The Information Security Profession: Today and Beyond

The Information Security Profession: Today and Beyond
Presented by: Kelly Manthey, Partner www.solstice-consulting.com
Date: 3/04/2010
NetSecure 2010 Conference

Agenda
Introduction
Traditional role of Information Security
Realities facing the Information Security profession
Where the profession is going

A Definition
Information security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification or destruction
Information security is concerned with the confidentiality, integrity and availability of data regardless of the form the data may take: electronic, print, or other forms.
Source: Wikipedia

A little humor…..

Simple terms
keep the bad guys out
let the trusted guys in
give trusted guys access to what they are authorized to access
Layers of the profession
Operational security
Managers
CISO, CSO, Governance Risk and Compliance (GRC)
What is an InformationSecurity Professional

Core CISSP Concepts
Legal, Regulations, Compliance and Investigations
Operations Security
Physical (Environmental) Security
Security Architecture and Design
Telecommunicationsand Network Security
Access Control
Application Security
Business Continuity and Disaster Recovery Planning
Cryptography
Information Security and Risk Management

Traditional View of Information Security
Aligned with technology
Reviews, consults, tests, and monitors the security position of the company’s technology
Operational focus
Focus on audit requirements

Business Realties
Mergers and Acquisition
Security Breaches
Enterprise Re-Orgs
Regulatory Expectations
Auditors
Economic Realities

Today’s Technology Realities

Evolution of the Threats in 2.0
USB and auto-run malicious code
Insiders are a threat, but they don’t know it
Adobe PDFs and Flash replace Word and Excel
Worms travel through social spaces into offices
DOS attacks against social networks
Malware travels via all conduits
Pop-ups advertise seemingly legitimate services and take advantage of current events
Source: David Sherry, CISO Brown University, Mitigating Web 2.0 Threats

Why Evolve?
Because it’s a different world today
Criminals are smarter (and less assuming)
Threats have evolved,are greater, the impact is more severe
Identity theft is growing……fast
www.privacyrights.org
Customer perception; company reputation

Identity Theft Stats
Stolen wallets and physical paperwork accounts for almost half (43%) of all identity theft (Javelin Strategy and Research, 2009).
Online methods accounted for only 11% (Javelin Strategy and Research, 2009).
38% of ID theft victims had their debit or credit card number stolen (Javelin Strategy and Research, 2009).
37% of ID theft victims had their Social Security number stolen (Javelin Strategy and Research, 2009).
36% of ID theft victims had their name and phone number compromised (Javelin Strategy and Research, 2009).
24% of ID theft victims had their financial account numberscompromised (Javelin Strategy and Research, 2009).
More than 35 million data records were compromised in corporate and government data breaches in 2008 (ITRC).
59% of new account fraud that occurred in 2008 involved opening up a new credit card and store-branded credit card accounts (Javelin Strategy and Research, 2009).
Source: SpendOnLife.com credit reporting 2009 Study

Where is Security Going?
More business focus
Differentiator for competitive advantage
Enabling function; not just CYA
Less checking the box, more differentiation
Requires management to look at Information Security differently

From operational to client facing
Thought leadership
Enables enterprise maturity
Not just technology or control focus – business process focus
Creates a culture of compliance
Must educate
Is a competitive advantag
Focuses on balancing tactical problem solving with business priorities and company culture
Today’s Information Security Professional

Follow-ups.. . .
Kelly Manthey
kmanthey@solstice-consulting.com
Blog: http://mantheyblog.solstice-consulting.com/
Twitter: @kmanthey
Other Thought Leadership:
www.solstice-consulting.com
CIO.com Blog: http://advice.cio.com/user/solstice_consulting/track
Follow us on Facebook and Twitter:
Twitter: http://twitter.com/solsticellc
Facebook: http://www.facebook.com/solsticeconsulting

http://mantheyblog.solstice-consulting.com	24
https://bb.csueastbay.edu	18
http://www.slideshare.net	8
http://www.lmodules.com	2
http://translate.googleusercontent.com	1

The Information Security Profession: Today and Beyond

by kmanthey on Mar 02, 2010

Accessibility

Categories

Tags

Upload Details

Usage Rights

5 Embeds 53

Statistics

The Information Security Profession: Today and Beyond — Presentation Transcript