The document discusses the challenges of existing security models, highlighting their complexity and lack of prioritization. It introduces the CISO Platform Security Strategy Model (CP-SSM), which aims to offer a minimalist and focused approach to security strategy through threat modeling and prioritization. Key elements include a threat repository, prioritization guidelines, and a mapping between threats and controls.

1. CISO Platform Security Strategy
Model ( CP-SSM )
Bikash Barai

3. Challenges with existing models
• Too heavy to be intimidating - Too many steps
• Cannot be done incrementally – Needs big
bang approach
• Very few SABSA professionals and very few
implementation
• Does not produce a prioritized list of security
activities

4. Goodness Criteria
• Should help to eliminate
• Should help to focus
• Should be simple
• Should be easy to remember

5. Introducing CP-SSM

6. Goals of CP-SSM
• Light
• Minimalist
• Focused

7. Steps
• Create Business Architecture (High Level)
• Strategic Threat Modeling
• Elimination: Bucket and Prune
• Mapping: Threats to 4 types of controls
• Priority Bucketing of Activities

8. Key Elements
• CP- Threat Repository
• Threat Prioritization Guideline – Available
– Benchmark, Risk Management Model
• CP - Control Repository – Not available
• CP- Threat to Control Map – Not available
• CP- Activity/Control Priority Map

9. Threat Repository
• Taxonomy
– Software (26 sub class)
– Hardware (3)
– Physical Security (3)
– Supply Chain (2)
– Human (3)
• Industry or vertical specific top N listing

10. CISO Platform Threat – Control Map
• Threat: SQL Injection Attack
– Detection: WAF, SAST, DAST, IAST, RASP
– Prevention: Secure Coding, WAF, RASP
– Response: SIEM, SOC Response Process
– Prediction: TI (External and Internal)

11. Prioritization Matrix
Prevention Detection Response Prediction
High Risk 1 1 2 3
Medium
Risk
2 2 2 3
Low Risk 3 3 3 3

12. Next Steps
• Utilize the model (loosely) for building an
Appsec Program - Post Lunch
• Create Community Projects
– Threat Repository (Comprehensive + Top N)
– Threat Control

13. Thank You
@bikashbarai1