Selling Data Security Technology
0 likes659 views
The document discusses strategies for selling data security solutions to CEOs, highlighting the importance of understanding data security, the evolution of threats, and the need for a strong sales strategy. It emphasizes building business pain and securing sponsorship from top executives to drive the adoption of data security measures. The content also suggests ways to calculate the value at risk and address vulnerabilities within organizations.
Selling Data Security Technology
- 1. Selling Data security to the CEO Licensed under the Creative Commons Attribution License Danny Lieberman dannyl@controlpolicy.com http://www.controlpolicy.com/
- 2. Sell high “it's a lot easier to manage a big project than a small one” Boaz Dotan – Founder of Amdocs (NYSE:DOX), $5.3BN Cap.
- 3. Agenda • Introduction and welcome • What is data security? • Defining the problem • After Enron • Weak sales strategy • The valley of death • Strong sales strategy • Execution
- 4. Introduction • Our mission today – How to sell data security to the CEO
- 5. What the heck is data security? • Security – Ensure we can survive & add value • Physical, information, systems, people • Data security – Protect data directly in all realms
- 6. Defining the problem • You can't sell to a need that's never been observed(*) – Little or no monitoring of data theft/abuse • Perimeter protection, access control – Firewall/IPS/AV/Content/AD Lord Kelvin (*) Paraphrase of
- 7. What happened since Enron • Threat scenario circa 1999 – Bad guys outside – Lots of proprietary protocols – IT decides • Threat scenario circa 2009 – Bad guys inside – Everything on HTTP – Vendors decide
- 8. Weak sales strategy IT – data security is “very important” ...Forrester Management board – fraud/data theft can maim or destroy the company ...SarbanesOxley
- 9. Mind the gap IT – We can get DLP technology for 100K and the first 6 months are free. ...Websense Management board – We have Euro 100M VaR ...PwC
- 10. The valley of death Logical &rational Emotional & Political IT Requirements Compliance requirements Meet Close vendors Evaluate alternatives Capabilities Project Presentation Talk to analysts Losing control Month 1 Month 5 Month 1218
- 11. Why you lose control • Issues shift – Several vendors have technology • Non-product differentiation • Divided camps – Nobody answers all requirements • Need a political sponsor • Loss of momentum – No business pain – No power sponsors
- 12. Strong sales strategy • Build business pain – Focus on biggest threat to the firm – Rational • Get a power sponsor – CEO,COO, CFO,CIO – Personal
- 13. Close the gap Toxic customer data VaR: 100M VaR reducation: 20M Cost: 1M over 3 years ...Security & Risk Management board – We have 100M VaR ...PwC
- 14. Execution – building business pain • Prove 2 hypotheses: – Data loss is happening now. – A cost effective solution exists that reduces risk to acceptable levels.
- 15. H1: Data loss is happening • What keeps you awake at night? • What data types and volumes of data leave the network? • Who is sending sensitive information out of the company? • Where is the data going? • What network protocols have the most events? • What are the current violations of company AUP?
- 16. H2: A cost effective solution exists • Value of information assets on PCs, servers & mobile devices? • What is the Value at Risk? • Are security controls supporting the information behavior you want (sensitive assets stay inside, public assets flow freely, controlled assets flow quickly) • How much do your current security controls cost? • How do you compare with other companies in your industry? • How would risk change if you added, modified or dropped security controls?
- 17. What keeps you awake at night Asset has value, fixed over time or variable Plans to privatize, sell 50% of equity Threat exploits vulnerabilities & damages assets. IT staff read emails and files of management board Employee leaks plans to press Buyer sues for breach of contract. Vulnerability is a state of Countermeasure has a cost weakness mitigated by a fixed over time or recurring. countermeasure. Monitor abuse of privilege & IT staff Prevent leakage of have access management board documents to mail/file servers on all channels.
- 18. Calculating Value at Risk Value at Risk Metrics =Threat Damage to Asset value, Asset x Asset Value x Threat damage to asset, Threat Probability Threat probability (*)PTA Practical threat analysis risk model
- 19. Coming attractions • Sep 17: Selling data security technology • Sep 24: Write a 2 page procedure • Oct 1: Home(land) security • Oct 8: SME data security http://www.controlpolicy.com/workshops
- 20. Learn more • Presentation materials and resources http://www.controlpolicy.com/workshops/data-security-workshops/ • Software to calculate Value at Risk PTA Professional http://www.software.co.il/pta