Mandelaris_SecureWorld_2016_FINAL
- 1. Speakers: Put your Name and Title here: --- --- --- xxxSWE2016xxx Christopher Mandelaris, MS, CCSIO, CISM, CRISC, CISA, PMP, MCSA CISO Chemical Bank www.linkedin.com/in/cmandelaris Background: 15 years of progressive IT experience and organizations. 7x Ironman Triathlete, 2x Boston Marathon finisher and endurance athlete
- 2. Key Talking Points • Information Security and IT Risk Management • The Changing Dynamic of Information Security • The Modern CISO • Program Components and Future Trends • Partnership and Communication
- 3. Perspective Going from… • Reactive • Product Purchasing state of mind …To • Proactive • Risk-informed state of mind
- 4. Traditional Role of CISO
- 6. Security & Risk Management: A Shared Responsibility
- 7. IT Security Partnerships • Bridging the gaps between Information Security and Business • Building partnerships with Information Technology teams.
- 8. IT Risk Management • Set of processes through which management identifies, analyzes, and responds appropriately to risks that might adversely affect the business • Has become one of the most important tools used by the CISO • Translates security requirements and controls into a common language understood by all stakeholders
- 9. ISM Program Building Blocks
- 11. Program Components & Future Trend Gaps
- 12. Technical Security Operations & Architecture Example. - Firewalls, gateways, IDS/IPS • Subset of enterprise architecture which answers: – When, Where and Why something can be done – What is being done – Who is authorized to do it – How is it supposed to be done • Only one facet of a mature program • Driven by Policy, which is driven by the business
- 13. Asset Classification • Establish IT asset inventory – Public, Internal, Restricted and Confidential • Review inventory at least quarterly • Policies & Procedures to document AND maintain: – Acceptable Use Policy – Information Classification and Handling Policy – IT asset handling procedures
- 14. Security Management & Operations Center (SOC)
- 15. Business Continuity & Disaster Recovery • Program which helps organizations prepare for disruptive events • Business Impact Analysis (BIA) = process that defines what and how critical something is
- 16. Training & Awareness • Build awareness to protect system resources • Develop skills and knowledge so employees can perform duties more securely • Build in-depth knowledge as needed, to design, implement or operate security for organizations and systems
- 17. Metrics & Reporting Basic Methods to define Operational Metrics for Information Security Reporting: 1. Trailing and leading indicators of business related metrics 2. To measure the effectiveness of the security department
- 18. Information Security Governance Defined: The active involvement of senior management in the institutionalization and oversight of the information security program of a given organization.
- 19. Information Security Governance Success Factors • Institution-wide issue • Leaders are accountable • Viewed as an instructional requirement • IT is Risk-Based, and Risk Informed • Roles, responsibilities and segregation of duties are defined • IT is addressed and enforced in policy • Adequate resources are committed • Staff is trained and aware • Requires Development Life Cycle • Planned, managed, measurable and measured • Reviewed and Audited
- 21. Closing Remarks
Editor's Notes
- #4: So often Information Security is thought of a product tools centric initiate with code running in the background in a dark room where the business has no idea what’s going on. Buying products to monitor, alert and respond to threats and vulnerabilities and keep the fraudsters at bay keep organizations in a reactive state rather than proactive state. Many organizations implement products and services to keep risk at a minimum but alternatively opens the organization up to more risk by not aligning with goals an objectives of the enterprise, not risk based focus, not reviewing logs and alerts coming from security applications, too many solutions best in class rather than a security management system focused on the right risks, vulnerabilities and threats for the environment.
- #7: Domain 1 page 30 for further definitions to speak
- #8: Domain 1 page 30 for further definitions to speak
- #10: Domain 1 page 5
- #15: The workhorses, monitoring, detecting and reporting
- #18: Page 67 domain 1