Crown jewels risk assessment - Cost-effective risk identification

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

SESSION ID:SESSION ID:
#RSAC
Douglas J. Landoll, CISSP, MBA, ISSA Distinguished Fellow
Crown Jewels Risk Assessment: Cost-...

#RSAC
Information Security Risk Assessment (ISRA)
2
Definition- An objective analysis of the current security controls
eff...

#RSAC
Information Security Risk Assessment
3
Preparation
Data
Gathering
Risk Analysis
Risk
Remediation
Reporting
and
Resol...

#RSAC
Traditional Centralized System Risk Assessments
4
Traditional organizations have centralized information systems
Com...

#RSAC
De-Centralized System Risk Assessments
5
Many organizations have expanded from centralized information systems
Cloud...

#RSAC
Information Security Risk Assessment
6
Preparation
Data
Gathering
Risk Analysis
Risk
Remediation
Reporting
and
Resol...

#RSAC
Effect of Increasing # of Systems
7
$ $ $ $ $
Cost
drastically
increase…
as # of
systems
increases.

#RSAC
Effect of Increasing # of Systems
8
Data
quality
suffers…
as # of
systems
increases.

#RSAC
Data Quality Typically Suffers
9
Self-
Assessments
ask each system owner to
rate the strength of their
systems
Surve...

#RSAC
Crown Jewel Approach
10
Threats Impact
Most Critical Data &
Systems
All System Threats
+ Unique threats
+ Targeted a...

#RSAC
Crown Jewels Approach
11
Volume Impact
Most Critical Data &
Systems
For most organizations –
0.01% - 2.0% of total
s...

#RSAC
Crown Jewels Project Environment
12
Fortune 500 Subsidiary
189 information systems; 80%+ cloud-based
36 System owner...

#RSAC
Crown Jewels Project
13ITAR CM.01.2014
Define
For Each
Business
Unit:
Identify
Critical
Systems
Define Critical
Data...

#RSAC
Crown Jewels Project
14ITAR CM.01.2014
Define
Discover
Baseline
Analyze
Secure
Application Risk Survey & Interview R...

#RSAC
Crown Jewels Project Results
15
Identification of Corporate “Crown Jewels”
Determination of Crown Jewel Risk
Limitat...

#RSAC
Applying Crown Jewel Lessons
16ITAR CM.01.2014
Next Week
• Identify Organization’s Security Assessment
Plan
• Self v...

#RSAC
Applying Crown Jewel Lessons
17ITAR CM.01.2014
Within 1 Month
• Identify and Review Contractual and Legal
Security R...

#RSAC
Thank You
Contacts
Doug Landoll, CEO Lantego
dlandoll@lantego.com
18ITAR CM.01.2014

#RSAC
Project Challenges
19ITAR CM.01.2014
1. Common Organizational Definition
of “Crown Jewels”
2. Identification of Busi...

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1063109 views
Storytelling For The Web: Integrate... by Chiara Aliotta 981811 views
Artificial Intelligence, Data and C... by OECD Directorate ... 923520 views
How to Leverage AI to Boost Employe... by SocialHRCamp 392340 views
2024 State of Marketing Report – by... by Marius Sescu 221896 views
Everything You Need To Know About C... by Expeed Software 237729 views

View on Slideshare

1 of 19 Ad

View on Slideshare

1 of 19 Ad