstateEntertainment & HumorHealth & MedicineDevices & HardwareLifestyle
Uploaded byParishSummer
PDF, PPTX2,230 views

Microsoft-CISO-Workshop-Security-Strategy-and-Program (1).pdf

The document discusses a CISO workshop agenda to modernize a security strategy and program. It includes: - An overview of who should attend, such as the CISO, CIO, security directors, and business leaders. - The agenda covers key context and fundamentals, business alignment, and security disciplines. - Exercises are included to assess maturity, discuss recommendations, and assign next steps. - Modules will provide guidance on initiatives like secure identities and access, security operations, and data security.

Technology◦
Download as PDF, PPTX
CISO Workshop Security Program and Strategy Your Name Here MENU
CISO Workshop & Architecture Design Session (ADS) You are Here
Who should be in the CISO Workshop? Primary Participants • CISO + Security Directors - Helps modernize security strategy and program components, integrate security into larger organization • CIO + IT Directors – Helps integrate security into technology program, cloud, and other initiatives • Enterprise + Security Architects – and other roles with broad strategy/technology responsibilities Optional Attendees • Business IT leads, Business initiative owners that sparked discussion – helps integrate security into business initiatives and better understand security dependencies • Cloud Lead / Cloud Team (if formed) – help integrate security into cloud initiatives and reduce unhealthy friction between teams • Any supporting partners and integrators chosen by those roles Note: This workshop is essential for people performing the functions that align with the roles above and is also useful to many other roles within an organization
Agenda A. Key Context and Fundamentals Threat trends, Role & Responsibility Evolution, Strategy and Recommended Strategic Initiatives to structure security transformation B. Business Alignment Engage business leaders on security, align to business priorities and risk management, integrate security in IT/Business and build business resilience C. Security Disciplines Provide a clear structure for durable security program elements Exercises 1. Assess against maturity model based on real world journey 2. Discuss prescriptive recommendations to improve programs 3. Assign next steps
This presentation is interactive! Using PowerPoint Zoom Navigation
Introductions Name Role Expectations for today
❑ Modern Access Control ❑ Modern Security Operations ❑ Infrastructure and Development ❑ OT and IoT Security ❑ Data Security & GRC
Module 2 – Secure Identities and Access Module 3 – Modern Security Operations (SecOps/SOC) Module 4 – Infrastructure & Development Security Module 5 – Data Security & Governance, Risk, Compliance (GRC) Module 6 – IoT and OT Security What’s on your current priority list? Secure Identities and Access Modern Security Operations Infrastructure and Development Data Security & GRC OT and IoT Security ________________________________ # # # # # # Start Date / In Progress Start Date / In Progress Start Date / In Progress Start Date / In Progress Start Date / In Progress Start Date / In Progress Other Ransomware Recovery Readiness Start Date / In Progress
Common Security Initiatives Mapping business outcomes to technical initiatives Implementation Architects & Technical Managers CIO Technical Leadership CISO Business Leadership CEO Align security to business priorities Security Program and Strategy / Cloud Adoption Framework (CAF) - Secure Methodology Secure hybrid work Secure Identities and Access Modernize incident response Modern Security Operations (SOC) Secure cloud migration Infrastructure and Development Security Find and protect critical data Data Security & Governance, Risk, Compliance (GRC) IoT and OT Security Protect Industrial Control Systems
Implementation Architects & Technical Managers CIO Technical Leadership CISO Business Leadership CEO CISO Workshop & Architecture Design Session (ADS) Business and Security Integration Implementation and Operation Technical Planning Architecture and Policy Security Strategy, Programs, and Epics Securing Digital Transformation CISO Workshop Security Program and Strategy End-to-end Security Program Guidance + Integration with Digital & Cloud Transformation Teams Module 2 – Secure Identities and Access Module 3 – Modern Security Operations (SecOps/SOC) Module 4 – Infrastructure & Development Security Module 5 – Data Security & Governance, Risk, Compliance (GRC) Module 6 – IoT and OT Security Security Architecture Design Session Module 1 – Zero Trust Architecture Engaging Business Leaders on Security
Strategy Architecture Implementation Operation Learning What’s in these workshops? Business Alignment and Cloud Transformation Rosetta Stone for all security models Success Metrics End to End Scenarios Detailed Architecture Information on Initiatives Technical Plan for initiative (roles, outcomes, etc) Summary of initiatives Ransomware Guidance Overall Architecture Security Disciplines and Program Structure CISO Workshop Security Program and Strategy End-to-end Security Program Guidance + Integration with Digital & Cloud Transformation Teams Module 1 – Zero Trust Architecture and Ransomware Modules 2-6 Role and Responsibility Evolution Threat Trends Zero Trust RaMP Product Documentation Zero Trust Strategy SASE
Implementation Architects & Technical Managers CIO Technical Leadership CISO Business Leadership CEO Business and Security Integration Implementation and Operation Technical Planning Architecture and Policy Security Strategy, Programs, and Epics Securing Digital Transformation Planning for each role Documentation Step by Step Instructions on Microsoft Docs site Enables a Zero Trust transformation Reference plans for 3 entry points ➢ Complete end to end security modernization ➢ Quick wins across all initiatives (Zero Trust RaMP) ➢ Microsoft 365 Zero Trust capabilities
A security program bridges two worlds Aligning security to business outcomes + apply Zero Trust security principles and best practices Ready Plan Adopt Define strategy Manage Govern Cloud Adoption Framework (CAF) - Secure Methodology Security ADS Workshop Program Guidance Secure CISO Workshop End-to-end Security Program Guidance + Integration with Digital & Cloud Transformation Teams Module 1 – Zero Trust Architecture and Ransomware Module 2 – Secure Identities and Access Module 3 – Modern Security Operations (SOC) Module 4 – Infrastructure & Development Security Module 5 – Data Security & Governance, Risk, Compliance (GRC) Module 6 – IoT and OT Security
Start Here – with key context and fundamentals Business Alignment – Continuously Prioritize and integrate security CISO Workshop End-to-end Security Program and Strategy Guidance + Integration with Digital & Cloud Transformation Teams Priorities Discussion Business Alignment Exercise Risk Insights Security Integration Business Resilience Engaging Business Leaders on Security Access Control Security Operations Asset Protection Security Governance Innovation Security Security Governance Exercise Next Steps Security Disciplines – Establish and Evolve Foundational Capabilities Strategy and Recommended Initiatives Roles & Responsibilities Threat Environment and Trends Zero Trust Principles Assume breach | Explicitly Verify | Least privileged Cloud Adoption Framework (CAF) Secure Methodology Decision Makers
Complex Technical Estate Hybrid of Everything IT, IoT, OT, Hybrid and multi-cloud Legacy won’t go away 30+ years of technology layers Always Changing DevOps, Infrastructure as Code, etc. Complexity is driving urgent security changes Increased Security Threats Growing Business Impact with extortion & ransomware Increasing Sophistication with new techniques Commoditization with “as a service” models Modernize & Simplify with Zero Trust Stay focused, move fast, & adapt quickly Align to Business + IT Build a partnership Transform teams to embrace innovations Simplify architecture, configuration, & tech portfolio Continuous improvement across people, processes, and technology Dynamic Business Environment
Email & Collaboration On-Premises Identities Phishing mail Open attachment Click a URL Browse a website Exploitation and Installation Command and Control Cloud Identities Brute force account or use stolen account credentials User account is compromised Attacker collects reconnaissance & configuration data Attacker attempts lateral movement Privileged account compromised Domain compromised SaaS Apps Attacker accesses sensitive data Exfiltration of data Leading indicators History of violations Distracted and careless Disgruntled or disenchanted Subject to stressors Insider has access to sensitive data Anomalous activity detected Data leakage Potential sabotage Endpoints & Cloud Infrastructure Imperative: Coverage for common attack chains Insider Risks IoT (& OT) Disrupt OT Environment IoT Device Exploitation
For sale in “bad neighborhoods” on the internet Attacker for hire (per job) $250 per job (and up) Ransomware Kits $66 upfront (or 30% of the profit / affiliate model) Compromised PCs / Devices PC: $0.13 to $0.89 Mobile: $0.82 to $2.78 Spearphishing for hire $100 to $1,000 (per successful account takeover) Stolen Passwords $0.97 per 1,000 (average) (Bulk: $150 for 400M) Denial of Service $766.67 per month Attackers Other Services Continuous attack supply chain innovation How this shaped Microsoft investments How this complicates fact validation
Note: Sophisticated attackers sometimes use commodity toolkits to hide their origin Don’t believe everything you see Facts are naturally obscured Demand for facts far exceeds ability to provide (expensive to positively identify attackers, most useful defenses, etc.) Attack economy adds complexity Profit driven actors re-use tools, sell ready made kits, and monetize attacks in multiple ways (extortion / ransomware, selling passwords/access, data, etc.) Deliberate Deception Hides More Sophisticated attackers often deliberately pretend to be something else (use commercial tools, hide data theft in DDoS attacks, etc.)
Azure Security Capabilities and Guidance Attacker for hire (per job) Ransomware Kits Compromised PCs / Devices Spearphishing for hire $100 to $1,000 (per successful account takeover) Stolen Passwords Denial of Service Attackers → Native Security Controls and integration with existing security capabilities Native Threat Detection (& SIEM) Secure Azure, Azure AD, Windows, Linux, iOS, Android, SaaS apps + correlate with cloud native SIEM+SOAR+UEBA (Azure Sentinel) Passwordless and Multi-factor Authentication (MFA) Mitigate common and effective identity and password attacks with biometrics, hardware security, and threat intelligence Native Firewall and Network Security Protect business-critical assets with Azure Firewall, DDoS protection, & integrated web application firewall (WAF) → Industry Collaboration with customers, NIST, CIS, The Open Group, and others Azure Security Guidance Top 10 Best practices Azure Security Benchmarks Cloud Adoption Framework (CAF) Well Architected Framework (WAF) + Top 10 Best practices
(hundreds of millions of dollars paid)
2021 Microsoft Digital Defense Report contents CHAPTER 1 Introduction Introduction Our 2021 focus areas CHAPTER 2 The state of cybercrime The cybercrime economy and services Ransomware and extortion Phishing and other malicious email Malware Malicious domains Adversarial machine learning CHAPTER 3 Nations state threats Tracking nation state threats What we’re seeing Analysis of nation state activity this year Private sector offensive actors Comprehensive protections required CHAPTER 4 Supply chain, IoT, and OT security Challenges in managing risk associated with the supplier ecosystem How Microsoft thinks about supply chain IoT and OT threat landscape The 7 properties of highly secured devices Applying a Zero Trust approach to IoT solutions IoT at the intersection of cybersecurity and sustainability IoT security policy considerations CHAPTER 5 Hybrid workforce security A Zero Trust approach for securing hybrid work Identities Devices/Endpoints Applications Network Infrastructure Data People CHAPTER 6 Disinformation Disinformation as an emerging threat Mitigation through media literacy Disinformation as an enterprise disruptor Campaign security and election integrity CHAPTER 7 Actionable insights Five cybersecurity paradigm shifts Summary of report learnings Conclusion Contributing teams at Microsoft Download the full report at https://aka.ms/MDDR
• • • • Next Up: 1A – Strategy and Recommended Initiatives CISO Workshop
Information Risk Management Supply Chain Risk (People, Process, Technology) Program Management Office (PMO) Managing Information/Cyber Risk Security responsibilities or “jobs to be done” December 2021 - https://aka.ms/SecurityRoles Posture Management Incident Management (IT, IoT, OT) Incident Response Threat Hunting Incident Preparation
Information Risk Management Supply Chain Risk (People, Process, Technology) Program Management Office (PMO) Working Together on Information/Cyber Risk Increase collaboration across teams Posture Management Incident Management Incident Response Threat Hunting Incident Preparation Prevention Response
DevOps/DevSecOps Leadership Innovation Security Application Security Application Owners Users Mapping Roles to Disciplines Requires collaboration between IT and Security teams Data Security Network Security Identity Security Infrastructure security (Servers, Endpoints, Containers, Storage, etc.) Security Architect Security Governance / Project Management Risk and Posture Management Technical Leadership CIO, CISO, CTO, and Chief Risk/Compliance Officer Business Leadership CEO, Board, Other CxOs, and Business Unit/Line Leaders IT Admin / IT Leadership Identity Architect MDM Admin IT Architect Identity Admin End User Developer Access Control Asset Protection Security Governance OT Operations SecOps Leadership SecOps Analysts & Threat Hunters Incident Response and Hunting Security Operations Typically in IT Organization Typically in Security Organization
Identify Protect Detect, Respond, Recover Feedback loop Security Roles and Responsibilities Business and technology outcomes Security outcomes Plan Identify opportunities Governance Architecture and Compliance Build Execute and capture value Prevention Access control Asset protection Run Sustain and adapt Role Types Security Posture & Compliance Platform Security Engineer App Security Engineer Responsibilities “Jobs to be done” / Organizational functions aka.ms/securityroles Security leadership Security architecture Posture management Policy and standards Security compliance management Identity and key management People security Data security Application security & DevSecOps Infrastructure and endpoint security • Network security • Server/VM security • Client endpoints/devices Response Security operations Security Leadership Roles Security Architect Roles Incident monitoring & response Threat Hunting IT & OT Operations, DevOps Security Operations Threat intelligence Incident preparation
Identify Protect Detect, Respond, Recover Feedback loop Security Roles and Responsibilities Business and technology outcomes Security outcomes Plan Identify opportunities Governance Architecture and Compliance Build Execute and capture value Prevention Access control Asset protection Run Sustain and adapt Role Types Security Posture & Compliance Platform Security Engineer App Security Engineer Responsibilities “Jobs to be done” / Organizational functions aka.ms/securityroles Security leadership Security architecture Posture management Policy and standards Security compliance management Identity and key management People security Data security Application security & DevSecOps Infrastructure and endpoint security • Network security • Server/VM security • Client endpoints/devices Response Security operations Security Leadership Roles Security Architect Roles Incident monitoring & response Threat Hunting IT & OT Operations, DevOps Security Operations Threat intelligence Incident preparation Security isn’t that different Security maps well to standard business plan – build - run stages
Identify Protect Detect, Respond, Recover Feedback loop Security Roles and Responsibilities Business and technology outcomes Security outcomes Plan Identify opportunities Governance Architecture and Compliance Build Execute and capture value Prevention Access control Asset protection Run Sustain and adapt Role Types Security Posture & Compliance Platform Security Engineer App Security Engineer Responsibilities “Jobs to be done” / Organizational functions aka.ms/securityroles Security leadership Security architecture Posture management Policy and standards Security compliance management Identity and key management People security Data security Application security & DevSecOps Infrastructure and endpoint security • Network security • Server/VM security • Client endpoints/devices Response Security operations Security Leadership Roles Security Architect Roles Incident monitoring & response Threat Hunting Threat intelligence Incident preparation Build strong relationship and processes Security Operations needs to have a close working relationship IT Operations and with DevOps teams to enable rapid response and recovery IT & OT Operations, DevOps Security Operations
Identify Protect Detect, Respond, Recover Feedback loop Security Roles and Responsibilities Business and technology outcomes Security outcomes Plan Identify opportunities Governance Architecture and Compliance Build Execute and capture value Prevention Access control Asset protection Run Sustain and adapt Role Types Security Posture & Compliance Responsibilities “Jobs to be done” / Organizational functions aka.ms/securityroles Security leadership Security architecture Posture management Policy and standards Security compliance management Identity and key management People security Data security Application security & DevSecOps Infrastructure and endpoint security • Network security • Server/VM security • Client endpoints/devices Response Security operations Security Leadership Roles Security Architect Roles Incident monitoring & response Threat Hunting IT & OT Operations, DevOps Security Operations Threat intelligence Incident preparation Platform Security Engineer App Security Engineer Skill Demand is shifting To application-specific security skills (from enterprise-wide platform skills) as trends progress: • DevOps (and Low-Code Applications) increase volume and speed of new applications • Infrastructure as Code and automation reduce manual efforts in IT infrastructure
ESTABLISH CLEAR LINES OF RESPONSIBILITY 1. Designate Decision Makers 2. Publish and Update list 3. Socialize and follow-up CISO Workshop
Who makes security decisions for the cloud?
1. Designate 2. Publish 3. Socialize Identify who owns following up with stakeholders # Stakeholders Point of Contact 1 Security Team 2 IT Operations 3 Cloud Teams 4 DevOps/DevSecOps Teams 5 <Other Stakeholders>
Next Up: Roles and Responsibilities Summary 1. Designate Decision Makers 2. Publish and Update list 3. Socialize and follow-up CISO Workshop
Review – Roles and Responsibilities • Different security specialties reduce organizational risk differently • Prevent, respond, govern, architect, compliance, and more • Security works through IT, OT, IoT, and DevOps teams • Must build strong relationships and processes • Security skill demand is shifting • Designate and publish list of security decision makers Next Up: 1A – Strategy and Recommended Initiatives CISO Workshop
Technology Business The world is transforming rapidly Market Security Attackers
Working together Market Attackers Security Business Technology Digital Transformation Zero Trust Transformation Cloud Transformation
Governance Driving Continuous Improvement Security Shifts to Continuous Improvement Asset Protection Access Assets Innovate with Assets Security Imperatives
Governance Driving Continuous Improvement Security Imperatives Asset Protection Access Assets Innovate with Assets Context to inform decisions, tools, & automation Continuous Improvement Clear guidance that stays current Enablement and Monitoring To ensure security maintenance is performed well and properly Apply Security Standards to all new assets as they are created and updated Accuracy, Impact, and Speed For every response to disrupt attackers (OODA loops) Known, Trusted, Allowed On every access request Clear North Star Describing end state and integration across teams & systems Prioritize and scale Protect business critical assets most & first Apply security consistently at scale & speed
Build Modern Security Common Modernization Initiatives Secure Identities and Access Modern Security Operations Infrastructure and Development OT and IoT Security Data Security & Governance, Risk, Compliance (GRC) Ensure backups are validated, secure, and immutable to enable rapid recovery Ransomware Recovery Readiness
Security initiatives improve one or more disciplines Access Control Security Operations Asset Protection Security Governance Innovation Security Each initiative maps to an Architecture Design Session (ADS) Module Module 2 Module 3 Module 4 Module 5 Module 6
Access Control Security Operations Asset Protection Security Governance Innovation Security Microsoft Cloud Adoption Framework (CAF) Define strategy Understand motivations Business outcomes Business justification Prioritize project Plan Digital estate Initial organization alignment Skills readiness plan Cloud adoption plan Ready Operating model Landing zone concepts Design area guidance Implementation options Adopt Migrate Modernize Innovate Manage Business commitments Operations baseline Operations maturity Govern Business risks Policy & compliance Governance maturity https://aka.ms/adopt/overview https://aka.ms/CAFSecure Secure Risk insights Business resilience Asset protection
Microsoft Cloud Adoption Framework (CAF) Align business, people and technology strategy to achieve business goals with actionable, efficient, and comprehensive guidance to deliver fast results with control and stability. Achieve balance
Assume breach | Explicitly Verify | Least privileged Cloud Adoption Framework | Secure Methodology Security Program and Strategy Guidance Zero trust principles • Assume breach • Explicitly Verify • Least privileged
What is Zero Trust? Zero Trust Security Strategy – Secure digital business assets everywhere Secure Identities and Access Modern identity & network access Modern Security Operations (SOC) Infrastructure & Development Security Data Security & Governance, Risk, Compliance (GRC) IoT and OT Security Secure Access Service Edge (SASE) Assume breach | Explicitly Verify | Least privileged Includes Multiple Technical Modernization Initiatives: Zero Trust History and Standards
Too little security (or skipping it) increases number & impact of security incidents Too much security can block productivity which incents people to bypass authorized systems & protections Increased Risk High Security High Agility Balanced Security Productivity Shadow IT
Assume breach Explicitly Verify Least privileged Zero Trust Principles Strengthen Security Capture business opportunities Increase Business Agility and Mitigate Security Risk Digital Transformation Simplify User Experience – ensure each user role and business process can execute with minimal friction and interruption Agile - adapt rapidly to changing business conditions and technologies with regular contact between business, IT, and security. Sustainable – Ensure sponsors, developers, users, IT, and security maintain a constant pace (and budget) indefinitely. Assume Breach (Assume Compromise) Minimize blast radius with asset centric protections, micro-segmentation, continuous monitoring, and automated threat response Use least privilege access Limit access with just-in-time and just-enough-access (JIT/JEA) and risk-based polices like adaptive access control. Verify explicitly Always make security decisions using all available data points, including identity, location, device health, resource, data classification, and anomalies.
Zero Trust Implementation CISO CIO CEO CFO COO Zero Trust Security Strategy Digital Transformation
“Zero Trust” has been around for a while Increasing consensus and convergence (though still some variations) The Open Group (Home of the Jericho Forum, TOGAF, and more) Forrester ZTX Model
Endpoints Identities Network Applications Infrastructure Data Assume breach | Explicitly Verify | Least privileged Zero Trust Architecture
Zero Trust Architecture Public Private Network Risk Assessment Forensics Threat Protection Threat Intelligence Response Automation Continuous assessment User Experience Optimization Policy Optimization Security Posture Assessment Corporate Personal Human Non-human Device compliance Device risk Strong authentication Identity risk Telemetry/analytics/assessment Traffic filtering & segmentation Classify, label, encrypt, prevent loss Adaptive Access Runtime control Emails & documents Structured data Data Evaluation Zero Trust Policy Enforcement Request Enhancement Apps SaaS Apps On-premises Apps Infrastructure JIT and Version Control IaaS PaaS Int . Sites Containers Serverless
Review - Strategy and Recommended Initiatives • Security’s dual mission: reduce risk + enable the business • Partner and collaborate across Business, IT, and Security teams • Zero Trust Strategy includes multiple initiatives • Zero Trust Principles are critical to modernization Next Up: 1B Business Alignment CISO Workshop
Security is a Team Sport Example: Identifying what is business critical Clients Servers Apps Databases Clouds and more Business What would you restore first if everything was down? • How to protect assets without disruption? • What security threats could cause this? IT / Technology What are technical components of business critical assets?
Reduced Business Friction = Increased Business Agility (and ability to capture opportunities)
“That won’t be us“ Security is not a technical problem (to be ‘solved’). Security is an ongoing risk to be managed (driven by groups of well funded humans)
Partially prepared (~8 weeks) Prepared state (~2-weeks) Reducing Time to Recover = Reducing Lost Revenue (and distractions from business growth) Significant risk of reduced financial performance Unprepared State (16 weeks +) Never plan to ‘Just pay the ransom’
What ‘Unprepared’ is like True Story: Desperate Measures • Programmer wrote a useful application, which worked well and became business critical …years pass… • Programmer retired (and later passed away) …years pass… • Destructive attack erased all copies of business- critical application (among others) • Company finds adult child of deceased programmer on social media… …asks if they have floppy disk with <critical application> in their father’s old boxes …hours pass (that feel like years)… • They find one! And send to company They got lucky, but you may not • Business Down - Most operations are completely down • Zero or limited visibility into operations • Zero or limited ability to execute processes • Pervasive Uncertainty – even if paying the ransom(s) • Unknown/uncertain timeline to restore business operations and return to profitability • Uncertain if keys/tools from criminals will work • Uncertain legal/brand ramifications of paying criminals (who may be affiliated with terrorists) • High likelihood gangs will sell data even after paying ransom • In destructive scenarios, there is no key and IT must be completely rebuilt from the ground up • Unreliable communication with employees & customers (status updates, managing expectations, coordination) • Chaotic communications + leaks to social media. • Slow Recovery – manual restoration of each critical system • Using backups , sh---y ransomware tools, or old disks see true story on desperate/extreme measures → • Teams work endless hours, get exhausted, make mistakes (recover wrong systems, forget basic steps, etc.), get emotional, start burning out and quitting
‘Planning to Pay’ has hidden costs …and doesn’t avoid security investments Legal & Brand Risk (Funding Criminals/Terrorists) Funding Future Attacks on You Restore trust in environment Risk of no recovery (destructive attacks, etc.)
Secure cloud adoption enables rapid secure innovation Secure innovation is the beating heart of an organization in today’s digital landscape Provides a safe foundation Confidentiality, integrity, availability, posture management, governance, and regulatory compliance 2 Provides native Zero Trust security capabilities Built-in controls, monitoring, threat protection, and threat intelligence Enables rapid secure innovation DevSecOps, IaC security, distributed security workflow Secure Cloud Adoption Secure cloud adoption is the foundation of a Trusted Digital Fabric
Components of a Trusted Digital Fabric Safely Enable Business Agility from anywhere Modern security incident response Secure Cloud Migration Secure hybrid work Find and protect critical data Trusted Digital Fabric • Business Agility • Great User Experience
Business Enablement How much security friction is in user experience and business processes? Business Enablement Are we getting better every month? Security Improvement How good are we at preventing damage? Security Posture How good are we at responding to and recovering from attacks? Security Response Starting Points Board Questions Metrics
Example Metrics Focus on continuous improvement Security Scorecard Metrics Supporting Performance Measurements Mean Time for security review # days for application security review Average boot/logon time for managed devices. Number of security interruptions in user workflow % of IT help desk time spent on low-value security activities % of new apps/etc. reviewed Secure score % Compliant apps # of privileged accounts meeting 100% of requirements # of accounts meeting 100% of requirements Mean Time to Acknowledge (MTTA) # of high severity incidents Incident growth rate (overall) Mean Time to Recover (MTTR) Time to Restore Critical Systems # of modernization projects open # modernization project milestones achieved in last 60 days Number of repetitive manual steps removed from workflows # of Lessons learned from internal/external incidents Business Enablement Security Improvement Security Posture Security Response
• What is our financial exposure to security risk? • How prepared are we for extortion/ransomware attack? • Are processes aligned to identifying and protecting business critical processes? (without breaking them) • Are we securing all business-critical assets? (including IT, IoT, and OT) • Can we recover them quickly? • Are we measuring continuous improvement for security? • Is security program balanced across people, process, and tech? • Are the security risk decisions by the right people? Are they prepared and informed to do so? Help focus on key business outcomes
Better security and user experience with Passwordless + working anywhere you want • Business Models and Partnerships • Technology Trends • Regulatory, Geopolitical, Cultural Forces • Disruptive Events • Paradigm Shift to Remote Work Employee → supplier → partners
3. Shift security accountability and oversight to business owners 2. Help protect business critical assets and processes 1. Prioritize secure cloud adoption + modernization investments a. Accelerate secure cloud & app modernization increases productivity and reduce risk b. Normalize preventive maintenance for security reduces downtime & disruption risk a. Identify business critical systems Ensures teams know the top priorities a. Prepare business owners for security risk Owners need security context + expertise to make good decisions b. Sponsor + participate in Cybersecurity BC/DR exercises Reduces impact of real incidents & extortion/ransomware b. Empower business owners to accept security risk • Ensures consideration of all opportunities and risks • Enables agility and collaborative relationship with security Encourage continuous collaboration between business, IT, and security teams NIST 800-40 on security maintenance
https://csrc.nist.gov/publications/detail/sp/800-40/rev-4/final Just as preventive maintenance on corporate fleet vehicles can help avoid costly breakdowns, patching should be viewed as a normal and necessary part of reliably achieving the organization’s missions. If an organization needs a particular technology to support its mission, it also needs to maintain that technology throughout its life cycle – and that includes patching.
• needed for Security Next Up: 1B Risk Insights, Security Integration, Business Resilience CISO Workshop
• Business/asset owners should be accountable for security risk • Security should be responsible to inform and help them. Asset owners need to balance security risks against all other risks and benefits with security providing subject matter expertise as a trusted advisor.
CRIMINAL ENTERPRISES GOVERNMENTS HACKTIVISTS
Review – Risk Insights • Align Security Priorities to Business • Business critical initiatives, applications, and data • Integrate Security Risk into Existing Processes • Risk Management Framework, Risk Register, Prioritization, Impact, Language, etc. • Threat Awareness and Planning • Increase security literacy for organizational leaders • Prioritize security investments around your likely threats Next Up: 1B Risk Insights, Security Integration, Business Resilience CISO Workshop
Healthy Friction – Critical thinking that reduces risk but doesn’t break processes. Unhealthy friction – impedes more value than it protects. CISO CIO CEO CFO COO
Technical Estate (Dev → Test → Production) Posture Management Manage potential security risk (vulnerabilities) Security Operations / SOC Manage realized security risk (attacks) Security Management – Key Operational Functions Two operational functions for prevention (potential risk) and response (realized risk) IT Operations Detect Respond Recover Prevent Identify • Accountable for Operational Uptime • Responsible for change implementation Collaboration
People Security Education, Insider Risk Access Control Technical Estate (Dev → Test → Production) Security Operating Model Posture Management Manage potential security risk (vulnerabilities) Security Operations / SOC Manage realized security risk (attacks) IT Operations & Data Governance Detect Respond Recover Prevent Identify • Accountable for Productivity and Operational Uptime • Responsible for change implementation and lifecycle management Collaboration Security Governance Risk, Architecture, Compliance, Threat Intelligence (Strategic) People Employees, Partners, Customers Innovation Security Application Security Citizen Developers DevOps Teams Asset Protection (Data and Systems)
PostureManagement Continuously Learning to Reduce Risk Collaborative approach to mitigate potential and realized risk No threat Found threat Security Collaboration Quick Fix Major/New incidents Note: Threat Intelligence and Security Engineering (automation) is a supporting function for all security activities
Evolution of Traditional Vulnerability Management Focused on Operating System vulnerabilities New Tooling Available On-demand insights into security posture, threat intelligence helps prioritize Security Posture Management • Measure and Report Risk across all sources: • Software vulnerabilities – Operating System (OS), app, middleware, etc. • Configuration – OS, networks, apps, SaaS, PaaS, IaaS, Containers, Low-code apps, and more • Operation – processes and practices that create risk (e.g. overuse of privileged accounts, entitlements, etc.) • Mitigate Risk by enabling teams - Proactively work with IT operations and DevOps teams to assist with remediation (expertise, planning, tooling, education, etc.) Posture Management
Posture Management Manage potential security risk (vulnerabilities) Posture management is large and complex Collaboratively enabling many teams to secure a continuously changing technical estate Identity Security DevOps Teams Productivity Team / User Support Security Teams Productivity Team Business Leads Application Developers DevOps Teams Database Teams Productivity Team / User Support Business Leads IT Operations Application Developers DevOps Teams Citizen Developers Productivity Team Network Teams IT Operations (Infrastructure and Endpoint) (Multi-Cloud and Hybrid) Privacy Team(s)
Posture Management Rapid Modernization Plan (RaMP) 1. Start with Cloud Infrastructure (via CSPM) • Tooling - Cloud Security Posture Management (CSPM) for VMs, Containers, Databases, etc. (e.g. Defender for Cloud) • Process - Build shared responsibility model between teams + enablement processes for IT/Dev Ops teams • Configuration Baseline – start with vendor/industry recommendations (ASB, M365 Secure Score, CIS Benchmark for AWS, etc.) 2. Extend CSPM to all clouds and on-premises datacenters • Extend Tools & Processes – add on-premises assets to CSPM (e.g. via Azure Arc) & extend processes to new teams • Integrate TVM Team and Tools – to monitor all assets consistently 3. Proactively engage IT Ops and DevOps • Adopt a self-service model for patching on clients and servers • Build security engineering capacity & accountability to accelerate risk reduction 4. Establish Automated Guardrails • Automate – security into DevOps & Infrastructure as code (IaC) with Azure Policy, ARM, Terraform, etc. Extend to more assets & controls • Improve baseline configuration beyond default configuration • Add more controls across technologies (identities, apps, network, infrastructure, etc.) • Integrate with application security engagement team(s) (e.g. SDL/DevSecOps) Prepare and Build • Leadership support • Team skillsets • Processes 5. Continuously improve and extend Enables business agility by reducing process friction and delays
Review – Security Integration • Build consistent processes to integrate across security and IT teams • Align to shared goals, outcomes, risk understanding • Always seek healthy level of security friction for IT and Business • Build Posture Management operations • Combines vulnerability management + CSPM/EASM/others • Critically important, but large & complex problem to solve • Follow Rapid Modernization Plan (RaMP) for quick wins and incremental progress • Provides visibility needed to make business case for improving security maintenance and measuring progress Next Up: 1B Risk Insights, Security Integration, Business Resilience CISO Workshop
Enterprise IT & Security Teams T + 7 days Self-Service Grace Period Forced remediation End User T + 48 hours Workload owner T = Patch Ready Extended Testing Requires Approved Exception Management of this process may be simplified with AutoPatch (Preview)
N
N is the consistent goal of security program and disciplines
Weak Prevention + Rapid Response • More successful attacks • Increased damage (attackers get farther before containment/recovery) A balanced strategy reduces risk faster Weak preventive controls + Weak response/recovery • More successful attacks • Highly impactful/damaging (Bigger breaches take a long time to contain & recover, often requiring outside expertise) Strong Prevention + Rapid Response • Fewer successful attacks • Limited impact/damage
• • • Next Up: Business Alignment Exercise
Risk Insights Integrate security insights into risk management framework and digital initiatives Business Resilience Ensure organization can operate during attacks and rapidly regain full operational status Security Integration Integrate security insights and practices into business and IT processes, integrate security disciplines together 1. Assess Current State 2. Discuss Focus Areas 3. Assign Next Steps CISO Workshop
Program Maturity Path Proactive Integration natural aspect of risk and enablement decisions Unmanaged Security Risk No security owner in leadership team Security as Technical Risk Security program focused on technical view of risk (limited business alignment) Basic Business Alignment Risk viewed per project or ad hoc, limited business enablement focus See ‘Engaging Business Leaders on Security’ for metrics guidance 1. Assess 2. Discuss 3. Assign
Proactive Integration natural aspect of risk and enablement decisions Unmanaged Security Risk No security owner in leadership team Security as Technical Risk Security program focused on technical view of risk (limited business alignment) Basic Business Alignment Risk viewed per project or ad hoc, limited business enablement focus • Integrate security into risk management framework • Enable business asset owners to make informed security risk decision (similar to other risks) and implement mitigations • Identify business enablement opportunities for security (e.g. rapid entry of markets, enable remote work, etc.) • Align security risk to business goals and risks • Link critical business processes to IT systems 1. Assess 2. Discuss 3. Assign Next: Business Resilience
1. Who is accountable for security vulnerabilities & incidents? a. Business Asset Owners? IT Teams? Security? b. At what organizational level? 2. What is the highest level of executive interaction on security topics/risks? How frequently? 3. Is there a specific board member or committee that oversees security? a. Does the CISO (or CIO) meet with them regularly? 4. How do conflicts of interest get resolved between security and IT (or business) functions? The person who owns and accepts the risk is the person that explains to the world what went wrong (often in front of TV cameras).
1. How are you measuring security and compliance today? a. Do you use KPIs, KRIs, OKRs, or other? b. Do you measure & report security resiliency or organizational resiliency? 2. How are security risks integrated into the organizations’ risk management framework? 3. How are security priorities aligned to organizational priorities? To cloud/digital transformation? What gets measured gets managed What gets mismeasured gets mismanaged - Rory Sutherland
1. How are you investing into integrating security into business and IT processes? a. How prepared are organizational leaders to make security/risk decisions? b. How prepared are business line leaders to make security/risk decisions? 2. What would business and IT leaders say about the progress on that integration? 3. How is security budgeted? Proportional to IT? to organization’s FTEs or revenue? Ad Hoc/Custom? “Trust is knowing that when a team member does push you, they're doing it because they care about the team.” ― Patrick Lencioni
Program Maturity Path Learning Organization All teams focused on learning from internal & external incidents Compliance Focus Preventive program focused on meeting compliance obligation and control configurations Response Focus (or overpivot) Building and maturing new separate security operations/SOC function (often after major incident) Balanced Investment SOC drives increased investment into meaningful incident prevention 1. Assess 2. Discuss 3. Assign
Discuss Improvement Steps Learning Organization All teams focused on learning from internal & external incidents Compliance Focus Preventive program focused on meeting compliance obligation and control configurations Response Focus (or overpivot) Building and maturing new separate security operations/SOC function (often after major incident) Balanced Investment SOC drives increased investment into meaningful incident prevention 1. Assess 2. Discuss 3. Assign • Continuous improvement of inter-team processes (and automation of them) • Continuous learning culture across all teams • Continuously empower business asset owners with security knowledge and accountability • Integrate incident response learnings into strategy and preventive controls • Shift security left (earlier) in technical processes • Build incident response capability (Security Operations / SOC) Next: Assign Next Steps
1. What security framework do you adhere to today? 2. How are lessons learned from incidents integrated into security, IT, and business processes? 3. How well do you balance investments across prevention vs. detection/response/recovery? a. Do you have a dedicated operations function focused on incident response? (aka Security Operations Center or SOC) b. Do you have a dedicated operations function focused on prevention? (e.g. security posture management team) c. Are these functions represented in technology leadership meetings?
1. Assess 2. Discuss 3. Assign Capture next step and who owns following up on it # Next Step Point of Contact 1 2 3 4 5
Next Up: 1C – Security Disciplines 1. Assess Current State 2. Discuss Focus Areas 3. Assign Next Steps CISO Workshop
Zero Trust principles transform access control Secure assets wherever they go
Evolution of Authentication and Authorization “Coarse authorization” during authentication process that enforces common trust attributes
TRUSTED KNOWN ALLOWED Airport Security (Identity System) Airline (Application) Air travel analogy High Level Access Model