December ISSA Meeting Executive Security Presentation

“ Enterprise Security from a C-Level Perspective” Information Systems Security Association (ISSA) Space Coast Florida Chapter William H. Miller, Jr. Industry IT Executive & Independent Consultant Hosted at Florida Institute of Technology December, 2010 Feb 11, 2011

We are in the Right Profession Today! An engineer dies and reports to the pearly gates. St. Peter checks his dossier and says, " Ah, you're an engineer -- you're in the wrong place." So, the engineer reports to the gates of hell and is let in. Pretty soon, the engineer gets dissatisfied with the level of comfort in hell, and starts designing and building improvements. After awhile, they've got air conditioning and flush toilets and escalators, and the engineer is a pretty popular guy. One day, God calls Satan up on the telephone and says with a sneer, " So, how's it going down there in hell? " Satan replies, " Hey, things are going great. We've got air conditioning and flush toilets and escalators, and there's no telling what this engineer is going to come up with next." God replies, " What??? You've got an engineer? That's a mistake -- he should never have gotten down there; send him up here." Satan says, " No way. I like having an engineer on the staff, and I'm keeping him ." God says, " Send him back up here or I'll sue ."

We are in the Right Profession Today! Satan laughs uproariously and answers, "Yeah, right. And just where are YOU going to get a lawyer?"

Headlines ………….. ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Feb 11, 2011

Cyber Threat Status: “Red” Feb 11, 2011 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Who’s Concerned Today? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

DoD DIB – Government Organized Feb 11, 2011 DoD DIB = U.S. Department of Defense, Defense Industrial Base; Critical Infrastructure Protection ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Security Policy Guidelines ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Article By Gary McGraw and Ivan Arce , Nov 24, 2010 – “Software [In]security: Cyber Warmongering and Influence Peddling”

Some Thoughts on Cyber “Good Guys and Bad Guys” ,[object Object],[object Object],[object Object],[object Object],[object Object]

What are Some of Our Key Security Framework Components? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

From the SANS Web Site ……. ,[object Object],[object Object],Figure 1: Number of Vulnerabilities in Network, OS and Applications

Security Investment Evolution Measurement processes emerge Reactive Undefined policies, procedures Informal policies, procedures SOX – Initial control structure Enterprise control framework Continuous process improvements 2000 2004 2009 Compliance Proactive Optimized 2010 2012 Security Advisory Group Virus Script Kiddies Insider Threat APTs Nation State Attacks True Cyber Warfare Security Investment $ZM $YM $XM New threats may require additional Investments? 2015 2014

Security Tools are Expensive and Burdensome …. ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],… . and only represent part of the solution today

Ten Outcomes That Keep CIOs Up At Night ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Some Environmental Challenges in Cyber Space in 2010 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

What Can, and What Can’t, a CIO or CISO Control in Regards to IT Security? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

A Litany of Tough Executive Management Questions Persist ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Ambiguity is not popular in the Executive Suite

Behavioral Drivers for the Executive Staff ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],- Mission of CEO, CFO, COO and Others -

These Objectives Translate to ……. ,[object Object],[object Object],[object Object],[object Object],[object Object],Note that Security “Issues” Rarely Come with a Perceived Upside in the C-Suite

Executive $$ Investment Priorities ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Decreasing Appetite for Company Spend Security Sarbanes Oxley Business Resumption Planning ERM $$$ $$ S

C-Suite and Director Mindset ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Implications for the Security Professional ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],* Offsets the inevitable ‘ difficult days’ In the C-Suite, Security Concerns = FUD

Important Cyber Security Discussion Questions ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Feb 11, 2011

Debate Over “How Much Does This Really Matter”? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Some Additional Observations ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

And a Few Final Suggestions for Cyber Craftsmen ,[object Object],Architecture Investment Education ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Relevant Quotations ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

December ISSA Meeting Executive Security Presentation

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (20)

En vedette

En vedette (20)

Similaire à December ISSA Meeting Executive Security Presentation

Similaire à December ISSA Meeting Executive Security Presentation (20)

December ISSA Meeting Executive Security Presentation