Information Security in a Downturn

Transcription

1 Information Security in a Downturn Prof. Howard A. Schmidt, CISSP, CSSLP President and CEO Information Security Forum Ltd. Vice-Chair and Security Strategist (ISC)2 Board of Directors

2 Agenda 1. The Information Security Forum 2. Information security and the downturn 3. The world has changed 4. Key information security challenges 5. How can I respond? Security in a Downturn Copyright 2008 Information Security Forum Limited 2

3 The Information Security Forum (ISF) An international association of approximately 300 leading global organisations, which... addresses key issues in information risk management through research and collaboration develops practical tools and guidance is fully independent and driven by its Members promotes networking within its membership. Security in a Downturn Copyright 2008 Information Security Forum Limited 3

4 What the ISF provides for its Members and much more besides! Security in a Downturn Copyright 2008 Information Security Forum Limited 4

5 Information security and the downturn (1) Organisations are focusing on cash, cost control and retaining customers Internal cost-centres are targets for cost control - Information security sometimes viewed as an overhead The downturn and organisational responses may change the organisational risk profile and risk appetite - May alter the operating environment for information security Security in a Downturn Copyright 2008 Information Security Forum Limited 5

6 Information security and the downturn (2) Information security could be affected - Spending on information security might be reduced - But the reduction will lag the downturns in the economy and organisation Threats and risks to information will change - New threats and risks will emerge - Sophistication will increase Will your information security budget change in 2009? Increase Staying the same Decrease 0% 10% 20% 30% 40% 50% 60% 70% % of respondents Source: ISF MX Quick Vote Security in a Downturn Copyright 2008 Information Security Forum Limited 6

7 The world has changed very quickly POLITICAL LEGAL Intellectual property, electronic evidence, identity theft ECONOMIC SOCIO-CULTURAL Espionage, lack of public trust, cyber-terrorism Emerging economies, complex ownership, organised crime Corporate loyalty, demographics Long-term threats are in the here and now TECHNICAL Web 2.0, solar flares, process control Security in a Downturn Copyright 2008 Information Security Forum Limited 7

8 Key information security challenges There are four major information security challenges: - poor understanding of the information risk environment by the organisation - misalignment of the information risk strategy with revised business objectives - obsolescence of plans and processes associated with information security - lack of focus on the long-term objectives of the information security function. Security in a Downturn Copyright 2008 Information Security Forum Limited 8

9 Key information security threats today Cybercrime - It s growing and becoming more specialised Espionage - Exposure of Intellectual Property Fraud and embezzlement - Both internal and external Disgruntled employees - Sabotage, data theft Incidents - Relative impact may increase Cutting too deep - Loss of expertise and experience Lack of support from IT - Their budgets are under pressure too! Security in a Downturn Copyright 2008 Information Security Forum Limited 9

10 How can I respond? 1. Get the basics right identify critical and/or sensitive information re-assess information risk identify and deploy security controls re-examine security function activities 2. Throw out your assumptions look beyond historical data change your thinking about the threats revise information security plans question the beliefs 3. Plan for uncertainty prepare for a whole new world develop and rehearse responses Security in a Downturn Copyright 2008 Information Security Forum Limited 10

11 How can I respond? 4. Become the risk champion adapt to changes in the organisation s risks use your nose for risk 5. Build for the future maintain capability Members of the ISF have a strategy Security in a Downturn Copyright 2008 Information Security Forum Limited 11

12 ISF Reports Managing Security in a Downturn Economy Profit Driven Attacks Insider Threats Threat Horizon 2010 Effective approaches to managing a security function Information security strategy Examining the needs of CISO RISE: role of information security in the enterprise The Insider view Security in a Downturn Copyright 2008 Information Security Forum Limited 12

13 Information Security Forum Security in a Downturn Copyright 2008 Information Security Forum Limited 13