Sem 003

Sem 003

• 1.
  Start Time TitlePresenter 8:30 AM Introduction 8:35 AM Maturity Lifecycle of a Security Program John Iatonna 9:10 AM Building Your Team Justin Peavey 9:40 AM Role of the CISO: Influence & Decision Support Derek Brink 10:15 AM Break 10:30 AM AreYou Fighting the Wrong Battles? Bob Rudis 11:00 AM CISO Roundtable: Security Intelligence Gathering for Leaders Evan Wheeler (Moderator) Derek Brink James Burrell John Iatonna Dave Notch Bob Rudis 11:30 AM Seminar Adjourns Information Security LeadershipDevelopment: Survivingas a Security Leader Seminar Agenda
• 26.
  Session ID: Session Classification: JustinPeavey SEM-003 BuildingYourTeam Five lessons from the trenches
• 27.
  In security, it’salways an away game Lesson 1: Image © Marine Corps Archives & Special Collections (CC BY 2.0)
• 28.
  Some skills youcan teach, some you can’t (or maybe shouldn’t) Lesson 2: Image ©x-ray delta 1 (Flickr) . CC BY-SA 2.0
• 29.
  Everybody has theirissues Lesson 3: Image © Heather Rose. CC BY-ND 2.0
• 30.
  Size does matter,at least to your CFO Lesson 4: Image ©Peter Taylor (CC BY 2.0)
• 31.
  In business, it’sbecoming nearly always an away game. Lesson 5: Image ©woodleywonderworks (Flickr) (CC BY 2.0)
• 33.
  Session ID: Derek E.Brink, CISSP Vice President and Research Fellow, IT Security and IT GRC Aberdeen Group, a Harte-Hanks Company www.linkedin.com/in/derekbrink SEM-003 Role of the CISO: Influence and Decision Support
• 34.
  “The 2012 CyLabGovernance survey results indicate a serious lack of attention at the top.” Jody R. Westby, Carnegie Mellon CyLab, third bi-annual survey on how Boards of Directors and senior executives from the Forbes Global 2000 are governing security and privacy for their corporate information assets – at RSA Conference 2012 Does Security Speak Make a Sound? If what’sbeing transmittedisn’theard, thenit isn’tmaking a sound http://blogs.aberdeen.com/it-security/does-it-security-and-compliance-make-a-sound/ (6 March 2012)
• 35.
  The CISO isan Apologistfor Security
• 36.
  No, not inthe sense of saying“I’m sorry”… … although there were plenty of public disclosures of Security to be sorry about since the last RSA Conference … The CISO is an Apologistfor Security
• 37.
  LinkedIn, eHarmony Yahoo Certificates signedwith MD5 Barnes & Noble United Technologies (Onity) South Carolina Department of Revenue Saudi Aramco Java vulnerabilities NY Times, Wall Street Journal Twitter, Facebook The Works Bakery Café … And the Beat Goes On …
• 38.
  What bothers memost is the smarmy, disingenuous language that a Chief Privacy Officer at TD Bank uses in communicating about this incident to its customers: “At TD Bank, we realize the importance of keeping you informed when it comes to your banking.”But we still waited six months. “That’s why we’re committed to notifying you about events that might affect your accounts.”Not just your accounts with us, of course, but your entire digital identity. “Today, we’re writing to let you know about an incident involving your personal information.”We still haven’t figured out what happened … and we’re silent on whether or not we’ve taken any steps to prevent it from happening again. “At TD Bank, protecting our Customers’personal information is a top priority and something we take very seriously.”Except we didn’t implement the basic best practice of encrypting our backup tapes, and we don’t have controls in place to understand what happened to them even after an investigation of more than six months. But perhaps the most painfully ironic is this:“We sincerely regret any concern or inconvenience this may cause you.”Written on letterhead with the tagline “America’s Most Convenient Bank.” TD Bank (drilldown) http://blogs.aberdeen.com/it-security/td-fumbles-tapes-not-encrypted-customers-lose/ (19 October 2012)
• 39.
  Back-End Systems Endpoints Networks Over just thepast 3-4 years, a dramaticchangeinbusiness context for CISOs Flexibility and Power | Complexity and Risk Attackers Compliance Vulnerabilities End- Users Collab- oration http://blogs.aberdeen.com/it-security/we-have-met-the-enemy-and-he-is-____/ (3 February 2012)
• 40.
  An apologist, asin "a person who makes a case, in speech or in writing, for a belief or idea" The other side of the coin for evangelist, as in“an enthusiastic advocate” Usually these terms are used in an ecclesiastical context … … and in fact I often find many ecclesiastical parallels and inspiration for my own work … The CISO is an Apologistfor Security
• 41.
  The Devil’s Dictionary– also known as The Cynic’s Word Book – by Ambrose Bierce was first published over 100 years ago Examples of his cynical, satirical“definitions”include: Absurdity – a statement of belief manifestly inconsistent with one’s own opinion Accident – an inevitable occurrence resulting from the action of immutable natural laws Congratulations – the civility of envy The Devil’s Dictionary for IT and Security
• 42.
  Advanced Persistent Threat(APT) – an undocumented guest user, accessing valuable enterprise resources. See Illegal Immigrant. The Devil’s Dictionary for IT and Security http://blogs.aberdeen.com/it-infrastructure/the-devils-dictionary-for-it-and-it-security-eleven-initial-entries/ (27 November 2012)
• 43.
  Consumerization – anexcuse frequently offered by enterprise IT and Security staffs for their lack of leadership, and their increasing risk of irrelevance The Devil’s Dictionary for IT and Security http://blogs.aberdeen.com/it-infrastructure/the-devils-dictionary-for-it-and-it-security-eleven-initial-entries/ (27 November 2012) http://blogs.aberdeen.com/it-security/moron-consumer-file-sharing/ (27 April 2012)
• 44.
  Deny by default– the traditional enterprise security policy of denying everything except that which is specifically permitted, as opposed to proactively identifying and enabling the capabilities that support the rapidly changing needs of the business (see also Consumerization and Dr. No) The Devil’s Dictionary for IT and Security http://blogs.aberdeen.com/it-infrastructure/the-devils-dictionary-for-it-and-it-security-eleven-initial-entries/ (27 November 2012)
• 45.
  Security Breach Notification– an opportunity for management to try to shift the blame for a security breach to someone else, and to position the company as the actual victim; an opportunity for management to remind its valued customers, whose information it has just allowed to be compromised, that the company takes the security of its customers’ information very seriously The Devil’s Dictionary for IT and Security http://blogs.aberdeen.com/it-infrastructure/the-devils-dictionary-for-it-and-it-security-eleven-initial-entries/ (27 November 2012)
• 46.
  Risk-based decisions –the process by which enterprises with world-class brands fail to implement the most basic best practices and protections for user identities and data; the indifference, incompetence or calculation by which industry in general appears to be incapable of self- regulation in matters of security and continues to invite stronger regulatory mandates The Devil’s Dictionary for IT and Security http://blogs.aberdeen.com/it-infrastructure/the-devils-dictionary-for-it-and-it-security-eleven-initial-entries/ (27 November 2012)
• 47.
  Are companies capableof self- regulation on security matters? Or will corporate profit motives / ignorance / indifference / incompetence continue to result in similar security breaches … and invite stronger regulatory mandates? Where is the Invisible Hand, or at leasttheVisible Hand of Management?Where is the Influence of the CISO?
• 48.
  TheVeryVisible Hand ofRegulation • Isn’t the answer right in front of us? • Each of the complex matrix of regulatory requirements was put in place because neither the invisible hand of the market, nor the visible hand of management, was deemed to be adequate …
• 49.
  The question ismagnified when it gets applied to critical infrastructure – i.e., Power plants Utilities Pipelines Transportation networks Telecommunications networks Hospitals Financial systems Other systems that people and businesses rely on for the essentials of daily life The Larger Question ely
• 50.
  Senator Rockefeller’s staffpublished a 6-page memo on 28 Jan 2013 with their summary of industry feedback, along with 13 pages of verbatims from the written responses. Staff conclusions include: “Many companies supported a voluntary program to protect critical infrastructure, so long as it would not become mandatory.” “Concerns related to the proposed voluntary program were primarily related to the potential development of an inflexible,“one-size-fits-all” set of best practices.” “Other common concerns included the need to adequately protect the confidentiality of information shared with the federal government during cyber threat assessments.” “The responses showed that you should continue working to advance cybersecurity legislation in the 113th Congress.” Confirmation bias among the Senator’s staff? Worth your own read! CIOsWho Responded to Sen. Rockefeller’s Letter (September2012 –about300 of500 companiesresponded)
• 51.
  to enhance thesecurity and resilience of the Nation's critical infrastructure to maintain a cyber environment that encourages efficiency, innovation, and economic prosperity while promoting safety, security, business confidentiality, privacy, and civil liberties through a partnership with the owners and operators of critical infrastructure to improve cyber security information-sharing and collaboratively develop and implement risk-based standards PresidentObama’s Executive Order (February2013)Thenational and economicsecurityoftheUnited States depends onthe reliablefunctioning ofthe Nation's criticalinfrastructure http://www.whitehouse.gov/the-press-office/2013/02/12/executive-order-improving-critical-infrastructure-cybersecurity (12 February 2013) Devil in the Details: Agreement on“critical” Conditions on information-sharing Yet another framework Voluntary adoption – at first Again, I recommend that you read the verbatims
• 52.
  Company WaltDisney Johnson&Johnson Microsoft UnitedTechnologies BankofAmerica GeneralElectric Pfizer Procter&Gamble Coca-Cola TravelersCompanies UnitedHealth 3M AT&T ExxonMobil Hewlett-Packard JPMorganChase Merck Verizon Wal-Mart Intel McDonald's Boeing Caterpillar HomeDepot IBM Alcoa AmericanExpress DuPont Chevron CiscoSystems Compromise of confidential information XX X X X X X X X X X X X X X X X X X X X X X X X Compromise of intellectual property X X X X X X X X X Disruption from reliance on IT infrastructure X X X X X X X X X X X X X X X X X X X X X Disruption from reliance on third-party i/s X X X X X X X X Evidence of Progress: Management’s Discussionof Risk Analysis ofDowJones Industrial Average(30companies)SEC10-KFilings Four years ago, I wrote that discussion of IT-related risks were not even showing up in the SEC 10-K filings for leading US high-tech firms … my review of the 2012 filings of the DJIA shows some interesting new patterns 25 out of 30 identify the risk of compromise of confidential company / partner / customer information … but just 9 out of 30 explicitly discuss risks to their intellectual property and trade secrets 21 out of 30 identify the risks of disruptions in their IT infrastructure … but just 8 out of 30 explicitly discuss risks from their reliance on third-party infrastructure (e.g., managed services, cloud service providers) http://www.sec.gov/divisions/corpfin/guidance/cfguidance-topic2.htm(13October2011)
• 53.
  Types of RiskUnrewarded Rewarded Risk Management Objectives Protect value Defend assets Minimize downside Create value Enable assets Maximize upside Example Areas of Focus Security vulnerabilities and threats Regulatory compliance Innovation and growth initiatives Operational efficiencies Associated Assets Identities and access Applications and data IT infrastructure Physical infrastructure Personnel safety Revenue streams Distribution channels Products and services Operations and supply chain Reputation and brand Speaking the Language(s) of Risk Review oftheSEC10-K language showsthatcompanies are startingtobridgethegapintheirdiscussionsofrisk
• 54.
  “Insanity is doingthe same thing over and over again but expecting different results.” Commonly attributed to Albert Einstein (Germany, 1879) “Good judgment comes from experience, and often experience comes from bad judgment.” Rita Mae Brown (US, 1944) Insane IT Keepdoing whatyou’vealways done, keepgetting whatyou’vealways got
• 55.
  Relying solely ontraditional signature-based approaches E.g., network security only traditional firewalls; endpoint security only anti-virus Applying traditional, centralized endpoint management approaches to smart phones and tablets E.g., a focus on devices, as opposed to a focus on applications and data Scanning and testing as a primary strategy for application security I.e., not necessarily fixing, or not developing applications with fewer vulnerabilities in the first place Insane IT – Examples?(1 of 2)
• 56.
  Leveraging the“big data”and“analytics”ofsecurity and compliance primarily for understanding“what happened” I.e., as opposed to identifying, containing and responding to“what’s abnormal”more quickly Communicating the value of IT Security solely in terms of prevention, avoidance, or“insurance” Enforcing policies to prevent end-users from using consumer- oriented tools, e.g., file-sharing As opposed to providing them with supported, enterprise-class alternatives Investing millions in security technologies, but not investing in security awareness and education for end-users Insane IT – Examples?(2 of 2)
• 57.
  We live ina world that has walls, and those walls have to be guarded … Who’s gonna do it? You? … I have a greater responsibility than you can possibly fathom … My existence, while grotesque and incomprehensible to you, saves lives … deep down in places you don’t talk about at cocktail parties, you want me on that wall, you need me on that wall … I have neither the time nor the inclination to explain myself to a man who rises and sleeps under the blanket of the very freedom that I provide, and then questions the manner in which I provide it. I would rather you just said thank you, and went on your way. Service to the Organization (Past … and Present) Committed,faithful,honorable… unrecognized,and underappreciated “You can’t handle the truth!” http://blogs.aberdeen.com/it-security/the-information-security-servant-leader-3/ (5 October 2012)
• 58.
  Servant-Leaders are characterizedas excellent: Communicators, with the ability to: Listen Empathize Heal Persuade / build consensus Strategists, with strengths in: Awareness Conceptualization Forward-thinking Builders, with a commitment to: Stewardship Growth of people Growth of community Service to the Organization (Present and Future) CISOs as Servant-Leaders –a fundamentallydifferentapproach Source: Character and Servant-Leadership: Ten Characteristics of Effective, Carding Leaders, Larry C. Spears
• 59.
  Understand the businessto support the business Security and compliance objectives support strategic objectives … Collaboration Agility and productivity Efficiency, innovation and growth … by managing its risks and playing within the rules Connect to concepts and projects that are understood and accepted Compromised data or IP is compromised, regardless of how Disrupted operations are disrupted, regardless of how The CISO is an Apologist for Security InfluenceandDecision Support=Servant-Leadership
• 60.
  Build influence bybuilding relationships Finance, Audit, Legal, HR, Marketing, Lines of Business, Risk, Privacy, Business Continuity … Solve their problems; establish your credibility; gain their trust, e.g., Finance and SEC filings Audit and compliance deficiencies Legal and IP protection HR and onboarding Marketing and data / privacy protections Lines of Business and secure file sharing End-users (employees)? End-users (business partners, customers)? The CISO is an Apologist for Security InfluenceandDecision Support=Servant-Leadership
• 61.
  Listen, empathize, heal,persuade Inform, educate, coach, connect Public disclosures are opportunities Awareness and training is ongoing Decisions will increasingly be affected, both directly and indirectly The CISO is an Apologist for Security InfluenceandDecision Support=Servant-Leadership
• 62.
  Communicate, in theright language for the target audience Bridge the gaps Between technology and business Between the two types of risk Between policies (management’s intent) and administration “Act as if” CISO as a business leadership role, not a technology support role The CISO is an Apologist for Security InfluenceandDecision Support=Servant-Leadership
• 63.
  Some situations cryout for change … Not everyone will necessarily like it Role of the CISO: Influence and Decision Support
• 64.
  For More Information DerekE. Brink, BS, MBA, CISSP Vice President and Research Fellow, IT Security and IT GRC dbrink@mba1991.hbs.edu www.linkedin.com/in/derekbrink Research publications: http://aberdeen.com/_aberdeen/it- security/ITSA/practice.aspx Blogs: http://blogs.aberdeen.com/category/it-security/ On-demand webcasts: https://www.brighttalk.com/channel/290
• 65.
  Session ID: Session Classification: LibertyMutual Insurance Bob Rudis INFORMATION SECURITY LEADERSHIP DEVELOPMENT SURVIVING AS A SECURITY LEADER AREYOU FIGHTINGTHEWRONG BATTLES?
• 66.
  IT’S ATRAP!!!
• 67.
  www.nicoledextras.com
• 68.
  [SCAN | PATCH| PEN TEST | LOG | RISK ASSESS | CONFIG CHECK | BLOCK | …]
• 69.
  ► Steer clearof CBTs ► Do not use stock photography ► Tailor messages to specific audience ► Integrate training into daily workflow ► Create opportunities for live demos ► Think like Facebook/Twitter/Pinterest ► Use incentives (carrots vs sticks) ► Make messages personal
• 70.
  INFORMATION SECURITY POLICY
• 71.
  ► Let thingsgo! ► Gone…but not forgotten ► Issues ► Vulnerabilities ► Risks
• 72.
  If in doubt,Peregrin Took, always follow [ your users | the business ]!
• 75.
  WHAT HAVEYOU DONEFOR ME LATELY? ► Empowered your users ► Enabled the business to do more/new ► Addressed emerging risks ► Made systems & processes more resilient ► Decreased application issues ► Deployed foundational security capabilities ► Created security allies in other areas
• 78.
  : MODERATOR: Evan Wheeler Omgeo CISO ROUNDTABLE:SECURITY INTELLIGENCE GATHERING FOR LEADERS PANELISTS: James Burrell Federal Bureau of Investigation Dave Notch Intensity Analytics Derek Brink Aberdeen Group Bob Rudis Liberty Mutual Insurance John Iatonna Edelman
• 79.
  DiscussionTopics