IT Risk Management. Agenda. Roche at a glance OSI Layers above 7 What we did What we plan to do how to not get shoot

Size: px

Start display at page:

Download "IT Risk Management. Agenda. Roche at a glance OSI Layers above 7 What we did What we plan to do how to not get shoot"

Bruce Jacobs
8 years ago
Views:

1 IT Risk Management ISACA Switzerland Chapter After Hours Seminar Mario Walter Agenda Roche at a glance OSI Layers above 7 What we did What we plan to do how to not get shoot 2006 ISACA After Hours Seminar IT Risk Management Mario Walter Seite 2

2 Corporate Setup Clear focus on innovating healthcare Two strong pillars Roche: Since 2004 healthcare company focused on pharmaceuticals and diagnostics Roche Diagnostics: A global leader in diagnostics Roche Pharmaceuticals: A global leader in biotechnology and key therapeutic areas 2006 ISACA After Hours Seminar IT Risk Management Mario Walter Seite 3 Basic facts Founded 1896 in Basel, Switzerland Employing around people Currently active in 150 countries on all continents 2005 sales (continuing businesses): 35.5 billion Swiss Francs Core businesses: Pharmaceuticals and Diagnostics Number 1 in the global diagnostics market (in vitro), the leading supplier of medicines for cancer & transplantation and a market leader in virology 2006 ISACA After Hours Seminar IT Risk Management Mario Walter Seite 4

Switzerland Employing around 65 000 people Currently active in 150 countries on all continents 2005 sales (continuing businesses): 35.

3 Corporate Setup Roche Group Sales % local 20 % CHF in CHF m 25 % 26 % 4% 5 % ISACA After Hours Seminar IT Risk Management Mario Walter Seite 5 Roche strategy Innovation across the entire healthcare-spectrum Our capabilities in diagnostics and pharmaceuticals enable us to innovate across the entire healthcare spectrum, from identifying disease susceptibilities and disease screening in populations at risk to prevention, diagnosis, therapy and treatment monitoring. Predisposition Early detection Prevention Diagnosis Therapy Monitoring 2006 ISACA After Hours Seminar IT Risk Management Mario Walter Seite 6

entire healthcare spectrum, from identifying disease susceptibilities and disease screening in populations at risk to prevention, diagnosis, therapy and

4 Diagnostics Division Diagnostics market Market share 1 Sales growth 2 Roche Diagnostics Abbott J & J Bayer* Beckman C.* Dade Behring * DIA Market ** 1 Source: company reports, Boston Biomedical Consultants, Roche analysis 2 in local currencies; excludes Life Science research market * Based on nine months sales 2004 **IVD 2006 ISACA After Hours Seminar IT Risk Management Mario Walter Seite 7 Diagnostics Division Broadest product portfolio in the industry Life science research Diagnostics market Research Professionals Consumers research academia pharma biotech university hospital commercial lab hospital clinic GP patient Applied Science Molecular Diagnostics Centralized Diagnostics Near Patient Testing Diabetes Care 2006 ISACA After Hours Seminar IT Risk Management Mario Walter Seite 8

**IVD 2006 ISACA After Hours Seminar IT Risk Management Mario Walter Seite 7 Diagnostics Division Broadest product portfolio in the industry Life science research Diagnostics market Research

5 Diagnostics broadest portfolio Molecular Biochemicals Molecular Systems Clinical Chemistry Immunology Haematology Coagulation Blood Glucose Testing Urinanalysis Point of Care Blood gas/ electrolytes LightCycler, MagNA Pure LC COBAS AMPLICOR, AmpliScreen, AmpliPrep, TaqMan Roche/Hitachi and COBAS INTEGRA lines Elecsys and E170 (MODULAR ANALYTICS SWA) Sysmex systems STA-R, STA Compact, STA-R Evolution Products of the Accu-Chek family Miditron, Combur product line, Urisys CoaguChek, Cardiac Reader, Reflotron OMNI C/S COBAS, INTEGRA, ELECSYS, MIDITRON, MODULAR and URISYS are trademarks of Roche. STA and STA Compact are trademarks of Diagnostica STAGO S.A ISACA After Hours Seminar IT Risk Management Mario Walter Seite 9 Diagnostics Division Regional headquarters and R&D centers Indianapolis Pleasanton/ Alameda Rotkreuz Basel Burgdorf Mannheim Penzberg Graz Tokyo Applied Science Molecular Diagnostics Centralized Diagnostics Near Patient Testing Diabetes Care Branchburg Barcelona Singapore Regional headquarters 2006 ISACA After Hours Seminar IT Risk Management Mario Walter Seite 10

Evolution Products of the Accu-Chek family Miditron, Combur product line, Urisys CoaguChek, Cardiac Reader, Reflotron OMNI C/S COBAS, INTEGRA, ELECSYS, MIDITRON, MODULAR and URISYS are trademarks of

6 Agenda Roche at a glance OSI Layers above 7 What we did What we plan to do how to not get shoot 2006 ISACA After Hours Seminar IT Risk Management Mario Walter Seite 11 OSI Modell 2006 ISACA After Hours Seminar IT Risk Management Mario Walter Seite 12

Seminar IT Risk Management Mario Walter Seite 11 OSI Modell

7 The layers above 7 Layer 10 Regulations Layer 9 Finance Layer 8 Politics 2006 ISACA After Hours Seminar IT Risk Management Mario Walter Seite 13 Agenda Roche at a glance OSI Layers above 7 What we did so far What we plan to do how to not get shoot 2006 ISACA After Hours Seminar IT Risk Management Mario Walter Seite 14

at a glance OSI Layers above 7 What we did so far What we plan to do how to not

8 E Frequent ~ 1 per day D Probable ~ every 10 days C Occasional ~ 3 times a year B Remote ~ once in 3 years A Improbable ~ once in 30 years Minor 2 Moderate 3 Considerable 4 Critical 5 Catastrophic How to tackle risks Strategic approach Probability 1 Severity Risk Operational approach Correlation 2006 ISACA After Hours Seminar IT Risk Management Mario Walter Seite 15 Strategic approach - The Project Global IT Security launched a project to: develop a comprehensive overview of all potential relevant IT risk scenarios throughout Roche Diagnostics systematically collect and assess the top major risk scenarios related to IT security present all collected information on IT risk scenarios in one single picture, i.e. the IT Risk Landscape as a sound basis for decision making define a top-down approach for improving IT security based on the high level IT Risk Landscape enable an optimal balance between accepting/mitigating risks and prioritization, resource allocation, timing, impact 2006 ISACA After Hours Seminar IT Risk Management Mario Walter Seite 16

Project Global IT Security launched a project to: develop a comprehensive overview of all potential relevant IT risk scenarios throughout Roche Diagnostics systematically collect and assess the top

9 Method A team of internal and external IT security experts systematically collected, described and evaluated Roche Diagnostics specific IT risk scenarios Elaborated the risk ratings (i.e. frequency and severity), based on professional judgment mapped the risk scenarios to operational risk management standards, e.g. COSO chose not extreme but realistic scenarios that could happen here and now organized a security-internal quality assurance with the DISN, the Diagnostics Information Security Network, team members developed a process for periodic update/maintenance of the IT Risk Landscape 2006 ISACA After Hours Seminar IT Risk Management Mario Walter Seite 17 The IT Risk Landscape Probability E Frequent ~ 1 per day D Probable ~ every 10 days C Occasional ~ 3 times a year b B Remote ~ once in 3 years a A Improbable ~ once in 30 years Minor 2 Moderate 3 Considerable 4 Critical 5 Catastrophic Severity 2006 ISACA After Hours Seminar IT Risk Management Mario Walter Seite 18

members developed a process for periodic update/maintenance of the IT Risk Landscape 2006 ISACA After Hours Seminar IT Risk Management Mario Walter Seite 17 The IT Risk Landscape Probability E

10 Security Operations Competency Center (SOCC) Overall Strategy: Integrated View supports risk management Impact Analysis. Threat Profile. Reduction falsepositives IDS Detection VM Correlation Log Files Prevention 2006 ISACA After Hours Seminar IT Risk Management Mario Walter Seite 19 Current Supported Services Detection and Prevention (Network) Global Pharmaceuticals Global Diagnostics 1 FTE 1 FTE Roche Global Security Operations and Competency Center Personal Firewall (Desktop) Global Diagnostics 1 FTE Vulnerability Management Global Pharmaceuticals Global Diagnostics 1 FTE 1 FTE 16 Hours Manned Coverage 7x24 on-call coverage 365 Days Per Year 2006 ISACA After Hours Seminar IT Risk Management Mario Walter Seite 20

Detection and Prevention (Network) Global Pharmaceuticals Global Diagnostics 1 FTE 1 FTE Roche Global Security Operations and Competency Center Personal Firewall (Desktop) Global

11 Agenda Roche at a glance OSI Layers above 7 What we did so far What we plan to do how to not get shoot 2006 ISACA After Hours Seminar IT Risk Management Mario Walter Seite 21 A Single Integrated Solution Monitoring, Visualization, and Reporting Real-time Analysis, Correlation, and Workflow Event Collectors Firewalls Firewalls Detection Applications Firewalls Firewalls Systems Detection Applications Detection Applications Firewalls Systems Detection Systems Hosts Applications Applications Systems Applications Applications Detection Anti Systems Detection Detection Detection Virus Anti Systems Detection Systems Detection Detection Systems Detection Systems Detection Network Systems Systems Databases Virus Systems Equipment Systems Sign-On Sign-On Directory Services 2006 ISACA After Hours Seminar IT Risk Management Mario Walter Seite 22

Applications Detection Applications Firewalls Systems Detection Systems Hosts Applications Applications Systems Applications Applications Detection Anti Systems Detection Detection Detection Virus

12 A roadmap Provide senior management with traffic lights Complexity / Integration Create dashboards for your management Define a scoring system Time 2006 ISACA After Hours Seminar IT Risk Management Mario Walter Seite 23 Agenda Roche at a glance OSI Layers above 7 What we did so far What we plan to do how to not get shot 2006 ISACA After Hours Seminar IT Risk Management Mario Walter Seite 24

Mario Walter Seite 23 Agenda Roche at a glance OSI Layers above 7 What we did so far What we plan

13 5 body armour points Start small Convince / seduce your senior management Get a strong relationship with your operational people Be aware that people fear the new Be supportive, i.e. help projects achieve their goals 2006 ISACA After Hours Seminar IT Risk Management Mario Walter Seite 25 Questions 2006 ISACA After Hours Seminar IT Risk Management Mario Walter Seite 26

e. help projects achieve their goals 2006 ISACA After Hours Seminar IT Risk Management Mario

Accu-Chek Inform II system. Professional glucose testing for the wireless age

Accu-Chek Inform II system. Professional glucose testing for the wireless age Accu-Chek Inform II system Professional glucose testing for the wireless age The Accu-Chek Inform II system Real time control The Accu-Chek Inform II System overview Quality Advanced chemistry with multiple