Briefing the board lessons learned from cisos and directors

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

#RSAC
SESSION ID:SESSION ID:
#RSAC
John Pescatore
CXO-T11 - Briefing the Board: Lessons
Learned from CISOs and Directors
C...

#RSAC
“Obviously, some people here
do not appreciate the gravity
of our situation.”

#RSAC
Measuring the Right Things –
Having Something Business
Relevant to Say to the Board
John Pescatore, SANS

#RSAC
Driving Security Change By Communicating Upwards
We mostly know what to do in security,
and we can learn how to do o...

#RSAC
What (Actually) Works?
Separate the hype from the reality of
briefing the board
John and Alan’s centuries years of
e...

#RSAC
Why Do Some Do Better Than Others?
980 breaches in 2016
What did the other 9,020 of the F10000 do
differently?
(781 ...

#RSAC
Characteristics of Cybersecurity Success
Understand vulnerabilities and threats – critical table stakes
Know demands...

#RSAC
Shellye Archambeau
Director Verizon,
Nordstrom
Steve Martino
VP CISO Cisco
Kim Jones
CISO Vantiv
Gary Hayslip
CISO C...

#RSAC
Nick Fick
Director Dartmouth
University
Suzanne Vautrinot
Director Wells Fargo,
Symantec
Josh Davis
Qualcomm

#RSAC
REPLACESLIDE

#RSAC
Avoiding the same old noise…

#RSAC
Focus on protecting the
business first
Effectively and efficiently
and quickly
Make sure the solution isn’t
worse th...

#RSAC
Useful Security Metrics Can:
Drive change
Increase efficiency
Increase effectiveness
Give Warning
Action Required
In...

#RSAC
Delivering Security Efficiency and Effectiveness
Decrease the cost of dealing with
known threats
Decrease the impact...

#RSAC
Steve Martino, VP InfoSec, Cisco

#RSAC
Sources of Examples

#RSAC
Some Real World Examples
Healthcare – Building Security in Maturity Model (BSIMM) increase in
secure app dev life cy...

#RSAC
Source: Kim Jones, Vantiv CISO at SANS Scottsdale AZ CISO Hot Topics Session

#RSAC
Alan Paller
The SANS Institute
paller@sans.org
AUGUST 2016, WASHINGTON, DC
Copyright 2016. SANS Institute
So You Jus...

#RSAC
The Situation
The CIO emails the CISO saying that Board of Directors
is meeting next week; they want to be briefed o...

#RSAC
In Their Own Words
Shellye Archambeau
Member of the Board of Directors of
Verizon
Arbitron
Nordstrom
CEO of MetricSt...

#RSAC

#RSAC

#RSAC

#RSAC

#RSAC

#RSAC

#RSAC

#RSAC

#RSAC
Examples of BAD Slides ACTUALLY USED
IN A FEDERAL Executive BOARD BRIEFING

#RSAC
Agency IT Risk Management (AITRM) Program
ISCM is a risk-based strategy to maintain ongoing awareness
of information...

#RSAC
Agency IT Risk Management (AITRM) Program
AITRM integrates technical capabilities, reporting
requirements, managemen...

#RSAC
Four CISOs Who Found Effective Paths
Approaches that have worked:

#RSAC
CISO 1: Board Briefing
Plus:
1) FBI Director to validate the
immediacy of the risk
2) CISO of a well known industry
...

#RSAC
CISO 2: Top Management Update
Continuous quarterly gap analysis vs the 20 Critical Controls
Critical control categor...

#RSAC
CISO 3: Reporting to Cabinet Secretary & Congress
90% risk reduction
over 12 months
0.0
200.0
400.0
600.0
800.0
1,00...

#RSAC
To be credible to management, metrics must be
“authoritative and important and reliably measured”
How can you prove ...

#RSAC
Who Understands Offense?
Would they be willing to combine their knowledge of attacks
and offense to define the most ...

#RSAC
CISO 4: Major Utility
Let’s start with the results:
The Chairman of the Board told the CIO: “That’s
the first time a...

#RSAC
20 Critical Security Controls
Sample Red/Yellow/Green Metric
1 2
3
4
5
6
7
8
9
101112
13
14
15
16
17
18
19
20
Protec...

#RSAC
Auditor Buy-in
ONE More benefit from using the
validated critical controls

#RSAC
Summary
CISO’s perspective doesn’t necessarily match
the Board of Directors’ perspective
What do I need to do? How m...

#RSAC
When You Get Back to Work
Make sure you are collecting the right security metrics so you can demonstrate
value, impr...

#RSAC
Resources
SANS What Works: https://www.sans.org/critical-security-controls/case-studies
CIS Critical Security Contro...

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1063109 views
Storytelling For The Web: Integrate... by Chiara Aliotta 981811 views
Artificial Intelligence, Data and C... by OECD Directorate ... 923520 views
How to Leverage AI to Boost Employe... by SocialHRCamp 392340 views
2024 State of Marketing Report – by... by Marius Sescu 221896 views
Everything You Need To Know About C... by Expeed Software 237729 views

View on Slideshare

1 of 44 Ad

View on Slideshare

1 of 44 Ad