Pharos Security Solution
•Download as PPTX, PDF•
0 likes•34 views
Pharos doesn't deliver bad news and leave you to fix it. Pharos CSO helps you achieve and show more value from existing spend, set up a roadmap of victories that matter to the Board, and articulate the business case for investment so that you gain traction.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Pharos Security Solution
Similar to Pharos Security Solution (20)
Recently uploaded
Recently uploaded (20)
Pharos Security Solution
- 1. www.pharossecurity.com © Copyright 2017. Pharos, Inc. CONFIDENTIAL
- 2. www.pharossecurity.com © Copyright 2017. Pharos, Inc. CONFIDENTIAL Industry Problem CISO View CFO View Billions invested annually in security programs Most programs deliver weak security ROI Weak protection of what matters most Expense in depth1 It’s not how much you spend, it’s how you use it 1 Forrester report “Expense in Depth and the Trouble with Tribbles”
- 3. www.pharossecurity.com © Copyright 2017. Pharos, Inc. CONFIDENTIAL Inability to offer the Board evidenced protection against a level of adversary sophistication Failure to map spend to common sense and relatable terms for security activity CISO Problem Bridging the BIG GAP Lack of cost effectiveness in protection Inconsistency and lack of clarity in reporting (and spreadsheets) Failure to link human resources (usually the largest expense in security) to business outcomes
- 4. www.pharossecurity.com © Copyright 2017. Pharos, Inc. CONFIDENTIAL BIG GAP Big Consequences 1 Forrester report “Expense in Depth and the Trouble with Tribbles”
- 5. www.pharossecurity.com © Copyright 2017. Pharos, Inc. CONFIDENTIAL Hierarchy of Needs
- 6. www.pharossecurity.com © Copyright 2017. Pharos, Inc. CONFIDENTIAL Expense in Depth 1 Forrester report “Expense in Depth and the Trouble with Tribbles”
- 7. www.pharossecurity.com © Copyright 2017. Pharos, Inc. CONFIDENTIAL Appreciating Gains
- 8. www.pharossecurity.com © Copyright 2017. Pharos, Inc. CONFIDENTIAL Solution Flow 3 Operate, Optimize, Track (real-time) Objectives & performance management down to practitioner level Measure and show progress via detailed KPIs Track budget Reorient as business or threats change Achieve and evidence real protection across threat exposures 1 Set State (any-time) Set program objectives and KPI state Do all this holistically – cyber, physical, social and 3rd party exposures Align security to core business assets and strategy Evaluate and discover over / under spend, misalignments, inefficiencies Evidence protection reality vs. expectations 2 Report, Model, Decision Support (any-time) Propose a threat sophistication level to protect assets against Create security strategy that can be defended at the Board / CxO level Allow CISO to balance protection, time, budget Produce detailed, multiyear, roadmap to achieve strategic targets
- 9. www.pharossecurity.com © Copyright 2017. Pharos, Inc. CONFIDENTIAL
Editor's Notes
- The Board and executive leadership answer to investors, customers, insurers, regulators, and opposing legal counsel. When the Board invest in security, they expect results. The result they need – above all else – are: Proof of protection from unacceptable impacts Proof of due diligence that stands up to scrutiny Proof of best cost options to achieve the above Even if the Board have not explicitly asked for it… Even if they, themselves, don’t realize it… This is what they hired the security officer to deliver. This is what the security officer is accountable to prove. For the CISO, it’s been a struggle to find ways to answer these questions. This results in a BIG GAP.
- https://go.forrester.com/blogs/14-05-20-introducing_forresters_targeted_attack_hierarchy_of_needs/ Need No. 1: An Actual Security Strategy. Many organizations are running a race and they have no idea where the finish line is. If you don’t have a sound security strategy, you might fail at responding to commodity threats, and you will certainly fail at responding to sophisticated attacks. Before we jump to buying "advanced" security solutions and services, we must first understand the data and architecture of what we’re trying to protect. This is fused with external data that incorporates attacker capabilities and motivations.
- https://go.forrester.com/blogs/12-12-09-expense_in_depth_and_the_trouble_with_the_tribbles/ The belief in silver bullets and “Expense in Depth” are two of the most common enterprise strategies. You start out small, but before you realize it the technology is everywhere and you are overwhelmed. It ends up in places you never intended.
- Conventional approach: Does not set a protection goal to track progress against Investment is ad hoc or based on % of IT budget No clear value statement on how spend is performing Cannot defend against basic challenge from insurers, litigators or investors Pharos System: Starts by achieving maximum value from existing investment Articulates strengths & lays out a path of victories that matter to the Board Tailors a prioritized multi-year Capex & Opex plan Tracks progress to defensible level of protection from unacceptable impact