Selling Security v4

VirtualProblems RealAnswers
JustinDrain jdrain@computer.org justin.drain@fremontbank.com JaredPfost jared@thirddefense.com
June1,2011
<PresenterName>
Disclaimer
Theviewsandopinionsexpressedduringthisconferencearethoseof thespeakersanddonotnecessarilyreflecttheviewsandopinions heldbytheInformationSystemsSecurityAssociation(ISSA),the SiliconValleyISSA,theSanFranciscoISSAortheSanFranciscoBay AreaInfraGardMembersAlliance(IMA). NeitherISSA,InfraGard,nor anyofitschapterswarrantstheaccuracy,timelinessorcompleteness oftheinformationpresented. Nothinginthisconferenceshouldbe construedasprofessionalorlegaladviceorascreatingaprofessional customerorattorneyclientrelationship. Ifprofessional,legal,or otherexpertassistanceisrequired,theservicesofacompetent professionalshouldbesought. TheseviewsandopinionsarealsodonotreflectthoseofFremont Bancorp.
June1,2011
<PresenterName>
Introductions
JustinDrain,CISM,CRISC,CISSP DataSecurityManager FremontBank Securityexperience:banking,aerospace,federal government,medical JaredPfost CEO ThirdDefense Securityexperience:banking,technology,consulting
June1,2011
<PresenterName>
SecurityProjects SecuringExecutiveApproval
Agenda
PresentState HowItWorksNow WhyIsItso? MySolution InTheory InMoreDetail BasicPointsToRemember LetsGo!
June1,2011
<PresenterName>
HowItWorks
Infrastructurevs.Security ProjectMgmt vs.SecurityPractitioner MatureOrganizationvs.JustGettingHeard
June1,2011
<PresenterName>
PresentState HowItWorksNow
WithAnyInfrastructureProject: ANeedIsIdentified BusinessCaseForAddressingTheNeedIsBuilt SimultaneouslyASearchForASolutionIs Underway Acceptance!
<PresenterName>
June1,2011
PresentState HowItWorksNowcontd
TheCriteriaForAcceptanceIsRelatively Straightforward: ItMakesUsMoney ItMakesUsLookGood ItKeepsUsFromLookingBad (compliance)
June1,2011
<PresenterName>
SecurityProjects
ThingsAreDifferentwithSecurity Atfirst StruggleswithBuyinonNeed Resistance:ImpacttoBusinessProcess PushbackOnCost

June1,2011
<PresenterName>
WhyIsItSo? ItsPsychological
WhyTheresaDifference WhyAreInsuranceSalesmenSoUnpopular? Reality/Perception&Profit/Risk SoundBite WhatDoYouWant? MatureCompaniesBuildProductsW/Infosec BakedIn Catchphrase,"WeTakeCareOfSecurity
June1,2011
<PresenterName>
WhatHaveWeDoneinResponse?
StandardApproach FearAndLoathing ComplianceCard ADifficultDefinition

June1,2011
<PresenterName>
10
WhatHaveWeDoneinResponse? contd
Fearisnotanoption, unlessitisapplied appropriately

June1,2011
<PresenterName>
11
WhatHaveWeDoneinResponse? contd
ComplianceCard ComplianceIsNotSecurity ThisOnlyGoesSoFar
June1,2011
<PresenterName>
12
WhyIsItSo? ItsPsychological contd
TheProspectTheory InTheory BusinessModels ApplyingToSecurity
June1,2011
<PresenterName>
13
WhatHave WeDonein Response?
Definition Of Insanity
June1,2011
14
SoNowWhat?MySolution
FromaHighLevel ButfirstwheredoIgetoff? WorksForMe ImmaturetoMature
June1,2011
<PresenterName>
15
Strategy,Strategy,Strategy
NoSingleSwitch IntegratedStrategy FocusedMethodology Groundwork BuildingACaseForSecurityBeforeYou
BuildTheBusinessCase
June1,2011
<PresenterName>
16
Don'tFighttheFeeling
MakeHumanNatureYourAlly FrameSecurityInPositiveLight UsetheShakyPerceptions SecurityBrakes AgainWithTheFear

<PresenterName>
June1,2011
17
NotOver
PlayingThe FearCard BurglarAlarm 9/11 SkyISFalling
June1,2011
18
HowDoesItGoAgain?MoreDetail
HowDoesItAllComeTogether?
June1,2011
<PresenterName>
19
InitialSteps
BeInTheRoom SecureAnAlly CreateAnAdvocate.
EvenIfItMeansGivingUpCredit PlantTheSeeds(Awareness,Metrics) BuildAwarenessOfSecurityStrategy
June1,2011
<PresenterName>
20
Formalizemandatoryvs.discretionarycategories.
Workwecould do
Business Drivers
EmbedRiskBased DecisionstoAchieve BusinessGoals ReachaLegally DefensibleLevelof Security
Workweshould do
Improve Security Services Regulatory Requirements
Workwemustdo
ManageCompliant ReadyServices
<PresenterName>
21
CommunicateTopRisks
ConstructaTopDownStory EvidenceDriven RisksPlacedinActionCategories Act,Evaluate,Accept ImpactRanges CalibrateMonetary&Risk ExposuresacrossScale LikelihoodRanges UseEvidenceforOccurance
June1,2011
<PresenterName>
22
BusinessDrivenInvestments
PrioritizebyBusiness
Value
RiskPriority ITCapability BusinessSupport PoliticalReality Cost
Efficiency Gains.Save $110K
DocumentDecisionand
JustificationforPosterity
<PresenterName>
23
CommunicateTopRisks&Investments
EvidenceDriven QuantifyWhenDefensible
June1,2011
PrioritizebyRisk,Capability,
Cost,&Politics
24
<PresenterName>
InitialSteps contd
GainWideAcceptanceAtInception
AsPartOfYourStrategy ProveYouCanDoItBeforeYouProve YouCanDoIt (TimeTravel?No.DemonstrateEffectiveness) CarrotAndStick

June1,2011
<PresenterName>
25
Next ClearthePath
MoreGroundwork SolutionLookingForAProblem SecuritySolutionsCanImprove
CustomerExperienceValueAdd PeopleAreSTILLthePerimeter
June1,2011
<PresenterName>
26
MetricsDemonstrateProgress&Needs
DefineTargetstoDriveAcceptableRisk
June1,2011
<PresenterName>
27
ClearthePath contd
MoretoConsider RevenueNow SecurityLater DontBeTheNail
June1,2011
<PresenterName>
28
Toahammer, everything lookslikea nail
DontBe The Nail

June1,2011 29
Engage OnTheSurfaceEverythingSeemsNormal BackAttheTable PresentationIsKey,DoYourHomework BePreparedToDefendTheObvious (obvioustous) KnowYourAudienceAndSpeakTheir Language

June1,2011
<PresenterName>
30
Engage contd
SecurityNeedsIt'sOwnROI ManyAreWilling/AbleToRationalize
CertainLosses ConvinceThemYouAreBetterOff W/SecuritySolution
June1,2011
<PresenterName>
31
Engage contd
DontForgetTheRankandFile WhatsTheDeductible Areyoubetteroffnow,thanyou
wereMetricsCanHelpHereToo
June1,2011
<PresenterName>
32
ClosetheDeal/FollowUp
YouSetThemUpNowIt'sTimeTo
KnockThemDown ThereIsNothingMoreExpensive ThanRegret
June1,2011
<PresenterName>
33
ClosetheDeal/FollowUp contd.
Securityisnotintuitive:continue
education Integration,integrationand integration. WherestheBeef?
June1,2011
<PresenterName>
34
SoInClosing
PointsToRemember
BeInTheRoom. DontBetheNail FearISanOptionSometimes IfYouDontWriteitDown.Metrics NOW! SecurityROIisdifferent.
<PresenterName>
June1,2011
35
FinalThought
The state of mind which enables a man to
do work of this kind is akin to that of the religious worshiper or the lover; the daily effort comes from no deliberate intention or program, but straight from the heart.
-Albert Einstein
Physical Society address, 1918
<PresenterName>
June1,2011
36
Thank You! Questions?

jdrain@computer.org justin.drain@fremontbank.com jared@thirddefense.com
Disclaimer Theviewsandopinionsexpressedduringthisconferencearethoseofthespeakersanddonotnecessarilyreflecttheviewsand opinionsheldbytheInformationSystemsSecurityAssociation(ISSA),theSiliconValleyISSA,theSanFranciscoISSAortheSan FranciscoBayAreaInfraGardMembersAlliance(IMA). NeitherISSA,InfraGard,noranyofitschapterswarrantstheaccuracy, timelinessorcompletenessoftheinformationpresented. Nothinginthisconferenceshouldbeconstruedasprofessionalorlegal adviceorascreatingaprofessionalcustomerorattorneyclientrelationship. Ifprofessional,legal,orotherexpertassistanceis required,theservicesofacompetentprofessionalshouldbesought.
June1,2011
<PresenterName>
37

Selling Security v4

Загружено:

Сведения о документе

Исходное описание:

Авторское право

Доступные форматы

Поделиться этим документом

Поделиться или встроить документ

Параметры публикации

Этот документ был вам полезен?

Это неприемлемый материал?

Авторское право:

Доступные форматы

Selling Security v4

Загружено:

Авторское право:

Доступные форматы

VirtualProblems RealAnswers

JustinDrain jdrain@computer.org justin.drain@fremontbank.com JaredPfost jared@thirddefense.com

ThingsAreDifferentwithSecurity Atfirst StruggleswithBuyinonNeed Resistance:ImpacttoBusinessProcess PushbackOnCost

StandardApproach FearAndLoathing ComplianceCard ADifficultDefinition

Fearisnotanoption, unlessitisapplied appropriately

ComplianceCard ComplianceIsNotSecurity ThisOnlyGoesSoFar

WhyIsItSo? ItsPsychological contd

TheProspectTheory InTheory BusinessModels ApplyingToSecurity

WhatHave WeDonein Response?

FromaHighLevel ButfirstwheredoIgetoff? WorksForMe ImmaturetoMature

MakeHumanNatureYourAlly FrameSecurityInPositiveLight UsetheShakyPerceptions SecurityBrakes AgainWithTheFear

PlayingThe FearCard BurglarAlarm 9/11 SkyISFalling

BeInTheRoom SecureAnAlly CreateAnAdvocate.

EvenIfItMeansGivingUpCredit PlantTheSeeds(Awareness,Metrics) BuildAwarenessOfSecurityStrategy

EmbedRiskBased DecisionstoAchieve BusinessGoals ReachaLegally DefensibleLevelof Security

Improve Security Services Regulatory Requirements

Efficiency Gains.Save $110K

AsPartOfYourStrategy ProveYouCanDoItBeforeYouProve YouCanDoIt (TimeTravel?No.DemonstrateEffectiveness) CarrotAndStick

MoreGroundwork SolutionLookingForAProblem SecuritySolutionsCanImprove

MoretoConsider RevenueNow SecurityLater DontBeTheNail

Toahammer, everything lookslikea nail

DontBe The Nail

Engage OnTheSurfaceEverythingSeemsNormal BackAttheTable PresentationIsKey,DoYourHomework BePreparedToDefendTheObvious (obvioustous) KnowYourAudienceAndSpeakTheir Language

CertainLosses ConvinceThemYouAreBetterOff W/SecuritySolution

DontForgetTheRankandFile WhatsTheDeductible Areyoubetteroffnow,thanyou

KnockThemDown ThereIsNothingMoreExpensive ThanRegret

education Integration,integrationand integration. WherestheBeef?

Thank You! Questions?

Вам также может понравиться