Executive Briefing for Chief Risk Officers, Heads of Resilience and Security Directors, about how to measure and mitigate cyber risks

1. Measuring Cyber Resilience
across Subsidiaries & Suppliers
because what gets measured gets managed
Executive Briefing, 12th March 2019
Kevin Duffey
Kevin.Duffey@CyberRescue.co.uk

2. HACK HERE FOR SECRETS…

3. THE SECRET PRIZE ON 12TH MARCH
£5,000 worth
of the Peer
Comparison
service, for
the best
contributor(s)

4. Cyber Rescue helps CEOs
reduce harm from cyber attacks

5. What is Resilience?
Resilience is the ability to:
• anticipate
• absorb and
• adapt
to challenges.
Source: Resilience First

6. What is Resilience
Resilience is the ability to:
• anticipate  Intelligence
• absorb and  Strength-In-Depth
• adapt  Honesty
to challenges.
Source: Resilience First

7. I’m looking for someone to come on an adventure

8. Questions for your teammates
• Where do you work?
• What’s your job?
• Are you intelligent, strong & honest?

9. Your Mission

10. Your Mission
Keep it secret. Keep it safe.

11. Who do you trust with sensitive data?
1) Your boss
2) Your team
3) Your IT Department
4) Your Supplier(s)

12. Who do you trust with sensitive data?
1) Your boss 63% of CEOs admit to clicking links by mistake
2) Your team
3) Your IT Department
4) Your Supplier(s)

13. Who do you trust with sensitive data?
1) Your boss 63% of CEOs admit to clicking links by mistake
2) Your team 22% of staff clicked a phishing link in the last year
3) Your IT Department
4) Your Supplier(s)

14. Who do you trust with sensitive data?
1) Your boss 63% of CEOs admit to clicking links by mistake
2) Your team 22% of staff clicked a phishing link in the last year
3) Your IT Department 34% of those that spend > 10% of IT budget on
security identified a data breach in last 12 months
4) Your Supplier(s)

15. Who do you trust with sensitive data?
1) Your boss 63% of CEOs admit to clicking links by mistake
2) Your team 22% of staff clicked a phishing link in the last year
3) Your IT Department 17% of those that spend < 10% of IT budget on
security identified a data breach in last 12 months
4) Your Supplier(s)

16. Who do you trust with sensitive data?
1) Your boss 63% of CEOs admit to clicking links by mistake
2) Your team 22% of staff clicked a phishing link in the last year
3) Your IT Department 17% of those that spend < 10% of IT budget on
security identified a data breach in last 12 months
4) Your Supplier(s) 416% annual growth in number of records
breached via a supplier or other third party

17. Who do you trust with sensitive data?
It wants to be found

18. Who do you trust with sensitive data?
1) Your boss 1
2) Your team 1
3) Your IT Department 1
4) Your Supplier(s) 100

19. Who do you trust with sensitive data?
1) Your boss 1 1
2) Your team 1 10
3) Your IT Department 1 100
4) Your Supplier(s) 100 10,000

20. Example: who does HR Dept trust?
Recruitment Agencies
Staff Vetting Agencies
Payroll Agencies
Pension provider
Private health care
Other Benefits Providers
Training Providers
Coaches & Mentors
Staff Survey Providers
Staff Unions
Legal Experts
Outplacement Consultants
Etc, Etc, … .

22. I am incredibly
angry about
this data
breach.
John Legere CEO, T-Mobile USA

23. “Equifax
was using an
‘honor
system’ for
patching”

24. March 8th, 2019

25. What does an
“honour system”
for patching look
like?

26. What does an
“honour system”
for patching look
like?

27. What does an
“honour system”
for patching look
like?

28. Who do you trust with sensitive data?

29. 77% of FTSE 350 businesses fail to properly recognise risks associated with
businesses in the supply chain – March 2019

30. We have a contract…

31. Regulators say Contract not Enough
GDPR (Article 32) requires you to implement a process for regularly
testing, assessing and evaluating technical and organisational
measures for security of processing at suppliers.
Banks operating in the USA must now conform to finance
regulation 23 NYCRR 500 which requires continuous monitoring or
periodic penetration tests of key suppliers.
The European Banking Authority issued Guidelines for all banks to
monitor the level of security at Suppliers.

32. How best to review suppliers?
Attestation: 60 questions completed each year by 1 person at supplier
Awareness: 1 hour online compliance training & assessment by all staff
Certification: 8 hour audit completed every three years by external reviewer
Discussion: 1 hour meeting where supplier explains security governance
Cyber Range: 8 hour competition for IT staff, with scores & feedback
Pen Testing: 10 days of probing each year, of 10% of the applications in use
ScoreCard: 365 days monitoring, scores & feedback on all external systems
Simulation: 2 hour simulation of executive decisions during a breach

33. How best to review suppliers?
Attestation: 60 questions completed each year by 1 person at supplier
Awareness: 1 hour online compliance training & assessment by all staff
Certification: 8 hour audit completed every three years by external reviewer
Discussion: 1 hour meeting where supplier explains security governance
Cyber Range: 8 hour competition for IT staff, with scores & feedback
Pen Testing: 10 days of probing each year, of 10% of the applications in use
ScoreCard: 365 days assessment, scores & feedback on all external systems
Simulation: 2 hour simulation of executive decisions during a breach

34. Discuss their Cyber Crisis Plan

35. Will suppliers (be able to) tell you?

36. Who do you trust with sensitive data?
Is it secret? Is it safe?

37. Executive Simulation

39. HOW READY ARE YOU?

40. HOW READY ARE YOU?

41. HOW READY ARE YOU?

42. HOW READY ARE YOU?

43. HOW READY ARE YOU?

48. The most important question
What will You do
by 12 April to
help your key
Suppliers keep
your secrets safe

49. Censored
The Live Demonstration
given to delegates on 12 March,
of how to measure cyber
resilience is Censored from this
public version of the slides.

50. Measuring Cyber Resilience
across Subsidiaries & Suppliers
because what gets measured gets managed
Executive Briefing, 12th March 2019
Kevin Duffey
Kevin.Duffey@CyberRescue.co.uk