Security Operations Update {Month/Year} CONFIDENTIAL

Agenda Security Program News Projects Looking Forward Updates from last meeting Completed, ongoing, new Recent developments Effect on risk metrics and controls Concerns Looking Forward Security Operations Metrics Next X Days Security operations Audit and compliance Risk drivers People, process, technology

Security Program News {This will cover anything new that has occurred since your previous update.}

Since the Last Meeting Action items (if any, from last meeting) Security environment changes Business developments Industry or regulatory developments Concerns High level – reasons will be discussed in following section

Security Operations Metrics {There are more metrics slides here that you will want to use. They are meant to be illustrative of how to show security operations performance, risk and controls.}

Security Operations Metrics Scorecard: Consistent (meeting over meeting) security metrics without jargon. Current measure, status and trend for all metrics. Adjust these metrics for your environment. There should be a governing security KRI.

Security Operations Metrics Governing security KRI trend Explanation (next slides) Organizational risk contributors Risk metrics and drivers Easy-to-spot risk trend

Security Operations Metrics Risk Contributors: Where in the organization is risk concentrated? Metrics breakdown by organization contributor. Use the same metrics as on the scorecard.

Security Operations Metrics Risk Matrix: An alternative view of overall risk contribution. LIKELIHOOD HIGH   LOW IMPACT SUPPORT SERVICES Metrics breakdown by organization contributor. CORE SERVICES Focus attention on business problem area. MARKETING MANUFACTURING DEVELOPMENT EXECUTIVE ADMIN HARDWARE

Compliance Metric (% controls, findings, etc.) Audit and Compliance Included in risk scorecard Compliance challenges Last audit: mm/dd/yy by ___________ Significant findings Compliance Metric (% controls, findings, etc.)

Clear indication of trend over time. Risk Drivers: People Observation Rate of severity for outbound access has been increasing over the past week Metric Event severity trend Actions Taken Improved rules in defenses, but increase still occurring Suggestion Target people with highest risk profile and have them go through a training course Clear indication of trend over time.

Show Process Metrics by organization/function Risk Drivers: Process Observation Time to patch has reduced Metric Compliance by Department Actions Taken Analyzed which org units were most behind Suggestion Internal training Meeting with middle management to get buy-in for employee machine reboots, stronger enforcement of security patch reboots Show Process Metrics by organization/function

Risk Drivers: Controls Identify Protect Detect Respond Recover Total Devices 5 9 6 2 22 Apps 4 Networks 7 8 33 Data 1 16 Users 17 25 13 10 75/250 Observation Risk controls concentrated on network, devices and data Users and apps largely unprotected Limited response and recovery capabilities Metric Cyber defense matrix (defense in depth) Actions Taken Implemented end-point protection on devices Suggestion Address users and apps next Then work on improving overall control maturity Ratings represent technologies and processes Scores can also be plotted over time.

Projects {These should align to the metrics shown and objectives discussed.}

Project Status Maps to Risk Metrics Report Project Status Date % Compliance Controls Metric(s) Network Segmentation Complete 1/1/17 100 PCI DSS Scoping NW - Prot Corporate Intrusion Protection System (IPS) In Progress 4/1/17 50 CSC 12 Defenses BigFix Endpoint Management 6/1/17 25 PCI Dev – Det/Prot Defenses Surface Area Maps to Risk Drivers – Controls Table

Looking Forward {What to expect by the next update.}

Next X Days Business operations impact(s) Training Project 1 Type (security awareness, phishing, etc.) Project 2 Audits / GAP analysis Dates Type (SSAE 16, PCI, FFIEC, ISO, etc.) Other Participants (vendor, departments, executives, others) Dates (audit, report, etc.)

Backup

What You Should Not Do Technical Jargon Statistics No Business Context