SOURCE Seattle 2011 - Jared Pfost

1. How To: Find The Right Amount Of Security Spend Jared Pfost jared@thirddefense.com thirddefense.wordpress.com @JaredPfost

2. Outline - 30 minutes! Are You Ready To Find the Answer? Tools & Techniques Inspiration 2

3. Are You Ready? 3 Motivating Event

4. 4 Formalize mandatory vs. discretionary spend Work we could do Risk-Based Decisions to Achieve Business Goals Work we should do “Legally Defensible” Security Work we must do Manage Compliant- Ready Services

5. 5 Are we as efficient as possible? Are we operating at acceptable risk?

6. Identify & Prioritize Assets Leverage Business Continuity Team Business Process Recovery & Ownership Good GRC platform scenario Add Regulated Data Classification Assessment Frequency 6

7. Prioritize Risks Threat Based vs. Control Based Construct a Top-Down Story Evidence Driven Define Formal Decision Roles Impact Ranges Calibrate Monetary Impact with Owners Likelihood Ranges Use Evidence for Occurrence Rates Use Culture to Select Model Strive for Consistency 7

8. Prioritize Risks (alt.) Threat Based vs. Control Based Construct a Top-Down Story Evidence Driven Define Formal Decision Roles Impact Ranges Calibrate Monetary Impact with Owners Likelihood Ranges Use Evidence for Occurrence Rates Use Culture to Select Model Strive for Consistency 8

9. Spend Or Owner Accepts Risk Prioritize by Business Value Risk Priority IT Capability Business Support Political Reality Cost Document Decision for Posterity Efficiency Gain Save $110K Mandatory vs. Discretionary 9

10. Control Effectiveness Metrics 10 Use Targets to Define “Acceptable Risk” Start Small

11. Are we as efficient as possible?

12. Define Services & Align Demand What is 100% of Security Services Foundation to manage Tradeoffs Business As Usual Short Term Efforts Long Term Projects Set Maturity Expectations Actual vs. Target 12 Mandatory vs. Discretionary

13. Service Metrics & SLAs Transparency Will Set You Free Start Small % Role Definitions % Project Performance % Business Risk Assessments 13

14. In vs. Out Source Define Internal Process Flow Before Outsourcing Require Metrics in Contract Accountability Through Visibility 14 Attribution: http://www.hotsocialbuzz.com/wp-content/uploads/2010/09/outsource-cartoon.jpg

15. Take Action Determine if your Leadership is Ready Start small Quick Wins Enjoy your career like never before! Start, Advance, Share 15

16. Questions & Resources SIRA: http://societyinforisk.org/ New School: http://newschoolsecurity.com Falcon’s View: http://www.secureconsulting.net/ Our Blog: http://thirddefense.wordpress.com/ Perspective: http://dilbert.com/ 16

17. Appendix 17

18. Breaking Down The Risk Statement 18 (qualitative assessment)