THE DIGITAL AGE THE DEFINITIVE CYBERSECURITY GUIDE FOR DIRECTORS AND OFFICERS

Save this PDF as:
 WORD  PNG  TXT  JPG

Size: px
Start display at page:

Download "THE DIGITAL AGE THE DEFINITIVE CYBERSECURITY GUIDE FOR DIRECTORS AND OFFICERS"

Transcription

1 THE DIGITAL AGE THE DEFINITIVE CYBERSECURITY GUIDE FOR DIRECTORS AND OFFICERS

2 Download the entire guide and follow the conversation at SecurityRoundtable.org

3 Collaboration and communication between technical and nontechnical staff, business lines and executives Wells Fargo & Company Rich Baich, CISO You can have brilliant ideas, but if you can t get them across, your ideas won t get you anywhere. Lee Iacocca Delivering results is a key metric of success for any leader. Exceeding revenue goals, meeting hiring and retention goals, or ensuring operational budget goals are well known and understood results. These goals are clear, easily measurable, and most importantly all individuals understand their role in achieving these results. These goals often are established with limited collaboration and a single communication to the appropriate leaders with minimal tolerance associated with not achieving the goals. The language used when establishing these goals and publishing the results transcends technical and nontechnical executives. This information must be understood and actionable; regardless of the executives background, having this information available allows them to make an informed decision. Leaders need the right information, at the right time to collaborate, communicate, and ultimately make the best decision. Information enables the executive to use a decision process or framework of reasoning to help rationalize the data and choose the best course of action. As the topic of cybersecurity rapidly moves to the top of every C-level executive s agenda, cyber leaders must embrace the importance of collaboration and communication while building bridges to ensure decisions are understood and actionable. Establish a cyber risk decision framework We live in a time of acute and persistent threats to our national security, our economy, and our global communities. The number of reported cyber incidents continues to grow. The threat of a cyber catastrophic event continues to lurk in the distance. New cyber vulnerabilities are reported each day and the frequency of zero-day threats is increasing. New victims make the headlines 1

4 CYBER RISK AND WORKFORCE DEVELOPMENT weekly. As a result, cyber leaders continue to be asked if their organizations are spending enough to address cyberthreats. To answer this question, cyber leadership must have the facts to establish a decision framework to guide them. Having a firewall, purchasing the latest technologies, growing the number of cyber professionals, and having information security policies do not adequately provide all the information needed to answer this question. Knowing what data to collect, demonstrating the ability to get the data in a timely fashion, operationalizing the data, and ensuring the data get to the right decision maker can provide an actionable framework. The following are a few examples of what information is needed to enable a framework: What risks will be mitigated if these additional funds are provided Specific cyberthreats are known, monitored, and integrated into the risk prioritization decision process. Vulnerabilities are identified, prioritized, remediated, and validated in a timely manner. Critical assets are well known, accountability is clear, and responsibility to ensure those assets meet defined protection criteria are met. The likelihood of a specific exploit, attack, or significant occurrence is understood and utilized in the cyber risk prioritization framework. Having trustworthy data is the foundation to all cybersecurity decision frameworks. It is important to have a framework to help support the fundamental changes required to enhance cyber practices and enable communication. Scenario: Cyber risk decision framework Today, the media announces a new zero-day exploit that has been identified. Business executives want to know: What do they need to do to respond to the exploit? How vulnerable are their products and solutions to this exploit? Is there any potential for business impact to customers or suppliers? Do they need to contact their third parties to see if they are secure? Will this affect their ability to service their own third-party relationships? Using the following framework formula to explain an approach could be helpful: Risk = Vulnerability Threat Asset Value Probability of Occurrence Having the trustworthy data readily available can allow cyber executives to quickly and confidently communicate throughout the organization and the third parties. For example, a quick query of the asset inventory indicates there are 50 instances of this exploit in the current infrastructure and five within the third-party ecosystem. Of those 50 internal instances, only three are external facing, and the remaining 47 are internal to the network. All the third-party instances are internal to the partner s network. The associated vendor to the zero-day exploit has provided a patch and recommended an immediate application of the patch. The internal cyberthreat team has reviewed the external intelligence, and there are already indications of potential miscreants scanning for the newly identified vulnerabilities. Additional intelligence and analysis suggest exploit code is already being crafted to take advantage of this new exploit. If successful, the exploit can be used to deliver malicious code throughout the organization providing kinetic and nonkinetic damage to an organization. Armed with this information, cyber leadership can quickly move to gain consensus, communicate recommendations, and influence the mitigation activities required to address the threat. Defining your stakeholders Trustworthy data are a key foundation to establishing cybersecurity creditability. 2

5 COLLABORATION AND COMMUNICATION BETWEEN TECHNICAL AND NONTECHNICAL STAFF, BUSINESS LINES AND EXECUTIVES Performance of executives, regardless if they work in a line of business, in corporate staff, or in technology, is often measured by results. Achieving results in cybersecurity requires others taking action. Effective leaders can motivate groups of like-minded people to come together and rally behind a cause to achieve a goal. Finding those individuals in the organization is critical to success. Identifying individuals who will become stakeholders in the cybersecurity journey provide the support needed to drive change. The following is a list of potential stakeholders to consider: chief executive officer (CEO) chief financial officer (CFO) chief auditor chief administration officer (CAO) chief communication officer (CCO) chief risk officer (CRO) member(s) of the board of directors chief information officer line of business leader audit committee chief technology officer (CTO) line of business leaders, CIO, CTO, risk leaders In addition to individual stakeholders, establishing a cybersecurity steering committee with cross-organizational representation can provide an additional platform for collaboration and communication. The purpose of the committee should be to promote cybersecurity awareness, provide a forum in which cybersecurity topics can be discussed, and to solicit cyber feedback to help evolve cyber practices and mature over time. In addition, the committee will seek to identify cybersecurity topics that may affect the broader applicable industry and the emerging trends that may affect the organization. The cybersecurity committee could: 1. review cybersecurity strategic direction and planned initiatives 2. discuss major milestones for cybersecurity initiatives that are in process of being deployed 3. assess business impact of material cybersecurity program changes 4. discuss lessons learned and situations in which program adjustment is prudent 5. identify potential areas of conflict and/or resource constraints between cybersecurity program and business priorities 6. discuss impacts from and/or to the larger applicable industry. Stakeholders want the facts and reassurance that the information being reporting is trustworthy and actionable. Risk management is everyone s responsibility, and individuals take great pride when helping reduce risk. Proactively removing risk before the risk evolves in negative consequence is a significant measurement for success. Providing a stakeholder with the data that clearly demonstrate a risk was remediated before it was significant will win the trust of most individuals. Scenario: Defi ning stakeholders You have been asked by a line of business leader to provide information regarding a third party before a contract is signed. Due diligence is done for third parties before any contracts are signed; that is a leading industry practice. However, what if you and your cybersecurity team were able to provide cyber intelligence that suggests the potential third-party partner is on a top-five easiestto-hack organization list being posted in credible underground forums? Having information without being able to make it actionable often results in a very heavy paper weight being created. In this scenario, having the cyber intelligence to provide the stakeholders helped provide transparency into cyber risks that can produce measured results. Maintaining a results-oriented mentality coupled with the right stakeholder group can help enable a cyber support culture. Delivering the message Effective communication, especially during a time of change, requires frequent touchpoints. Having a communicator or a communication 3

6 CYBER RISK AND WORKFORCE DEVELOPMENT team specifically aligned with the cybersecurity team can provide immense benefits. There is delicate balance associated with the frequency and content that is communicated to stakeholders. The fundamental goal is to tell the cybersecurity story throughout the organization through clear, concise, targeted communications through the most effective dissemination channels. Some will want more frequent communications, whereas others will desire less communication. Some will prefer pull communications and others will want the information pushed to them. Cultural appetite, tone from the top, and organizational commitment help drive the various required communication delivery techniques to ensure stakeholders are aware. Some examples include the following: publish monthly newsletters to various stakeholders create a robust intranet presence with tools and communications celebrate success stories of collaborative achievements provide platforms for cyber champion recognition track, measure, and report the effectiveness of the communications through a cyber communication dashboard Having a venue into the corporate communications team provides cybersecurity the opportunity to align, influence, and enable the influx of cybersecurity into normal business communications. It is critical that the corporate crisis communication team be part of the cybersecurity incident response team because of the potential reputational impact associated with a significant cyber incident. During a time of crisis, concise and timely communications to key stakeholders and customers can often be the difference between an incident being managed and an incident being exaggerated. Tactically positioning the cybersecurity story within the organization through effective education and awareness while addressing the latest trends in cybersecurity can help build collaboration by demonstrating how individuals can partner with cybersecurity to address customer needs. Regardless of the industry, customers want to know their information is safe and the organization that has their data has a clear plan to achieve that goal. Adding cybersecurity reminders in existing individual customer communications begins to demonstrate that commitment to the customer. It takes a long time to earn trust, but it only takes a second to lose it. This also holds true for internal stakeholders. Often the information and measurement of results reported by the cybersecurity team may not be perceived as positive news. For example, the cybersecurity team may implement new technology that provides an enhanced visibility into the health and hygiene of various technology assets. If these assets have never had this improved visibility, it is possible that the results may provide awareness of critical vulnerabilities or weakness associated with the platform. Consequently, when reporting these results, others may take offense to these perceived negative results. However, this is a great opportunity to educate leadership by explaining that it is far better to find these opportunities internally rather than be told about these vulnerability gaps from a law enforcement representative. Don t pass up the opportunity to build a champion; one champion can quickly lead to two, which, in turn, can often grow to thousands. Conclusion During times of conflict it is proven those countries that have aligned themselves with the right allies have prevailed and overcome grave challenges. These are challenging times; cyberthreats are real and present significant risks for most organizations. Communicating these risks to technical and nontechnical executives can often be a daunting task that requires additional background and context to successfully communicate the message. Executives are results driven and appreciate other executives who are proactive when dealing with risks. The ability to provide 4

7 COLLABORATION AND COMMUNICATION BETWEEN TECHNICAL AND NONTECHNICAL STAFF, BUSINESS LINES AND EXECUTIVES trustworthy data and a cyber decision support framework enables cyber executives to translate a new language to other executives. These actions can positively enhance cybersecurity s internal reputation by strengthening trust and credibility across the organization. Taking the time to include, educate, and collaborate with stakeholders can build alliances. Having the right information is powerful, and those stakeholders who get accurate, timely, and meaningful data will have the opportunity to lead change. SecurityRoundtable.org 5

8 CYBER RISK AND WORKFORCE DEVELOPMENT Wells Fargo & Company 420 Montgomery Street San Francisco, California Tel Web RICH BAICH Chief Information Security Officer Rich Baich is Wells Fargo s Chief Information Security Officer. Prior to joining Wells Fargo, he was a Principal at Deloitte & Touche, where he led the Global Cyber Threat and Vulnerability Management practice. Mr. Baich s security leadership roles include retired Naval Information Warfare Officer, Senior Director for Professional Services at Network Associates (now McAfee) and after 9/11, as Special Assistant to the Deputy Director for the National Infrastructure Protection Center (NIPC) at the Federal Bureau of Investigation (FBI). He recently retired after 20+ years of military service serving in various roles such as a Commander in the Information Operations Directorate at NORAD/Northern Command Headquarters; Commanding Officer Navy Information Operations Center (NIOC), Denver, Colorado; Special Assistant at the National Reconnaissance Office (NRO), Real Time Military Analysis Center, the Reserve Armed Forces Threat Center, the Center for Information Dominance, and the Information Operations Technology Center (IOTC) within the National Security Agency (NSA). Mr. Baich was also selected as an advisor for the 44th President s Commission on Cybersecurity. 6

State Agency Cyber Security Survey v 3.4 2 October 2014. State Agency Cybersecurity Survey v 3.4

State Agency Cyber Security Survey v 3.4 2 October 2014. State Agency Cybersecurity Survey v 3.4 State Agency Cybersecurity Survey v 3.4 The purpose of this survey is to identify your agencies current capabilities with respect to information systems/cyber security and any challenges and/or successes

More information

January IIA / ISACA Joint Meeting Pre-meeting. Cybersecurity Update for Internal Auditors. Matt Wilson, PwC Risk Assurance Director

January IIA / ISACA Joint Meeting Pre-meeting. Cybersecurity Update for Internal Auditors. Matt Wilson, PwC Risk Assurance Director January IIA / ISACA Joint Meeting Pre-meeting Cybersecurity Update for Internal Auditors Matt Wilson, Risk Assurance Director Introduction and agenda Themes from The Global State of Information Security

More information

Connecting the dots: A proactive approach to cybersecurity oversight in the boardroom. kpmg.bm

Connecting the dots: A proactive approach to cybersecurity oversight in the boardroom. kpmg.bm Connecting the dots: A proactive approach to cybersecurity oversight in the boardroom kpmg.bm Connecting the dots: A proactive approach to cybersecurity oversight in the boardroom 1 Connecting the dots:

More information

I D C A N A L Y S T C O N N E C T I O N

I D C A N A L Y S T C O N N E C T I O N I D C A N A L Y S T C O N N E C T I O N Robert Westervelt Research Manager, Security Products T h e R o l e a nd Value of Continuous Security M o nitoring August 2015 Continuous security monitoring (CSM)

More information

Leveraging Network and Vulnerability metrics Using RedSeal

Leveraging Network and Vulnerability metrics Using RedSeal SOLUTION BRIEF Transforming IT Security Management Via Outcome-Oriented Metrics Leveraging Network and Vulnerability metrics Using RedSeal november 2011 WHITE PAPER RedSeal Networks, Inc. 3965 Freedom

More information

Enterprise Security Tactical Plan

Enterprise Security Tactical Plan Enterprise Security Tactical Plan Fiscal Years 2011 2012 (July 1, 2010 to June 30, 2012) Prepared By: State Chief Information Security Officer The Information Security Council State of Minnesota Enterprise

More information

Confident in our Future, Risk Management Policy Statement and Strategy

Confident in our Future, Risk Management Policy Statement and Strategy Confident in our Future, Risk Management Policy Statement and Strategy Risk Management Policy Statement Introduction Risk management aims to maximise opportunities and minimise exposure to ensure the residents

More information

FFIEC Cybersecurity Assessment Tool Overview for Chief Executive Officers and Boards of Directors

FFIEC Cybersecurity Assessment Tool Overview for Chief Executive Officers and Boards of Directors Overview for Chief Executive Officers and Boards of Directors In light of the increasing volume and sophistication of cyber threats, the Federal Financial Institutions Examination Council 1 (FFIEC) developed

More information

Cyber Threat Intelligence Move to an intelligencedriven cybersecurity model

Cyber Threat Intelligence Move to an intelligencedriven cybersecurity model Cyber Threat Intelligence Move to an intelligencedriven cybersecurity model Stéphane Hurtaud Partner Governance Risk & Compliance Deloitte Laurent De La Vaissière Director Governance Risk & Compliance

More information

State of Minnesota. Enterprise Security Strategic Plan. Fiscal Years 2009 2013

State of Minnesota. Enterprise Security Strategic Plan. Fiscal Years 2009 2013 State of Minnesota Enterprise Security Strategic Plan Fiscal Years 2009 2013 Jointly Prepared By: Office of Enterprise Technology - Enterprise Security Office Members of the Information Security Council

More information

Cyber ROI. A practical approach to quantifying the financial benefits of cybersecurity

Cyber ROI. A practical approach to quantifying the financial benefits of cybersecurity Cyber ROI A practical approach to quantifying the financial benefits of cybersecurity Cyber Investment Challenges In 2015, global cybersecurity spending is expected to reach an all-time high of $76.9

More information

Cybersecurity: Considerations for Internal Audit. IIA Atlanta Chapter Meeting January 9, 2015

Cybersecurity: Considerations for Internal Audit. IIA Atlanta Chapter Meeting January 9, 2015 Cybersecurity: Considerations for Internal Audit IIA Atlanta Chapter Meeting January 9, 2015 Agenda Key Risks Incorporating Internal Audit Resources for Internal Auditors Questions 2 Key Risks 3 4 Key

More information

Politics of Security Webcast Summary Cyber Threat News and APT Defenses

Politics of Security Webcast Summary Cyber Threat News and APT Defenses Politics of Security Webcast Summary Cyber Threat News and APT Defenses Introduction Stories about cyber espionage and Advanced Persistent Threats (APTs) are part of the mainstream news cycle. Concerns

More information

Larry Schoeberl, Supervisory Examiner National Credit Union Administration FFIEC Cybersecurity Assessment Tool

Larry Schoeberl, Supervisory Examiner National Credit Union Administration FFIEC Cybersecurity Assessment Tool Larry Schoeberl, Supervisory Examiner National Credit Union Administration FFIEC Cybersecurity Assessment Tool Michigan CU League & Affiliates Conference February 11, 2016 Agenda Risk Trends FFIEC Cybersecurity

More information

Cybersecurity The role of Internal Audit

Cybersecurity The role of Internal Audit Cybersecurity The role of Internal Audit Cyber risk High on the agenda Audit committees and board members are seeing cybersecurity as a top risk, underscored by recent headlines and increased government

More information

Enterprise Risk Management

Enterprise Risk Management Cayman Islands Society of Professional Accountants Enterprise Risk Management March 19, 2015 Dr. Sandra B. Richtermeyer, CPA, CMA What is Risk Management? Risk management is a process, effected by an entity's

More information

Rethinking Information Security for Advanced Threats. CEB Information Risk Leadership Council

Rethinking Information Security for Advanced Threats. CEB Information Risk Leadership Council Rethinking Information Security for Advanced Threats CEB Information Risk Leadership Council Advanced threats differ from conventional security threats along many dimensions, making them much more difficult

More information

Middle Class Economics: Cybersecurity Updated August 7, 2015

Middle Class Economics: Cybersecurity Updated August 7, 2015 Middle Class Economics: Cybersecurity Updated August 7, 2015 The President's 2016 Budget is designed to bring middle class economics into the 21st Century. This Budget shows what we can do if we invest

More information

Experience the commitment WHITE PAPER. Information Security Continuous Monitoring. Charting the Right Course. cgi.com 2014 CGI GROUP INC.

Experience the commitment WHITE PAPER. Information Security Continuous Monitoring. Charting the Right Course. cgi.com 2014 CGI GROUP INC. Experience the commitment WHITE PAPER Information Security Continuous Monitoring Charting the Right Course May 2014 cgi.com 2014 CGI GROUP INC. During the last few months of 2013, six federal agencies

More information

Addressing FISMA Assessment Requirements

Addressing FISMA Assessment Requirements SOLUTION BRIEF Heeding FISMA s Call for Security Metrics and Continuous Network Monitoring Addressing FISMA Assessment Requirements Using RedSeal november 2011 WHITE PAPER RedSeal Networks, Inc. 3965 Freedom

More information

A Framework to Gauge Cyber Defenses

A Framework to Gauge Cyber Defenses White Paper A Framework to Gauge Cyber Defenses NIST s Cybersecurity Framework Helps Critical Infrastructure Owners to Cost-Effectively Defend National & Economic Security of the U.S. Executive Summary

More information

RSA ARCHER OPERATIONAL RISK MANAGEMENT

RSA ARCHER OPERATIONAL RISK MANAGEMENT RSA ARCHER OPERATIONAL RISK MANAGEMENT 87% of organizations surveyed have seen the volume and complexity of risks increase over the past five years. Another 20% of these organizations have seen the volume

More information

Sempra Energy Utilities response Department of Commerce Inquiry on Cyber Security Incentives APR 29 2013

Sempra Energy Utilities response Department of Commerce Inquiry on Cyber Security Incentives APR 29 2013 Sempra Energy Utilities response Department of Commerce Inquiry on Cyber Security Incentives APR 29 2013 Sempra Energy s gas and electric utilities collaborate with industry leaders and a wide range of

More information

Operationalizing Threat Intelligence.

Operationalizing Threat Intelligence. Operationalizing Threat Intelligence. Key Takeaways Time is becoming more and more compressed when it comes to protecting the enterprise Security teams must be able to rapidly and effectively translate

More information

Business Continuity for Cyber Threat

Business Continuity for Cyber Threat Business Continuity for Cyber Threat April 1, 2014 Workshop Session #3 3:00 5:30 PM Susan Rogers, MBCP, MBCI Cyberwise CP S2 What happens when a computer program can activate physical machinery? Between

More information

The Path Ahead for Security Leaders

The Path Ahead for Security Leaders The Path Ahead for Security Leaders Executive Summary What You Will Learn If you asked security leaders five years ago what their primary focus was, you would likely get a resounding: securing our operations.

More information

Into the cybersecurity breach

Into the cybersecurity breach Into the cybersecurity breach Tim Sanouvong State Sector Cyber Risk Services Deloitte & Touche LLP April 3, 2015 Agenda Setting the stage Cyber risks in state governments Cyber attack vectors Preparing

More information

Italy. EY s Global Information Security Survey 2013

Italy. EY s Global Information Security Survey 2013 Italy EY s Global Information Security Survey 2013 EY s Global Information Security Survey 2013 This year s survey our 16th edition captures the responses of 1,909 C-suite and senior level IT and information

More information

The Value of Vulnerability Management*

The Value of Vulnerability Management* The Value of Vulnerability Management* *ISACA/IIA Dallas Presented by: Robert Buchheit, Director Advisory Practice, Dallas Ricky Allen, Manager Advisory Practice, Houston *connectedthinking PwC Agenda

More information

Click to edit Master title style

Click to edit Master title style EVOLUTION OF CYBERSECURITY Click to edit Master title style IDENTIFYING BEST PRACTICES PHILIP DIEKHOFF, IT RISK SERVICES TECHNOLOGY THE DARK SIDE AGENDA Defining cybersecurity Assessing your cybersecurity

More information

FFIEC Cybersecurity Assessment Tool

FFIEC Cybersecurity Assessment Tool Overview In light of the increasing volume and sophistication of cyber threats, the Federal Financial Institutions Examination Council 1 (FFIEC) developed the Cybersecurity Tool (), on behalf of its members,

More information

Seamus Reilly Director EY Information Security sreilly@uk.ey.com 0207 951 3179 Cyber Security

Seamus Reilly Director EY Information Security sreilly@uk.ey.com 0207 951 3179 Cyber Security Seamus Reilly Director EY Information Security sreilly@uk.ey.com 0207 951 3179 Cyber Security An Internal Audit perspective on the threats and responses within the Retail Sector 15 th May 2014 Agenda Introductions

More information

CYBER SECURITY, A GROWING CIO PRIORITY

CYBER SECURITY, A GROWING CIO PRIORITY www.wipro.com CYBER SECURITY, A GROWING CIO PRIORITY Bivin John Verghese, Practitioner - Managed Security Services, Wipro Ltd. Contents 03 ------------------------------------- Abstract 03 -------------------------------------

More information

Cybersecurity in the States 2012: Priorities, Issues and Trends

Cybersecurity in the States 2012: Priorities, Issues and Trends Cybersecurity in the States 2012: Priorities, Issues and Trends Commission on Maryland Cyber Security and Innovation June 8, 2012 Pam Walker, Director of Government Affairs National Association of State

More information

Defending Against Data Beaches: Internal Controls for Cybersecurity

Defending Against Data Beaches: Internal Controls for Cybersecurity Defending Against Data Beaches: Internal Controls for Cybersecurity Presented by: Michael Walter, Managing Director and Chris Manning, Associate Director Protiviti Atlanta Office Agenda Defining Cybersecurity

More information

VOLUME 3. State of Software Security Report. The Intractable Problem of Insecure Software

VOLUME 3. State of Software Security Report. The Intractable Problem of Insecure Software VOLUME 3 State of Software Security Report The Intractable Problem of Insecure Software Executive Summary April 19, 2011 Executive Summary The following are some of the most significant findings in the

More information

Don t Get Left in the Dust: How to Evolve from CISO to CIRO

Don t Get Left in the Dust: How to Evolve from CISO to CIRO SESSION ID: CXO-W04 Don t Get Left in the Dust: How to Evolve from CISO to CIRO JC-JC James Christiansen VP Information Risk Management Accuvant jchristiansen@accuvant.com Bradley J. Schaufenbuel, CISSP

More information

THE SECURITY EXECUTIVE S GUIDE TO A SECURE INBOX. How to create a thriving business through email trust

THE SECURITY EXECUTIVE S GUIDE TO A SECURE INBOX. How to create a thriving business through email trust THE SECURITY EXECUTIVE S GUIDE TO A SECURE INBOX How to create a thriving business through email trust FORWARD Today the role of the CISO is evolving rapidly. Gone are the days of the CISO as primarily

More information

Improving Cyber Security Risk Management through Collaboration

Improving Cyber Security Risk Management through Collaboration CTO Corner April 2014 Improving Cyber Security Risk Management through Collaboration Dan Schutzer, Senior Technology Consultant, BITS Back in March 2013, I wrote a CTO Corner on Operational and Cyber Risk

More information

ENABLING THE BUSINESS WITH SOCIAL RELATIONSHIP PLATFORMS

ENABLING THE BUSINESS WITH SOCIAL RELATIONSHIP PLATFORMS WHITE PAPER ENABLING THE BUSINESS WITH SOCIAL RELATIONSHIP PLATFORMS AN EASY WIN FOR STRATEGIC CIOs THE ROLE OF THE IT LEADER IS CHANGING. CIOs must shift their focus from keeping the lights on to enabling

More information

Blending Corporate Governance with. Information Security

Blending Corporate Governance with. Information Security Blending Corporate Governance with Information Security WHAT IS CORPORATE GOVERNANCE? Governance has proved an issue since people began to organise themselves for a common purpose. How to ensure the power

More information

Linking Risk Management to Business Strategy, Processes, Operations and Reporting

Linking Risk Management to Business Strategy, Processes, Operations and Reporting Linking Risk Management to Business Strategy, Processes, Operations and Reporting Financial Management Institute of Canada February 17 th, 2010 KPMG LLP Agenda 1. Leading Practice Risk Management Principles

More information

www.pwc.com Developing a robust cyber security governance framework 16 April 2015

www.pwc.com Developing a robust cyber security governance framework 16 April 2015 www.pwc.com Developing a robust cyber security governance framework 16 April 2015 Cyber attacks are ubiquitous Anonymous hacker group declares cyber war on Hong Kong government, police - SCMP, 2 October

More information

NGA Paper. Act and Adjust: A Call to Action for Governors. for cybersecurity;

NGA Paper. Act and Adjust: A Call to Action for Governors. for cybersecurity; NGA Paper Act and Adjust: A Call to Action for Governors for Cybersecurity challenges facing the nation. Although implementing policies and practices that will make state systems and data more secure will

More information

How to start a software security initiative within your organization: a maturity based and metrics driven approach OWASP

How to start a software security initiative within your organization: a maturity based and metrics driven approach OWASP How to start a software security initiative within your organization: a maturity based and metrics driven approach Marco Morana OWASP Lead/ TISO Citigroup OWASP Application Security For E-Government Copyright

More information

Cybersecurity: A View from the Boardroom

Cybersecurity: A View from the Boardroom An Executive Brief from Cisco Cybersecurity: A View from the Boardroom In the modern economy, every company runs on IT. That makes security the business of every person in the organization, from the chief

More information

ASSUMING A STATE OF COMPROMISE: EFFECTIVE DETECTION OF SECURITY BREACHES

ASSUMING A STATE OF COMPROMISE: EFFECTIVE DETECTION OF SECURITY BREACHES ASSUMING A STATE OF COMPROMISE: EFFECTIVE DETECTION OF SECURITY BREACHES Leonard Levy PricewaterhouseCoopers LLP Session ID: SEC-W03 Session Classification: Intermediate Agenda The opportunity Assuming

More information

CORE INSIGHT ENTERPRISE: CSO USE CASES FOR ENTERPRISE SECURITY TESTING AND MEASUREMENT

CORE INSIGHT ENTERPRISE: CSO USE CASES FOR ENTERPRISE SECURITY TESTING AND MEASUREMENT CORE INSIGHT ENTERPRISE: CSO USE CASES FOR ENTERPRISE SECURITY TESTING AND MEASUREMENT How advancements in automated security testing software empower organizations to continuously measure information

More information

CYBERSECURITY IN FINANCIAL SERVICES POINT OF VIEW CHALLENGE 1 REGULATORY COMPLIANCE ACROSS GEOGRAPHIES

CYBERSECURITY IN FINANCIAL SERVICES POINT OF VIEW CHALLENGE 1 REGULATORY COMPLIANCE ACROSS GEOGRAPHIES POINT OF VIEW CYBERSECURITY IN FINANCIAL SERVICES Financial services institutions are globally challenged to keep pace with changing and covert cybersecurity threats while relying on traditional response

More information

Wilhelmenia Ravenell IT Manager Eli Lilly and Company

Wilhelmenia Ravenell IT Manager Eli Lilly and Company Wilhelmenia Ravenell IT Manager Eli Lilly and Company Agenda Introductions The Service Management Framework Keys of a successful Service management transformation Why transform? ROI and the customer experience

More information

Dodging Breaches from Dodgy Vendors: Tackling Vendor Risk Management in Healthcare

Dodging Breaches from Dodgy Vendors: Tackling Vendor Risk Management in Healthcare Dodging Breaches from Dodgy Vendors: Tackling Vendor Risk Management in Healthcare Strengthening Cybersecurity Defenders #ISC2Congress Healthcare and Security "Information Security is simply a personal

More information

The Cloud Balancing Act for IT: Between Promise and Peril

The Cloud Balancing Act for IT: Between Promise and Peril The Cloud Balancing Act for IT: Between Promise and Peril Table of Contents EXECUTIVE SUMMARY...2 ONBOARDING CLOUD SERVICES...3 SYSTEMS OF RECORD: THE NEXT WAVE OF CLOUD ADOPTION...6 A CULTURE OF COMPLIANCE

More information

PRIORITIZING CYBERSECURITY

PRIORITIZING CYBERSECURITY April 2016 PRIORITIZING CYBERSECURITY Five Investor Questions for Portfolio Company Boards Foreword As the frequency and severity of cyber attacks against global businesses continue to escalate, both companies

More information

Organizational Structure What Works

Organizational Structure What Works Organizational Structure What Works Evan Wheeler Director, Omgeo Session ID: PROF-001 Session Classification: Professional Development Once you have gotten past the first few months, you will be presented

More information

CLOSING THE DOOR TO CYBER ATTACKS HOW ENTERPRISES CAN IMPLEMENT COMPREHENSIVE INFORMATION SECURITY

CLOSING THE DOOR TO CYBER ATTACKS HOW ENTERPRISES CAN IMPLEMENT COMPREHENSIVE INFORMATION SECURITY CLOSING THE DOOR TO CYBER ATTACKS HOW ENTERPRISES CAN IMPLEMENT COMPREHENSIVE INFORMATION SECURITY CLOSING THE DOOR TO CYBER ATTACKS Cybersecurity and information security have become key challenges for

More information

Cybersecurity and internal audit. August 15, 2014

Cybersecurity and internal audit. August 15, 2014 Cybersecurity and internal audit August 15, 2014 arket insights: what we are seeing so far? 60% of organizations see increased risk from using social networking, cloud computing and personal mobile devices

More information

Bridging the HIPAA/HITECH Compliance Gap

Bridging the HIPAA/HITECH Compliance Gap CyberSheath Healthcare Compliance Paper www.cybersheath.com -65 Bridging the HIPAA/HITECH Compliance Gap Security insights that help covered entities and business associates achieve compliance According

More information

THE TOP 4 CONTROLS. www.tripwire.com/20criticalcontrols

THE TOP 4 CONTROLS. www.tripwire.com/20criticalcontrols THE TOP 4 CONTROLS www.tripwire.com/20criticalcontrols THE TOP 20 CRITICAL SECURITY CONTROLS ARE RATED IN SEVERITY BY THE NSA FROM VERY HIGH DOWN TO LOW. IN THIS MINI-GUIDE, WE RE GOING TO LOOK AT THE

More information

Continuous Network Monitoring

Continuous Network Monitoring Continuous Network Monitoring Eliminate periodic assessment processes that expose security and compliance programs to failure Continuous Network Monitoring Continuous network monitoring and assessment

More information

CyberSecurity Solutions. Delivering

CyberSecurity Solutions. Delivering CyberSecurity Solutions Delivering Confidence Staying One Step Ahead Cyber attacks pose a real and growing threat to nations, corporations and individuals globally. As a trusted leader in cyber solutions

More information

Integrated Risk Management:

Integrated Risk Management: Integrated Risk Management: A Framework for Fraser Health For further information contact: Integrated Risk Management Fraser Health Corporate Office 300, 10334 152A Street Surrey, BC V3R 8T4 Phone: (604)

More information

Cybersecurity Awareness for Executives

Cybersecurity Awareness for Executives SESSION ID: SOP-R04 Cybersecurity Awareness for Executives Rob Sloan Head of Cyber Content and Data Dow Jones @_rob_sloan Session Overview Aim: Provide a high level overview of an effective cybersecurity

More information

NIST Cybersecurity Framework & A Tale of Two Criticalities

NIST Cybersecurity Framework & A Tale of Two Criticalities NIST Cybersecurity Framework & A Tale of Two Criticalities Vendor Management & Incident Response Presented by: John H Rogers, CISSP Advisory Services Practice Manager john.rogers@sagedatasecurity.com Presented

More information

Helping Enterprises Succeed: Responsible Corporate Strategy and Intelligent Business Insights

Helping Enterprises Succeed: Responsible Corporate Strategy and Intelligent Business Insights I D C E X E C U T I V E I N S I G H T S Helping Enterprises Succeed: Responsible Corporate Strategy and Intelligent Business Insights May 2009 By Albert Pang, Research Director, Enterprise Applications

More information

Vulnerability Management. Information Technology Audit. For the Period July 2010 to July 2011

Vulnerability Management. Information Technology Audit. For the Period July 2010 to July 2011 O L A OFFICE OF THE LEGISLATIVE AUDITOR STATE OF MINNESOTA FINANCIAL AUDIT DIVISION REPORT Vulnerability Management Information Technology Audit For the Period July 2010 to July 2011 May 22, 2012 Report

More information

A Primer on Cyber Threat Intelligence

A Primer on Cyber Threat Intelligence A Primer on Cyber Threat Intelligence AS ADVERTISED 2 BUZZWORD BINGO! 3 TODAY S CYBER SECURITY CHALLENGES CISOs finding it difficult to define security ROI to executives Short shelf life for CISOs Vastly

More information

Remarks by. Carolyn G. DuChene Deputy Comptroller Operational Risk. at the

Remarks by. Carolyn G. DuChene Deputy Comptroller Operational Risk. at the Remarks by Carolyn G. DuChene Deputy Comptroller Operational Risk at the Bank Safety and Soundness Advisor Community Bank Enterprise Risk Management Seminar Washington, D.C. October 22, 2012 Good afternoon,

More information

Threat Intelligence. Benefits for the enterprise

Threat Intelligence. Benefits for the enterprise Benefits for the enterprise Contents Introduction Threat intelligence: a maturing defence differentiator Understanding the types of threat intelligence: from the generic to the specific Deriving value

More information

fs viewpoint www.pwc.com/fsi

fs viewpoint www.pwc.com/fsi fs viewpoint www.pwc.com/fsi June 2013 02 11 16 21 24 Point of view Competitive intelligence A framework for response How PwC can help Appendix It takes two to tango: Managing technology risk is now a

More information

Domain 1 The Process of Auditing Information Systems

Domain 1 The Process of Auditing Information Systems Certified Information Systems Auditor (CISA ) Certification Course Description Our 5-day ISACA Certified Information Systems Auditor (CISA) training course equips information professionals with the knowledge

More information

BladeLogic Software-as-a- Service (SaaS) Solution. Help reduce operating cost, improve security compliance, strengthen cybersecurity posture

BladeLogic Software-as-a- Service (SaaS) Solution. Help reduce operating cost, improve security compliance, strengthen cybersecurity posture BladeLogic Software-as-a- Service (SaaS) Solution Help reduce operating cost, improve security compliance, strengthen cybersecurity posture February 20, 2014 Contents The Configuration Security Compliance

More information

Report on CAP Cybersecurity November 5, 2015

Report on CAP Cybersecurity November 5, 2015 Agenda Number 7. Report on CAP Cybersecurity November 5, 2015 Phil Cook CISSP, CISM Manager, Information Technologies Risk #1 External Attacks PR 81 Protect and secure CAP's Information Technology assets

More information

An Overview of Large US Military Cybersecurity Organizations

An Overview of Large US Military Cybersecurity Organizations An Overview of Large US Military Cybersecurity Organizations Colonel Bruce D. Caulkins, Ph.D. Chief, Cyber Strategy, Plans, Policy, and Exercises Division United States Pacific Command 2 Agenda United

More information

THE drop cap white spread is the chartacter style to use for the drop cap. Use this masater

THE drop cap white spread is the chartacter style to use for the drop cap. Use this masater Headline White, Etc. Etc. Etc. Cybersecurity: Subhead Main White Byline White Program Managers Have Questions. Got Answers? THE drop cap white spread is the chartacter style to use for the drop cap. Use

More information

BIG SHIFT TO CLOUD-BASED SECURITY

BIG SHIFT TO CLOUD-BASED SECURITY GUIDE THE BIG SHIFT TO CLOUD-BASED SECURITY How mid-sized and smaller organizations can manage their IT risks and meet regulatory compliance with minimal staff and budget. CONTINUOUS SECURITY TABLE OF

More information

Minimizing Risk Through Vulnerability Management. Presentation for Rochester Security Summit 2015 Security Governance Track October 7, 2015

Minimizing Risk Through Vulnerability Management. Presentation for Rochester Security Summit 2015 Security Governance Track October 7, 2015 Minimizing Risk Through Vulnerability Management Presentation for Rochester Security Summit 2015 Security Governance Track October 7, 2015 Speaker Bio Partnering with clients to drive effective cyber risk

More information

Utilizing Security Ratings for Enterprise IT Risk Mitigation Date: June 2014 Author: Jon Oltsik, Senior Principal Analyst

Utilizing Security Ratings for Enterprise IT Risk Mitigation Date: June 2014 Author: Jon Oltsik, Senior Principal Analyst ESG Brief Utilizing Security Ratings for Enterprise IT Risk Mitigation Date: June 2014 Author: Jon Oltsik, Senior Principal Analyst Abstract: What do large enterprises need in order to address increasingly

More information

Address C-level Cybersecurity issues to enable and secure Digital transformation

Address C-level Cybersecurity issues to enable and secure Digital transformation Home Overview Challenges Global Resource Growth Impacting Industries Address C-level Cybersecurity issues to enable and secure Digital transformation We support cybersecurity transformations with assessments,

More information

Information Security Management System for Microsoft s Cloud Infrastructure

Information Security Management System for Microsoft s Cloud Infrastructure Information Security Management System for Microsoft s Cloud Infrastructure Online Services Security and Compliance Executive summary Contents Executive summary 1 Information Security Management System

More information

Middlesbrough Manager Competency Framework. Behaviours Business Skills Middlesbrough Manager

Middlesbrough Manager Competency Framework. Behaviours Business Skills Middlesbrough Manager Middlesbrough Manager Competency Framework + = Behaviours Business Skills Middlesbrough Manager Middlesbrough Manager Competency Framework Background Middlesbrough Council is going through significant

More information

Cybersecurity Kill Chain. William F. Crowe, CISA, CISM, CRISC, CRMA September 2015 ISACA Jacksonville Chapter Meeting August 13, 2015

Cybersecurity Kill Chain. William F. Crowe, CISA, CISM, CRISC, CRMA September 2015 ISACA Jacksonville Chapter Meeting August 13, 2015 Cybersecurity Kill Chain William F. Crowe, CISA, CISM, CRISC, CRMA September 2015 ISACA Jacksonville Chapter Meeting August 13, 2015 Who Am I? Over 20 years experience with 17 years in the financial industry

More information

THE DIGITAL AGE THE DEFINITIVE CYBERSECURITY GUIDE FOR DIRECTORS AND OFFICERS

THE DIGITAL AGE THE DEFINITIVE CYBERSECURITY GUIDE FOR DIRECTORS AND OFFICERS THE DIGITAL AGE THE DEFINITIVE CYBERSECURITY GUIDE FOR DIRECTORS AND OFFICERS Download the entire guide and follow the conversation at SecurityRoundtable.org Detection, analysis, and understanding of threat

More information

How ERM programs evolve

How ERM programs evolve How to achieve excellent Enterprise Risk Management series www.pwc.com/us/ermexcellenceseries Article 3: June 2015 How ERM programs evolve Overview An organization s enterprise risk management (ERM) program

More information

Defending yesterday. Financial Services. Key findings from The Global State of Information Security Survey 2014

Defending yesterday. Financial Services. Key findings from The Global State of Information Security Survey 2014 www.pwc.com/security Defending yesterday While organizations have made significant security improvements, they have not kept pace with today s determined adversaries. As a result, many rely on yesterday

More information

Solving the CIO s Cybersecurity Dilemma: 20 Critical Controls for Effective Cyber Defense

Solving the CIO s Cybersecurity Dilemma: 20 Critical Controls for Effective Cyber Defense Solving the CIO s Cybersecurity Dilemma: 20 Critical Controls for Effective Cyber Defense John M. Gilligan Information systems Security Association National Capital Chapter January 19, 2010 1 Topics Background

More information

SITUATIONAL AWARENESS MITIGATE CYBERTHREATS

SITUATIONAL AWARENESS MITIGATE CYBERTHREATS Gaining the SITUATIONAL AWARENESS needed to MITIGATE CYBERTHREATS Industry Perspective EXECUTIVE SUMMARY To become more resilient against cyberthreats, agencies must improve visibility and understand events

More information

Achieving Cyber Resilience. By Garin Pace, Anthony Shapella and Greg Vernaci

Achieving Cyber Resilience. By Garin Pace, Anthony Shapella and Greg Vernaci Achieving Cyber Resilience By Garin Pace, Anthony Shapella and Greg Vernaci Cyber security has become the single most important risk to company Boards of Directors around the world. This is not a surprise

More information

Cyber Defence Capability Assessment Tool (CDCAT ) Improving cyber security preparedness through risk and vulnerability analysis

Cyber Defence Capability Assessment Tool (CDCAT ) Improving cyber security preparedness through risk and vulnerability analysis Cyber Defence Capability Assessment Tool (CDCAT ) Improving cyber security preparedness through risk and vulnerability analysis An analogue approach to a digital world What foundations is CDCAT built on?

More information

15 Principles of Project Management Success

15 Principles of Project Management Success 15 Principles of Project Management Success Project management knowledge, tools and processes are not enough to make your project succeed. You need to get away from your desk and get your hands dirty.

More information

Security Controls Implementation Plan

Security Controls Implementation Plan GIAC Enterprises Security Controls Implementation Plan Group Discussion and Written Project John Hally, Erik Couture 08/07/2011 Table of Contents Executive Summary 3 Introduction 3 Security Controls Implementation

More information

CYBER SECURITY INFORMATION SHARING & COLLABORATION

CYBER SECURITY INFORMATION SHARING & COLLABORATION Corporate Information Security CYBER SECURITY INFORMATION SHARING & COLLABORATION David N. Saul Senior Vice President & Chief Scientist 28 June 2013 Discussion Flow The Evolving Threat Environment Drivers

More information

Breaking Down the Silos: A 21st Century Approach to Information Governance. May 2015

Breaking Down the Silos: A 21st Century Approach to Information Governance. May 2015 Breaking Down the Silos: A 21st Century Approach to Information Governance May 2015 Introduction With the spotlight on data breaches and privacy, organizations are increasing their focus on information

More information

All Eyes: A Security Breach Exercise. Disaster Recovery/Security and Business Continuity Readiness

All Eyes: A Security Breach Exercise. Disaster Recovery/Security and Business Continuity Readiness All Eyes: A Security Breach Exercise Disaster Recovery/Security and Business Continuity Readiness Commonwealth of Pennsylvania Molly Dougherty, Director Continuity of Government and Records Information

More information

Convergence of Internal Audit, Compliance, and Risk Management. Frank Bossle Executive Director- Office of Hopkins Internal Audits April 2014

Convergence of Internal Audit, Compliance, and Risk Management. Frank Bossle Executive Director- Office of Hopkins Internal Audits April 2014 Convergence of Internal Audit, Compliance, and Risk Management Frank Bossle Executive Director- Office of Hopkins Internal Audits April 2014 1 Summary Plan to share with you the maturation process at Johns

More information

INNOTAS EBOOK The Transformational CIO

INNOTAS EBOOK The Transformational CIO INNOTAS EBOOK The Transformational CIO The Change Agent That Drives Business Strategy Table of Contents Introduction.... 3 Shifting the Focus to Strategic IT Projects.... 4 Adding Value Through IT Operations....

More information

Security Management. Keeping the IT Security Administrator Busy

Security Management. Keeping the IT Security Administrator Busy Security Management Keeping the IT Security Administrator Busy Dr. Jane LeClair Chief Operating Officer National Cybersecurity Institute, Excelsior College James L. Antonakos SUNY Distinguished Teaching

More information

Introduction. Special thanks to the following individuals who were instrumental in the development of the toolkits:

Introduction. Special thanks to the following individuals who were instrumental in the development of the toolkits: Introduction In this digital age, we rely on our computers and devices for so many aspects of our lives that the need to be proactive and vigilant to protect against cyber threats has never been greater.

More information

Examining the Evolving Cyber Insurance Marketplace

Examining the Evolving Cyber Insurance Marketplace Prepared Testimony and Statement for the Record of Ola Sage Founder and CEO e-management Hearing on Examining the Evolving Cyber Insurance Marketplace Before the Senate Committee on Commerce, Science,

More information

Maintaining PCI-DSS compliance. Daniele Bertolotti daniele_bertolotti@symantec.com Antonio Ricci antonio_ricci@symantec.com

Maintaining PCI-DSS compliance. Daniele Bertolotti daniele_bertolotti@symantec.com Antonio Ricci antonio_ricci@symantec.com Maintaining PCI-DSS compliance Daniele Bertolotti daniele_bertolotti@symantec.com Antonio Ricci antonio_ricci@symantec.com Sessione di Studio Milano, 21 Febbraio 2013 Agenda 1 Maintaining PCI-DSS compliance

More information

Information security governance has become an essential

Information security governance has become an essential Copyright 2007 ISACA. All rights reserved. www.isaca.org. Developing for Effective John P. Pironti, CISA, CISM, CISSP, ISSAP, ISSMP Information security governance has become an essential element of overall

More information