CISO Platform Security Maturity Model
3 likes549 views
The document discusses the challenges of existing security models, highlighting their complexity and lack of prioritization. It introduces the CISO Platform Security Strategy Model (CP-SSM), which aims to offer a minimalist and focused approach to security strategy through threat modeling and prioritization. Key elements include a threat repository, prioritization guidelines, and a mapping between threats and controls.
CISO Platform Security Maturity Model
- 1. CISO Platform Security Strategy Model ( CP-SSM ) Bikash Barai
- 3. Challenges with existing models • Too heavy to be intimidating - Too many steps • Cannot be done incrementally – Needs big bang approach • Very few SABSA professionals and very few implementation • Does not produce a prioritized list of security activities
- 4. Goodness Criteria • Should help to eliminate • Should help to focus • Should be simple • Should be easy to remember
- 6. Goals of CP-SSM • Light • Minimalist • Focused
- 7. Steps • Create Business Architecture (High Level) • Strategic Threat Modeling • Elimination: Bucket and Prune • Mapping: Threats to 4 types of controls • Priority Bucketing of Activities
- 8. Key Elements • CP- Threat Repository • Threat Prioritization Guideline – Available – Benchmark, Risk Management Model • CP - Control Repository – Not available • CP- Threat to Control Map – Not available • CP- Activity/Control Priority Map
- 9. Threat Repository • Taxonomy – Software (26 sub class) – Hardware (3) – Physical Security (3) – Supply Chain (2) – Human (3) • Industry or vertical specific top N listing
- 10. CISO Platform Threat – Control Map • Threat: SQL Injection Attack – Detection: WAF, SAST, DAST, IAST, RASP – Prevention: Secure Coding, WAF, RASP – Response: SIEM, SOC Response Process – Prediction: TI (External and Internal)
- 11. Prioritization Matrix Prevention Detection Response Prediction High Risk 1 1 2 3 Medium Risk 2 2 2 3 Low Risk 3 3 3 3
- 12. Next Steps • Utilize the model (loosely) for building an Appsec Program - Post Lunch • Create Community Projects – Threat Repository (Comprehensive + Top N) – Threat Control