Cyber Security Organizational Operating Model and Governance
- 1. Cyber Security Organizational Operating Model And Governance Anusha Amareshbabu, Deepti Madhu, Rishi Midha, Srinidhi Aithal, Suvir Singh, Swati Mehta, Vikram Konduru UB – SOM – MSS – MGS 650/420 IA November 16, 2015; Buffalo, NY Deloitte Challenge
- 2. Safeguard and Maintain Confidentiality, Integrity and Availability Triad1 Information Security is not Just technical issues, but Governance responsibility2 Need for a “Safer Internal Business Community”3 • Organizations want to be more effective and competitive • Board of directors are driving Innovation like never before • Built in link between growth, innovation and cyber security CYBER SECURITY GOVERNANCE – THE EMERGING TREND
- 3. KEY CHALLENGES Security Posture Lack of due diligence in evaluating Security Maturity Level Physical and Logical Security Controlled Access Encryption Competitors Corporate Espionage
- 4. KEY CHALLENGES (contd.) Disgruntled Employees Headcount reduction Culture change after Merger Policies and Awareness Mismatch of security policies and governance models Financial Criminals Internal Threats APT
- 5. WHAT DOES THE FUTURE HOLD? LURKING PROBLEMS Technological Transformations Unhealthy Cyber Ecosystem Resource Allocation and Risk Appetite Globalization and Disappearing Business Boundaries
- 6. POPULAR CYBER SECURITY FRAMEWORKS Cybersecurity Capability Maturity Model(C2M2) National Institute Of Standards and Technology(NIST) Control Objectives for Information and Related Technology(COBIT 5) ITIL Security Management ISO 27000-series
- 7. THE NEXT GENERATION MODEL Enterprise-wide acceptance Commensurate with the work culture Senior management endorsement Alignment with business objectives Extend beyond the boundaries of the organization Long-term risk-based approach Comprehensive, Effective, and Adaptive
- 8. THE NEXT GENERATION MODEL ENHANCE SECURITY • Align corporate governance with IT • Perform risk analysis • Design enterprise wide policy • Build strong application controls • Establish accountability • Ensure security awareness • Audit processes, procedures, and controls BUILD RESILIENCE CONTINUOUS VIGILANCE • Monitor and adapt to threat trends in the industry • Design effective detection systems • Protect against internal attacks • Modify and update indicators of risk • Report inconsistencies for proactive measures • Effective, adaptive, and tested business continuity planning • Organization-wide training to enhance disaster response mechanism • Business impact analysis evaluations • Continuous rehearsals of disaster handling procedures
- 9. REFERENCES • https://securityintelligence.com/creating-a-cybersecurity-governance-framework-the- necessity-of-time/ • http://www.computerworld.com/article/2564800/security0/the-link-between- information-security-and-corporate-governance.html • http://www.govtech.com/blogs/lohrmann-on-cybersecurity/What-is-a-healthy- 061211.html • https://hbr.org/1991/05/transcending-business-boundaries-12000-world-managers- view-change • http://www.ciosummits.com/Financial_Services_Cyber_Challenges_White_Paper.pdf • https://www.securestate.com/blog/2015/02/06/cyber-security-concerns-in-the- mergers-acquisitions-due-diligence-process • http://www.boozallen.com/media/file/Overcoming-Financial-Crimes-wp.pdf • http://www2.deloitte.com/global/en/pages/risk/topics/cybersecurity.html