The four slide risk presentation to the board

Recent Gartner survey of security / risk professionals showed that;

45% think risk management data influences decisions at the board level

However

31% think that risk management data does not influence decisions at board level

15% think thew board do not understand risk management data

6% said it wasn’t even reported at a board level

and 4% didn’t know..

Personally I would have liked to delve into more depth on these questions

For example;

  • for those who think it influences board decisions – how, why and does it have enough influence
  • for those who think it doesn’t, why not and what could be done to improve things

 

What are the roles of the board and the CISO in enterprise risk management?

  • Board – balance Risk Indicators with Risk Appetite
    • ensure the executives understand what the risks are and are comfortable they fit into the overall rail appetite (e.g. how risk adverse they are)
  • CISO – moving from the traditional of Asset performance to Business performance

When reporting to the Board, how can you relate risks to business objectives that most concern the board?

Brief four slide presentation;

  • Slide 1:  List the half dozen most important enterprise strategies and objectives
  • Slide 2: Name the IT risks that have a potentially significant impact on the most important enterprise strategies and initiatives
  • Slide 3: Describe risk management initiatives
  • Slide 4: Wrap it up!

 Details / examples;

Slide 1: Enterprise Strategy Objectives

  • Acquisitions in emerging markets, new product development, customer retention, migration projects.
  • Guiding principle – Business objectives are IT objectives.  
    • Highlight that your security objectives are aligned with the business strategy and goals.

Slide 2: IT Risks

  • Acquisition Strategy
    • Acquired entities BC/Dr strategy
    • Acquired entities controls vs. our regulatory environment
    • Replacing / merging acquired systems with corporate systems
  • New product development
    • Application development security – SDLC – compliance
    • Infrastructure to support products in emerging markets
  • Customer retention
    • Customer experience with focus on acquired entities
    • Privacy
    • Social Media
    • Reputation

Slide 3: Risk Management Initiatives

  • Acquisition Strategy
    • Systems and controls analysis as part of M&A due diligence
    • Responsive, rapid IT on-boarding
    • Vendor consolidation
  • Product Development
    • QA program for application development including Six Sigma, ISO 9000 and ISO/IEC 27001
    • IT product development role specifically working to minimise risks in emerging markets, including product localisation – reduces time to market
  • Customer retention
    • CRM and SFA upgrades at acquired entities
    • Privacy management
    • Advanced analytics
    • Guiding principle – IT risks are business risks

Slide 4: Wrap it up

  • With current and proposed risk management initiatives there are no material or significant risks anticipated
  • IT is leading initiatives to manage risks to business objectives and other legal and regulatory risks – coordinating with departments across the business
  • Next steps include budget approval for the major initiatives
  • Details on risk and control assessments are in the board package
  • Thank you for your  support

Recommendations;

When communicating directly with the board, focus on:

  • What enterprise objectives and strategies matter most?
  • What’s the potential impact of IT risk on those things?
  • What are the current and proposed approaches to managing these risks?
  • What are the next steps?

In short, keep it simple and relevant to the concerns of the board.  Avoid technical jargon and focus on business goals and outcomes 🙂

K

13 Security Myths Busted.. My thoughts.

I was recently sent a link to an article covering what were described as ’13 security myths – busted’ and asked my opinion.  As it was a fairly light and interesting I thought I would share the article and my thoughts;

The original article can be found here;

http://www.networkworld.com/slideshow/86918/13-of-the-biggest-security-myths-busted.html?source=NWWNLE_nlt_afterdark_2013-02-21

Have a read of the myths and why they thin they are myths, read my thoughts below, and it would be great to hear your thoughts.

1. AV – Possibly not super efficient, but I think still necessary – they kind of mix apples and oranges with the targeted attack comment, as it is not designed for that, but it still prevents the vast majority of malware, and general attacks.  Possibly and an environment where literally no one runs with admin privileges and there is strong white listing you could do without AV, but generally I’d say it is still relevant and required.

2. This one is hard to know as there is so much FUD around.  It is clear that in many circumstances (stuxnet etc, Chinese APT , US government espionage etc.) that governments are investing huge sums of money and employing extremely bright people to attack and defend in cyber land.  I suspect much will never be known as the NSA / Mi6 / <insert secret government money pit here> are by definition very secretive.  Remember all the speculation around the NSAs ability to crack encryption in the past..

3. Totally agree – just look at most businesses and the trouble they have getting control of authentication via AD / IAM.  However, many are moving in the right direction though so maybe soon we’ll have everything in IAM and / or AD..

4. I think this one proves itself incorrect in the text – Risk management is needed, you just need to work on understanding your adversaries and the actual risks you face, which includes understanding their motivations and the value they place on your data and IP.

5. This I totally agree with.  I have already highlighted I don’t really like the fact we as an industry use the term ‘best practice’ all over our standards and policy documents etc – who defines what it is? Is it best in any specific environment with it’s support skill sets and technology stack etc?

6. Half agree they are a fact of life, however you can have effective responses and strategies around privilege control and application controls etc. to massively mitigate the risks these pose.

7. I can’t comment on this one, but most national infrastructures are inadequately protected and tend to rely on old legacy systems for many of their functions so this is probably try in the UK for much supporting infrastructure as well.

8. Completely agree with this.  Compliance is a useful checklist, but compliance with standards should be a by product of good secure design and processes, not something we strive for as a product in itself.  If provides a driver but is very much the wrong focus if you want to be secure rather than compliant.

9. Agree – CISO may own security policy and strategy etc., but security is everyone’s problem and everyone should be accountable for performing their duties with security and security policies in mind.  I’m a big fan of security awareness training as a regular thing to help educate people and keep security at the forefront of the way we do business.

10. Likely has been true, in the same way as Mac / Linux are ‘safer’ than Windows, as it has not been the focus of as much malicious attention and has not been carrying as much functionality and valuable data.  This is rapidly shifting though as we rely more and more on mobile devices for everything from banking to shopping to actual business.  So I think this one is rapidly if not already becoming a myth.

11. Agree – you can likely never be 100% secure if you want to have a life or business online.  I think it was an American who coined ‘eternal vigilance is the price of freedom’  we should work to be secure, but freedom both individually and as a business is too important and hard won to give up.  Obviously some personal freedoms to do whatever you want with corporate devices have to be given up, but I think my point stands as a general concept.  As the guy in the article says (and I do above) work to understand your adversaries, their motivations and tools.

12. Agree with this one also – continuous monitoring, trending and learning are key to understanding and preventing or at least capturing todays advanced long term threats such as APTs.

13. I agree with this final one as well, and have actually blogged about this before.  We live in an ‘assume you have or will be breached’ world.  Put the detective measures and controls in place to ensure you rapidly detect and minimise the damage from any breach.  Read last years Verizon data breach report..

It would be great to hear your thoughts on this light article.

K