Extreme risk - how bad tech mgmt destroys firms

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

EXTREMERISK
10 WAYS POORLY MANAGED TECH
CAN DESTROY YOUR COMPANY

dude, failing to manage IT
risk is serious

you might have to stop doing business altogether
stolen data can be used against your customers
the press may have a field...

and just cause you’re a
small, nimble start-up does
not give you license to be
sloppy (especially if you
hope to pass exit...

here are 10 obvious, but
common, mistakes to
avoid…

LACK
LEADERSHIPMISTAKE

LACK LEADERSHIP
Leadership must
understand the strategic
importance of technology
risk management
They must also be involv...

LACK LEADERSHIP
Leadership must put in place a
technology risk management
(TRM) framework that includes
the right culture,...

LACK LEADERSHIP
Leadership must get the right
people, in the right roles, at
the right time, with the right
trainingMISTAKE

LACK LEADERSHIP
Leadership must ensure that
risks are identified and
prioritized by likelihood and
severityMISTAKE

LACK LEADERSHIP
Leadership must identify
control gaps, prioritize and
budget for remediation, &
monitor projects to close ...

LACK LEADERSHIP
Leadership must approve &
track exceptions
MISTAKE

LACK LEADERSHIP
Line managers must be
engaged & accountable for
TRM
TRM must not be seen as
red tape. It must be seen as
a...

LACK TRM
FRAMEWORKMISTAKE

LACK TRM FRAMEWORK
ATRM Framework must
protect data & IT assets from
unauthorized access or
disclosure, misuse, and
fraudu...

LACK TRM FRAMEWORK
ATRM Framework must
ensure data confidentiality,
system security, reliability,
resiliency, & recoverabi...

LACK TRM FRAMEWORK
ATRM Framework must
define roles & responsibilities
MISTAKE

LACK TRM FRAMEWORK
ATRM Framework must
identify & prioritize IT assets
MISTAKE

LACK TRM FRAMEWORK
ATRM Framework must
identify & assess impact and
likelihood of operational &
emerging risk including in...

LACK TRM FRAMEWORK
ATRM Framework must
methodically & regularly
inventory and prioritize risks,
controls, exceptions, and
...

LACK TRM FRAMEWORK
ATRM Framework must be
updated regularly
MISTAKE

LACK PARTNER
OVERSIGHT
MISTAKE

LACK PARTNER OVERSIGHT
IT provided or supported by
partners must be in scope &
leadership must fully
understand outsourcin...

LACK PARTNER OVERSIGHT
Proper due diligence must
ensure viability, capability,
reliability, & stability of
vendorsMISTAKE

LACK PARTNER OVERSIGHT
Written contracts must define
expected risk-related service
levels, roles, obligations, &
control p...

LACK PARTNER OVERSIGHT
A Service Level Management
Framework such as the IT
Infrastructure Library (ITIL)
must ensure conti...

LACK PARTNER OVERSIGHT
An exit / backup plan must be
in place to switch partners if
required
MISTAKE

LACK PORTFOLIO
MANAGEMENT
MISTAKE

LACK PORTFOLIO MGMT
The entire technology
portfolio/platform must be
managed through it's
lifecycle
The business must be
e...

LACK PORTFOLIO MGMT
Enterprise architecture
strategy must be supported
by accurate & accessible
MIS and asset management
d...

LACK PORTFOLIO MGMT
Leadership must define,
document, & communicate
the target state platform
MISTAKE

LACK PORTFOLIO MGMT
A professional Project /
Change Management
Framework like Project
Management Body Of
Knowledge (PMBOK)...

LACK PORTFOLIO MGMT
A professional Quality
Management program
should ensure quality of
build and operate
For example, a do...

LACK PORTFOLIO MGMT
There must be strong
testing & code review
controls
MISTAKE

LACK PORTFOLIO MGMT
ITAcquisition must be
strategically aligned
MISTAKE

LACK PORTFOLIO MGMT
Technology exit planning
must be explicit & tracked
MISTAKE

LACK SERVICE
MANAGEMENT
MISTAKE

LACK SERVICE MGMT
Ongoing IT operations must
be guided by a Service
Management (SM)
Framework like ITILMISTAKE

LACK SERVICE MGMT
The SM Framework should
cover:
• Change Management & DevOps
• Release & Deployment
Management
• Capacity...

LACK
RECOVERABILITY
MISTAKE

LACK RECOVERABILITY
The firm needs a realistic,
business-prioritized,
strategically-aligned & simple
business continuity p...

LACK RECOVERABILITY
The BCP should identify
critical systems (those that
must not go down) as well as
recovery point objec...

LACK RECOVERABILITY
The disaster recovery plan
should cover multiple
scenarios, expose
dependencies, & be tested
regularly...

LACK RECOVERABILITY
Backup management must
ensure that IT assets can be
recovered as soon as
required, depending on
priori...

LACK RECOVERABILITY
There should be a
Communications Plan
defined in advance to deal
with various scenariosMISTAKE

LACK DATA
SECURITYMISTAKE

LACK DATA SECURITY
You must protect data,
hardware, software, and
networks from accidental or
intentional unauthorized
acc...

LACK DATA SECURITY
You must identify levels of
data sensitivity and ensure
escalating levels of
protection based upon the
...

LACK DATA SECURITY
You must have end-to-end
data protection such as
encryption when you are
dealing with confidential data...

LACK DATA SECURITY
You must properly dispose
of assets that hold
confidential data
MISTAKE

LACK DATA SECURITY
You must have a
mechanism to monitor
security & react as required
MISTAKE

LACK SYSTEM
SECURITY
MISTAKE

LACK SYSTEM SECURITY
You must protect data,
hardware, software, and
networks from accidental or
intentional unauthorized
a...

LACK SYSTEM SECURITY
You must identify levels of
sensitivity & ensure escalating
levels of protection based
upon the signi...

LACK SYSTEM SECURITY
You must ensure that IT
assets are patched as
required
You must ensure that IT
assets are migrated ou...

LACK SYSTEM SECURITY
You must deploy the right
level of network security
(including anti-virus) across
operating systems, ...

LACK SYSTEM SECURITY
Key points in the
infrastructure (perimeter &
internal as required) must be
protected through intrusi...

LACK SYSTEM SECURITY
You must test security using
vulnerability assessment &
penetration testing regularly
MISTAKE

LACK SYSTEM SECURITY
You must have a mechanism
to monitor security and react
as required
MISTAKE

LACK PHYSICAL
SECURITY
MISTAKE

LACK PHYSICAL SECURITY
You must protect data,
hardware, software, and
networks from accidental or
intentional unauthorized...

LACK PHYSICAL SECURITY
You must identify levels of
sensitivity & ensure
escalating levels of protection
based upon the sig...

LACK PHYSICAL SECURITY
There must be regular threat
and vulnerability
assessments
MISTAKE

LACK PHYSICAL SECURITY
You must implement
appropriate physical security
such as need-to-access-only
requirements & securit...

LACK PHYSICAL SECURITY
Critical resources such as air,
water, power fire
suppression, &
communications should be
redundant...

LACK ACCESS
CONTROLS
MISTAKE

LACK ACCESS CONTROLS
For critical / sensitive systems
an individual must not be
granted access alone (never-
alone princip...

LACK ACCESS CONTROLS
The transaction process
should prevent a single person
from initiating, approving, and
executing by t...

LACK ACCESS CONTROLS
Access should be limited to
need-to-know (access-control
principle)MISTAKE

LACK ACCESS CONTROLS
Access should be logged and
access rights should be easy
to review & modify as access
rights change n...

LACK ACCESS CONTROLS
There must be separate
environments for
development, testing, and
production with controlled
access t...

SHARE THIS DECK
& FOLLOW ME(please-oh-please-oh-please-oh-please)
stay up to date with my future
slideshare posts
http://w...

CLICK HERE FOR MORE!!!!

CREATIVE COMMONS ATTRIBUTIONS & REFERENCES
Title Slide: http://www.flickr.com/photos/23754017@N08/
Dude Slide: http://www....

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

26 ways to recognize employees by Eric Tachibana 1852 views
Be an enterprise social network roc... by Eric Tachibana 8843 views
10 strategy must haves by Eric Tachibana 16651 views
5 things I wish I knew before start... by National Entrepre... 108650 views
Start-up Financial Forecasting by Eric Tachibana 9338 views
Social influence for startups marke... by Eric Tachibana 8482 views

View on Slideshare

1 of 74 Ad

View on Slideshare

1 of 74 Ad