1

GaryPerkins,MBA,CISSPChiefInformationSecurityOfficer(CISO)ExecutiveDirector,InformationSecurityBranchGovernmentofBritishColumbia

BuildinganInformationSecurityProgram:The12StepMethodApril2017

2

10stepprogramStep1: Ensureyouhaveexecutivesupportforsecurity(ask!)Step2: Ensureyouarewellalignedwithgovernmentandministrystrategy,goals,

priorities(comparewithsecurityvision,mission,goalsandtheyshouldbewellaligned)

Step3: Understandorganizations’riskappetite(likelymedormed-low)Step4: Focusonarisk-basedapproachStep5: Focusonsecuritybydesign– buildingsecurityinfromthegroundup;

ensuresecurityreviewaspartofcapitalallocationprocessStep6: Determineyourapproach(risk,compliance,orcapability)Step7: UpdateandreviewhighlevelriskregistryquarterlyStep8: Identifywhatissecureenoughforyourorganization– whatissufficiento

mitigaterisktoanacceptablelevel?Whatisdefensible?(eg.hygiene+compliance)

Step9: Identifyasecuritystandardappropriateforyourorganizationandmeasurecompliance,identifygaps,prioritize,andremediate

Step10: Assemblecomponentsintoaministryspecificinformationsecurityprogram

3

Step1:Ensureyouhaveexecutivesupport

§ securitycultureandsupportforsecuritycomes

fromthetop

§ ensureacommon

understandingof

thethreat

§ howdoyoufindoutwhetheryouhavesupport?

Ask!

4

Step2:Alignwithorganization’svision,mission,goals,strategy

CreateacultureofexchangethroughSTUDENTMOBILITY

EnhancingtheINTERNATIONALSTUDENTEXPERIENCE

ProvidingINTERCULTURALCURRICULAforaglobal-readyinstitution

MakingavitalimpactthroughINTERNATIONALENGAGEMENT

EstablishinganEXTRAORDINARYENVIRONMENTFORINTERNATIONALIZATION

Examplestartingwith“MakingaWorldofDifference”InternationalPlan

5

Step2:Alignwithorganization’svision,mission,goals,strategyExamplestartingwith“MakingaWorldofDifference”InternationalPlan

- low- medium- high- veryhigh

Step3:Understandorganizationriskappetite

7

mobiledevices

mobileemployees

cloudcomputing

internetofthingsoutsourcing

BYOD

consumerization

proliferationofapps

erodingnetworkperimeter

IPv6

virtualization

bigdata

growthofdata

advancedpersistentthreats

operationaltechnology

machine-to-machine(M2M)APIs

digitalnatives

talentshortage

datasovereignty

dataresidency

robotics

industrialcontrolsystems

autonomousvehicles

DevOps

convergenceofphysicalandlogical

personalcloudanalyticsblockchain

wearables

augmentedrealityartificialintelligence

cyberinsurance

regulatory,legislation

predictive

supplychain

accesstodata

nanotech

bigstorage

3Dprinting

Step4:Takearisk-basedapproachandexaminetheforceschangingtheriskprofile

???

8

Step5:FocusonSecuritybyDesign

IM/ITCapitalInvestment- SecurityConsiderations

Buildsecurityinfromthegroundup&insertreviewincapitalallocationprocess

9

Step5:FocusonSecuritybyDesignIM/ITCapitalInvestment- SecurityConsiderations

Step6:Considermaturitylevelinapproach

Maturity Approach Steps

Low Riskregister 1. identifykeyrisks2. rate inherentriskandtrend3. identifycontrolsinplace4. rateresidualrisk5. comparewithriskappetite

Medium Standards-basedcompliance

1. identifyanappropriate standardforyourorganization

2. assesspresentstate3. determinedesiredtargetstatebasedon

appropriatecontrols4. gapanalysis5. plan,prioritize6. execute

High Capability-based 1. reviewtrends inenvironment2. focusonchangesinriskposture3. considerrelevantupdatesinstandards4. augmentwithincreasedcapabilities

Risk Definition Inherentrisk

Risktrend

Keyriskmitigationstrategies

Residualrisk

Owner

NetworkSecurity

Insufficiently proactiveapproachonidentificationofthreatsandvulnerabilitiesinnetworkinfrastructureandtimelymitigationmayresultinnetworkoutagesandexposure

H ↑

•

DataSecurity

Insufficientapplicationofadequatesecuritycontrols,heightenedbylimitationofvulnerabilitymanagementtoolsresultingininabilitytoidentifyandmediatedatabreaches,theft,destructionormanipulationofdata

H ↑

•

Step7:Updateandreviewriskregistryregularly

Risk Definition Inherentrisk

Risktrend Keyriskmitigationstrategies

Residualrisk

Owner

PhysicalSecurity

Insufficientsecurityawarenessandphysicalsecuritycontrolsmayfailtomitigatephysicalriskexposuresandcouldimpactstaffandcitizensafety.

M ↔

•

PropertyRisk

Inconsistentandinadequatepreventativemeasuresaroundkeybuildingsystems(suchasHVAC,electrical,firesuppression/detection)maintenance,housekeeping(i.e.,storageofcombustibles)andsafetyproceduresmayresultinavoidablelossordamageofassetssuchasnetwork,infrastructure,computingthatcouldimpactinternalprocessesorclientserviceanddelivery.

M ↔

•

IdentityTheft&Fraud

Increasedincidentsofidentitytheftandfraudglobally,includingconstantlyevolvingcardrelatedfraud,haveheightenedtheneedforappropriatecontrolstosafeguardassets, andprotectteammemberandcitizenprivacyandbrand.

M ↑

•

Step7:Updateandreviewriskregistryregularly

13

Step8:Definetargetstate

world-class

risk-basedsecurity

compliance

hygiene

defensible

Identifywhatissecureenoughforyourorganization– whatissufficienttomitigaterisktoanacceptablelevel?

14

Step9:Considerastandards-basedapproach

§ ISO27000series(eg.ISO27001,27002)

§ NIST800-53

§ Industryspecific(eg.NERC)

§ Others:CIS,SANS

Identifyasecuritystandardappropriateforyourorganizationandmeasurecompliance,identifygaps,prioritize,andremediate

15

Step9:CapabilityMaturityModel

§ 0– NotImplemented

§ 1– Initial

§ 2– Repeatable

§ 3– Defined

§ 4– Managed

§ 5– Optimized

16

Step10:Assemblecomponentsintoaprogram

17

Step11:Communicatetheplanappropriately

§ knowyouraudience

§ usetheirlanguage

§ communicateappropriately

§ makeitrelevant

§ demonstratealignmentwithstrategy

§ ensuretheyunderstandwhytheyshouldcare

18

Step12:Executetheplan

§ don’tboiltheocean

§ understandyourpresentlevelofmaturity

§ setachievablegoals

§ breakthemdownintodoablechunks

§ measuretheprogress

§ communicatetheprogress

§ celebratethesuccesses

19

Summary

Securityprogramswillbesuccessfulwhentheyare:§ supportedbyexecutive§ alignedwithgovernmentandministrygoals§ risk-based,alignedwithbusinessandriskappetite§ standards-based,evolveovertime§ capturepresentandtargetstateaccurately§ plansarerealisticandactionable§ resourcedeffectively§ focusedonbuildingsecurityinfromthegroundup§ measured/monitored§ continuousimprovement§ communicatedappropriately§ executedon

Questions?