Presentation On company
divya@2007
grc-r04-themeasureofsuccess-securitymetricstotellyourstory-160310122137_1__1_1.pdf
PANELISTS:
SESSION ID:
#RSAC
MODERATOR:
GRC-R04
Wendy Frank Principal, Advisory, Cybersecurity, Privacy & Risk, PwC
Julie Bernard Principal – Cyber Risk Services Deloitte @juliein10A
Lisa Lee, CRISC, CISA, IAM
IT Examiner Office of the Comptroller of the Currency @lisainmiami
The Measure of Success: Security Metrics to Tell Your Story
#RSAC
How to Tell Your Story
2
Audience
What Good Looks Like
Responsibility and Accountability
Data Availability
Single Source of Truth & Repeatability
“As Is” State
Frequency
#RSAC
Operational Report Examples
#RSAC
Operational Report Examples
4
75 64%
12 10%
7 6%
3 3%
6 5%
14 12% US
EMEA
Canada
Japan
Hong Kong
Latin America
Active Info Sec Audit Issues by Country/Region
0
20
40
60
80
100
120
140
Near Close
Business Issues
Significant Bus. Issues
Information Security Audit Issues
Overdue Audit Issues Trends in Info Sec Audit Issues
0
5
10
15
20
25
Near Close
Bus Issue
Significan Bus Issue
#RSAC
Operational Report Examples
5
500
200
200
100
530
250
327
268
0 100 200 300 400 500 600
IT
Sales
Finance
HR
Anti-Virus Coverage
# of Systems
# AV Reporting
#RSAC
Operational Report Examples
6
10 50
15 20
4 20
13 25
5 10
10 20
1 12
12 15
1 10 15
12
0%
20%
40%
60%
80%
100%
January February March April
% Vulnerabilities
Reported
Platform Vulnerability Distribution
Platform 5
Platform 4
Platform 3
Platform 2
Platform 1
#RSAC
Operational Report Examples
7
Patching Status for all W orkstations
Data gathered 10 days after release of patche and at the end of the month
326 330 295
313
272
318 328 340
278
319 331 350
21 16 52 28
50
16 24 12
69
28 14 2
54 55 54 61 74
66 55 55 61 63 61 55
1 1 3 3 8 4 0 0 2 0 3 2
4/ 24/ 09 4/ 30/ 09 5/ 22/ 09 5/ 29/ 09 6/ 22/ 09 6/ 30/ 09 7/ 24/ 09 7/ 31/ 09 8/ 21/ 09 8/ 31/ 09 9/ 18/ 09 9/ 29/ 09
Pat ched wit h Crit ical Pat ches M issing Crit ical Pat ches Pat ching Not Required Pat ching Def erred
#RSAC
Operational Report Examples
8
Patch Management Risk by Platform*
0
1
2
3
4
5
6
7
8
9
Jan Feb March April May June
Microsoft Servers
VM Ware
NetApp
Cisco
Checkpoint
Apple iOS
ATMs
Microsoft Servers
VM Ware NetApp Cisco Checkpoint Apple iOS ATMs
GREEN (0-3) 0.00% 2.34%
YELLOW (4-7) 5.32% 4.40% 7.25%
RED (8-10 7.98%
*Data is not actual
#RSAC
Operational Report Examples
9
#RSAC
Executive Discussions
#RSAC
Executive Discussions
11
Source: The State of Texas; State of the State Report, Jan. 2015
#RSAC
Executive Discussions
12
#RSAC
Executive Discussions
13
#RSAC
Executive Discussions
14
#RSAC
Dashboard
15
#RSAC
Board Reports
#RSAC
Board Reports - Dashboard
17
#RSAC
Board Reports - Dashboard
# Key Cyber Risk Metrics Risk Tolerance Value
Trend
Warning Breach Q1 2013 Q2 2013 Q3 2014 Q4 2014
1 # of Severity 1 Cyber Risk Incidents 2 3 4 2 2 2 Steady
2 Financial Impact ($MM) Attributed to Severity 1 or 2 Incidents
$2.5 $5 $6.2 $3.5 $1.3 $1.8 Worse
3 # of Tier 1 Institutional Clients Impacted by a Severity 1 or 2 Incident
5 12 28 11 4 4 Steady
4 # of Retail Gold Clients Impacted by a Severity 1 or 2 Incident
50K 250K 0 0 18K 28K Worse
5 Open Regulatory MRIAs, MRAs 3 10 8 7 6 5 Better
6 Open Severity 1 Audit Issues 5 8 9 8 6 6 Steady
7 # of Open High Risk Self-Identified Issues 5 10 3 3 3 4 Worse
8 # of Hours of Severe Service Degradation 10 20 18 11 15 9 Better
9 # of Key Open Cyber Risk Positions Not Filled within 120 Days
3 5 0 0 2 1 Better
10 % of Tier 2 Metrics that are Not Green 10 20 11 13 10 9 Better
- Metrics within acceptable thresholds - Metrics above threshold - Metrics significantly above thresholds
#RSAC
Board Reports – Program Maturity
19
#RSAC
Board Reports - Measures
20
Current threats to business
Security program strategy
Key trends in cybersecurity
Performance against goals & objectives
Exposure to key 3rd parties
Spending vs. priorities
Meeting internal standards
Security initiatives supporting business objectives
Management/staff experience
Tracking key projects
#RSAC
Applying These Examples
#RSAC
22
Next week you should:
Identify your audience, their concerns/values, and their language
Determine responsibility and accountability
Define the metrics that are important to your organization
Start somewhere and improve as needed
Applying These Examples
#RSAC
23
In the first month following this presentation you should:
Agree on what “Good” looks like
Determine data sources, availability, and repeatability
Develop the metrics, KPIs, and KRIs that best align with your objectives
Within six months you should:
Design a package of reports for senior committees and the board
Determine reporting frequency
Applying These Examples (cont’d.)
