1 Introduction Welcome! Format of day Response to previous requests from clients Amendment to schedule Using Information Security for Business Advantage

MWR InfoSecurity The Business Case for Information Security 12 March 2009 Alex Fidgen Ian Shaw

3 What will we achieve? Help you gain organisational commitment and justify required spend Introduction Part 1 - Visualisation techniques Part 2 - Communication techniques Part 3 - Supporting frameworks Using Information Security for Business Advantage

4 Introduction Communicating security risk can be very hard in environments without structured metrics The classic chicken and egg scenario We did not want to concentrate on the is there/isn’t there argument for ROI.

5 Problems Senior Management and Board directors need to increase shareholder value Mature metrics makes it easy to communicate shareholder value based risk Associating technical risks with revenue is impossible without a business context Information security managers with IT backgrounds find it hard to communicate risk at a business level The business seldom understands the value of its information assets

6 Communication! This is a communication issue!

7 Part 1 – Protecting Traditional Assets (Opening the Board’s Eyes to Information Security Spend – Is information security spending in line with traditional asset protection?) Using Information Security for Business Advantage

8 Questions your Board may be asking Why do we need to worry about this information security issue? Why is Malware Protection so expensive? Are these costs of doing business online justified? I don’t understand whether this expenditure is justified The following examples have been developed to demonstrate how security is integrated seamlessly into existing business models Try to ignore any immediate reaction to industry sector! Using Information Security for Business Advantage

9 Typical Retail Organisation (Asset Protection) Shops Warehouse / Distribution Human Resources Finance CCTV Counterfeit Detection Store Detectives Security Guards RFID Safes / Alarms Secure Cash Handling Vetting / References Disciplinary Procedure Internal Audit External Audit Stock Control Credit Control Accounting Policies / Standards Financial Reconciliations Product Integrity* * For example: tamper evident jars Cardwatch Local Crime Schemes

10 Typical Retail Organisation (Asset Protection) Using Information Security for Business Advantage Shops Warehouse / Distribution Human Resources Finance CCTV Counterfeit Detection Store Detectives Security Guards RFID Safes / Alarms Secure Cash Handling Vetting / References Disciplinary Procedure Internal Audit External Audit Stock Control Credit Control Accounting Policies / Standards Financial Reconciliations Product Integrity* * For example: tamper evident jars Cardwatch Local Crime Schemes

11 Typical E-Retail (Information Asset Protection) Using Information Security for Business Advantage Ecommerce Site Data Storage Business Interfaces IT/IS/ Development IT/IS/ Development Anti-Virus Firewalls Encryption Security in SDLC Threat Modelling Build Standards Information Security Policies Legislative Compliance Configuration Reviews Patch Management Access Control Reviews Application Testing Penetration Testing Monitoring / Intrusion Detection Vulnerability Assessment Vetting / References Disciplinary Procedure InfoSec Awareness Training

12 In Summary Information asset protection still lags behind traditional asset protection Opening the organisation’s eyes to traditional security measures can ‘set the scene’ to introduce information security A simple visualisation technique helps soften attitudes to information security spend Using Information Security for Business Advantage

13 Part 2 – A model for information asset identification and classification Using Information Security for Business Advantage

14 Part 2 - Communication of risk High level abstract link… How best to communicate the risk from this point forward Need to highlight risks that may impact shareholder value Must be flexible and expose risks not currently perceived One technique is threat modelling…plenty of others however Using Information Security for Business Advantage

15 Risk – A quick reminder An event that could have a detrimental effect on an asset A conduit that could be exploited by a threat An item of value The effect on a business of a risk being realised BUSINESS IMPACT Asset Threats Vulnerability Risks

16 What is threat modelling Threat Modelling: Grades Threats Allows identification of vulnerabilities Enhances the final calculation of risk Very powerful and business focussed Using Information Security for Business Advantage

17 Using Information Security for Business Advantage What it can provide: Defence in depth Effective controls with efficient expenditure Asset protection is proportional to the business value Greater measurable returns on security investment

18 Case Study – Insurance Company In excess of 600 systems Business run in a federated sense There is/was no centralised security management function, Some security testing in the past against core systems No set budget for security Some basic security training, around physical security and access control Using Information Security for Business Advantage

19 How the model was formed.. identified the systems and the assets, a high level risk assessment based on the business risk and potential business impact Assignation of a commercial revenue value to each system Using Information Security for Business Advantage

20 How the model was formed.. cont All revenue streams documented the most important systems quickly became evident, Allowed focus on the most financially important assets Intangible assets were also assessed (reputation, client satisfaction, employee happiness etc.).

21 What did this do? This made an actual and tangible link to the management team connecting the value of the information assets (within systems) with the value of assigned security spend to identify and manage the risk It open their eyes to the asset value, and made justification of budget almost self fulfilling

22 Using Information Security for Business Advantage Part 3 – Effecting Change (Operational Information Security)

23 Where are we? Using Information Security for Business Advantage Information Assets Threats Vulnerabilities Risks = Existing Controls Current Position =+

24 What is the appetite for risk? Using Information Security for Business Advantage Current Position Where we want to be -= STAGE 1 Organisational Changes STAGE 1 Organisational Changes

25 Stage 1 – Organisational Change What is required for successful organisational change Change Plan – how will we know when we arrive? Resources – do we have the resources to achieve the change? Sponsorship – do we have executives backing for change? Support (Culture) – important if exec sponsorship is broken? Using Information Security for Business Advantage

26 Stage 2 - Operation Measure performance (results not activities) Make changes as necessary Periodically review performance Review measures Using Information Security for Business Advantage

27 Summary Your organisation is protecting its assets, but probably not adequately protecting its information assets The risks may be different from the perceived risks. Communicate this by identifying assets and the threats to them You can only manage what your measure. Identify the changes necessary, measure transition Using Information Security for Business Advantage

28 Questions? Using Information Security for Business Advantage