No more security empires - The ciso as an individual contributor

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

SESSION ID:SESSION ID:
#RSAC
Jim Maloney
No More Security Empires –
The CISO as an Individual Contributor
STR-R02
CISO
Avi...

What if your security program had…
no staff, except you
no budget, except your salary
an ad-hoc collection of controls?
Yo...

You adapt (quickly) from this mindset…
a security empire
You adapt (quickly) from this mindset…
build a security empire

to this mindset…
an army of one (or a few)

#RSAC
A journey of discovery
6
Time
Employees
Then Now
<1000
>60,000

#RSAC
What I discovered - security empires, all
7
Company
Corporate
Core Team
Corporate
Business
Partner
Business Unit
Cor...

#RSAC
A more important discovery…
8
Ivory tower
Us vs. themFinger pointing
Security doesn’t
understand the
business
The bu...

No people and no budget? – My plan
• Understand requirements, industry practices
• Assess risk and controls, identify gaps...

#RSAC
Requirements and industry practices
10
Risk
• COSO
• ISO 31000
• NIST SP800-30
Security
• CIS CSC
• NIST CSF
• NIST ...

#RSAC
Risks and gaps
11
CIS CSC and threat assessment as a quick diagnostic
CSF, ISO, NIST as framework and more detailed ...

#RSAC
Build a roadmap
12
Three-year roadmap
Based on identified gaps
Risk-based prioritization
But some quick wins, too
So...

#RSAC
Look for synergies - examples
13
IT needs to manage logs
IT needs to respond to incidents
HR has a training platform...

#RSAC
Finding people
14
Where are the synergies?
Who should own and operate the controls?
Who cares about security?
Who un...

#RSAC
Finding people – my team
15
4 FTE in IT (infrastructure security)
1 FTE in IT (end-user support)
1 FTE in DevOps (pr...

#RSAC
Finding budget
16
Pain points from customers or partners?
Hot buttons from Board members?
Any budget already allocat...

#RSAC
…and a few champions
17
At all levels, across multiple orgs
Who really gets security?
Both active and passive can he...

#RSAC
Execute
18
Establish a clear and compelling vision, mission and objectives
Leadership by influence
Make others succe...

#RSAC
Some execution examples
19
Item CISO Others
Disaster recovery plan Outline, review Plan, testing (IT)
Business conti...

Apply – a green field approach
• Similar to my plan… but every company and program is unique
• Understand requirements, ad...

Apply – retrofit or rebuild
• What can you give away that
could be done by another team?
• What really needs to be
central...

#RSAC
Critical success factors
23
Get total buy-in from your manager
Create or leverage security culture
Don’t report to C...

Your journey will be different
• This shouldn’t be your first CISO journey
• Jury is out regarding scalability
• Be willin...

#RSAC
Questions?
25
email: jmaloney@avidxchange.com
LinkedIn: www.linkedin.com/in/jmaloneycrs
Thanks!
Think different – sm...

#RSAC
More stuff to help you succeed
Appendix – Tools and Techniques

#RSAC
Requirements and industry practices
27
CIS CSC - www.cisecurity.org/critical-controls.cfm
NIST CSF - www.nist.gov/cy...

#RSAC
Simple threat model
28
This is three entries (of 12) from a simple enterprise threat model that was used
to help set...

#RSAC
Assessment tool example
29
This is the format used for both the CSC and CSF assessments
Can use a 0-5 maturity scale...

#RSAC
Roadmap example
30
This is the format used to capture and track security tasks for a three-year window
Each task is ...

#RSAC
Influence references
31
Some good books on influence and power…
Influence: The Psychology of Persuasion, Revised Edi...

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1063109 views
Storytelling For The Web: Integrate... by Chiara Aliotta 981811 views
Artificial Intelligence, Data and C... by OECD Directorate ... 923520 views
How to Leverage AI to Boost Employe... by SocialHRCamp 392340 views
2024 State of Marketing Report – by... by Marius Sescu 221896 views
Everything You Need To Know About C... by Expeed Software 237729 views

View on Slideshare

1 of 31 Ad

View on Slideshare

1 of 31 Ad