No more security empires - The ciso as an individual contributor
•
2 likes•193 views
The staffing model for many mid-sized security programs is typically based on a highly centralized security team. While that provides a high degree of control, it can create inefficiencies and a lack of ownership relative to implementation of the program. This session will share the presenter’s experience as a CISO with no direct reports, leveraging people and budgets across the entire company. (Source : RSA Conference USA 2017)
Recommended
More Related Content
What's hot
What's hot (20)
Similar to No more security empires - The ciso as an individual contributor
Similar to No more security empires - The ciso as an individual contributor (20)
More from Priyanka Aash
More from Priyanka Aash (20)
Recently uploaded
Recently uploaded (20)
No more security empires - The ciso as an individual contributor
- 1. SESSION ID:SESSION ID: #RSAC Jim Maloney No More Security Empires – The CISO as an Individual Contributor STR-R02 CISO AvidXchange, Inc. @cyberrisks
- 3. What if your security program had… no staff, except you no budget, except your salary an ad-hoc collection of controls? You are here
- 4. You adapt (quickly) from this mindset… a security empire You adapt (quickly) from this mindset… build a security empire
- 5. to this mindset… an army of one (or a few)
- 6. #RSAC A journey of discovery 6 Time Employees Then Now <1000 >60,000
- 7. #RSAC What I discovered - security empires, all 7 Company Corporate Core Team Corporate Business Partner Business Unit Core Team Business Unit Business Partner A X B X X C X X D X X E X
- 8. #RSAC A more important discovery… 8 Ivory tower Us vs. themFinger pointing Security doesn’t understand the business The business doesn’t understand security this isn’t working And more
- 9. No people and no budget? – My plan • Understand requirements, industry practices • Assess risk and controls, identify gaps • Build a roadmap • Look for synergies • Find people, budget and champions • Execute
- 10. #RSAC Requirements and industry practices 10 Risk • COSO • ISO 31000 • NIST SP800-30 Security • CIS CSC • NIST CSF • NIST SP800-53 • ISO 27001 • ISO 27002 • PCI DSS • HIPAA Privacy • GAPP • HIPAA • GLBA
- 11. #RSAC Risks and gaps 11 CIS CSC and threat assessment as a quick diagnostic CSF, ISO, NIST as framework and more detailed assessment PCI DSS and HIPAA assessments as supplemental GAPP for baseline privacy assessment Red – missing, yellow – partial, green – in place Tag reds and yellows with potential owners
- 12. #RSAC Build a roadmap 12 Three-year roadmap Based on identified gaps Risk-based prioritization But some quick wins, too So called ‘black swans’ are the most difficult (low probability, high impact) ‘Gnats’ are the most annoying (high probability, low impact)
- 13. #RSAC Look for synergies - examples 13 IT needs to manage logs IT needs to respond to incidents HR has a training platform and initiatives Legal wants standard contract terms Software development wants to improve quality Product wants desirable features for customers Marketing wants to enhance brand
- 14. #RSAC Finding people 14 Where are the synergies? Who should own and operate the controls? Who cares about security? Who understands security?
- 15. #RSAC Finding people – my team 15 4 FTE in IT (infrastructure security) 1 FTE in IT (end-user support) 1 FTE in DevOps (production support) 2 FTE in Software Engineering (secure coding) 1 FTE in Facilities (physical security) 1 FTE across HR, Legal, Risk & Compliance (contracts, training, etc.)
- 16. #RSAC Finding budget 16 Pain points from customers or partners? Hot buttons from Board members? Any budget already allocated to security controls? Any unused budget? Compliance obligations? Black swans and gnats?
- 17. #RSAC …and a few champions 17 At all levels, across multiple orgs Who really gets security? Both active and passive can help
- 18. #RSAC Execute 18 Establish a clear and compelling vision, mission and objectives Leadership by influence Make others successful Do favors and collect favors Build a personal brand and a security brand Quick wins Demonstrate value
- 19. #RSAC Some execution examples 19 Item CISO Others Disaster recovery plan Outline, review Plan, testing (IT) Business continuity Policy, risk assessments Plans, testing (BU) Application security Training, tool selection Tool implementation, process (SE) Incident response Security and privacy supplement Crisis communications plan, IR plan, IR team (IT) Vulnerability management Requirements, SLA, references (NIST) Vulnerability management and patching program (IT) Vendor management Security terms, model Standard agreements, policy (Legal) Security awareness Requirements, advice Content in LMS (HR)
- 20. #RSAC Results so far - plusses and minuses 20 Plus – Engagement Ownership Speed Scope Brand Minus – Not always able to find synergy Some battles of priority Tracking security investment and effort Convincing partners and auditors Being invited to the right meetings Disappearing budgets
- 21. Apply – a green field approach • Similar to my plan… but every company and program is unique • Understand requirements, adopt industry practices • Assess risk and controls, identify gaps • Build a roadmap • Look for synergies • Find people, budget and champions • Execute
- 22. Apply – retrofit or rebuild • What can you give away that could be done by another team? • What really needs to be centralized vs. what can be done as well or better by other teams? • Outsourcing? • The what, why and how recipe
- 23. #RSAC Critical success factors 23 Get total buy-in from your manager Create or leverage security culture Don’t report to CIO / head of IT Execute and deliver Focus on the what and why, with just a little how Do non-security work (trading favors) Plan B – Selectively pull functions and people to the center if needed
- 24. Your journey will be different • This shouldn’t be your first CISO journey • Jury is out regarding scalability • Be willing to fail fast, learn and adapt
- 25. #RSAC Questions? 25 email: jmaloney@avidxchange.com LinkedIn: www.linkedin.com/in/jmaloneycrs Thanks! Think different – small can be cool. :-)
- 26. #RSAC More stuff to help you succeed Appendix – Tools and Techniques
- 27. #RSAC Requirements and industry practices 27 CIS CSC - www.cisecurity.org/critical-controls.cfm NIST CSF - www.nist.gov/cyberframework GAPP - www.aicpa.org PCI DSS - www.pcisecuritystandards.org HIPAA - www.hhs.gov/hipaa/for-professionals/index.html GLBA - www.ftc.gov/tips-advice/business-center/privacy-and- security/gramm-leach-bliley-act Other NIST guidance – www.csrc.nist.gov/publications/PubsSPs.html
- 28. #RSAC Simple threat model 28 This is three entries (of 12) from a simple enterprise threat model that was used to help set implementation priorities for closing identified gaps Likelihood and impact have scores generated by the selected rating and then combined to calculate an overall risk rating for each threat The rating scales and calculations are similar to NIST SP800-30
- 29. #RSAC Assessment tool example 29 This is the format used for both the CSC and CSF assessments Can use a 0-5 maturity scale or simply red (missing), yellow (partial), green (in place)
- 30. #RSAC Roadmap example 30 This is the format used to capture and track security tasks for a three-year window Each task is assigned a general category (e.g., Access Management) Tasks have identified sources, assigned priorities, target completion dates, and owners
- 31. #RSAC Influence references 31 Some good books on influence and power… Influence: The Psychology of Persuasion, Revised Edition by Robert B. Cialdini Influencer: The New Science of Leading Change, Second Edition by Joseph Grenny and Kerry Patterson Influencing Up by Allan R. Cohen and David L. Bradford Power: Why Some People Have It and Others Don't by Jeffrey Pfeffer