The document discusses outsourcing IT security. It notes that outsourcing is common now and companies must decide when, not if, to outsource. When outsourcing, companies must select the right provider, establish who is in control, own the risks, architect the right solution, maintain flexibility, manage SLAs, balance needs, establish governance through collaboration, consider the provider part of the team, and realize governance has costs. The key messages are that outsourcing is normal now and companies must thoughtfully partner with providers while maintaining ownership of security.

1. Outsourcing IT Security:
Yes, it’s still YOUR problem
Jay Leek
The views and opinions expressed within this presentation are solely my own and do
not necessarily reflect the position of my employer, nor are they intended to be
taken as business, security, financial or legal advice.

2. A history of hi-tech
and innovation
• 1865: Founded
• 1898: Finnish Rubber Works Ltd.
• 1967: began electronics
• 1992: Launch 1st GSM device
• 1999: World’s #1 manufacturer of
mobile devices
• 2009: World’s 5th most valued brand with ~38%
global market share

3. Our global footprint
is a key strength for Nokia ensuring that we retain an
international perspective
Over 1000 Collaborators worldwide
Device manufacturing in 9 countries
Over 125,000 employees

4. Nokia sales Breakdown
Over $70 Billion
North America
Latin America
4% Europe
Greater China 10%
13% 37%
14%
22%
Middle East &
Africa Asia-
Pacific

5. Ask the
audience

6. Outsourcing is nothing new…

10. Maturity of
IT Security Outsourcing

11. The question is not if, but when…
Embrace it while you still have an
option

13. Getting there will not be easy

14. Good days…

15. Normal days…

16. Challenging days…

17. The key is to not
just take a
plunge

18. Must
select the
right
provider

19. Know who is
in control

20. Owning
risks

21. Architecting the
right solution for
YOUR company
Architect:
Antoni Gaudí
Facts and stories
Visitor tours

22. Flexibility

24. Manage your SLAs
30 minute guarantee?
DISCLAIMER: Because safety is a priority, "You Got 30 Minutes™" is not a guarantee, but
an estimate.

25. Balance

26. Establishing a
partnership via
collaboration
governance

27. Example Your company
Governance Executive Board
Service Provider
Model
Strategic
Business Level Tactical
Management Board
Operational Operational
Management Board

28. Opportunity

29. Meet with your vendor
regularly

30. You must consider them
part of YOUR team to
achieve success

31. Governance is not
free

32. Getting the deal done

33. Take away:
•Industry has changed
•Threat landscape has evolved more
quickly than most companies can
manage
•As IT Security professionals, we must
evolve our mindset
•Reward vs. Risk