Showing posts with label IT. Show all posts
Showing posts with label IT. Show all posts

It would be funny, if it were not so frustrating, that two individuals so intent on managing risk don’t understand one another. But that is the fundamental problem between business and security leaders. The gap is so huge that bridging it may seem nearly impossible. Yet, it can be done.

Here’s some much-needed illumination on why previous attempts to close the gap have resulted in bridges to nowhere—and how to fix that.

Understanding the C-level Perspective

“The fact that cybersecurity is a board issue is yesterday’s news,” said Nik Whitfield, CEO of Panaseer, a cybersecurity data analytics company. “While there is lots of data available, the puzzle that CISOs are trying to solve is how to bring this information together to show the board the picture they need to see.”

It’s like both sides are speaking a different language. The first step in effectively communicating with the CEO and board is to understand their risk language.

“As a CEO, my key concerns are growing the business and increasing shareholder value. As it relates to cybersecurity, I want a holistic picture, not a discussion of the latest technologies,” said Scott Kannry, CEO of cyber risk management company Axio.

Kannry noted his most valuable framework for understanding CISOs is to ask them to answer these four questions:

Do we know our risk and fully understand the dollars and cents involved? Have we taken a sampling of scenarios, put various operational and functional staff around a table and used their collective knowledge to estimate what each of a variety of events could cost?

Do we use a maturity-based cyber evaluation framework and align it with the scenarios quantified in the previous step?

Do we maintain the resources and financial ability to recover from a meaningful event? Do we have the right balance of financial reserves and insurance to pay for as much (or all) of the forensics costs, notification requirements, lost revenue, stolen funds, legal fees and liabilities, repair costs or replacement of damaged assets and others? How do we understand how much insurance to buy? See Step 1.

Do we benchmark our organization against others, possibly a peer group?

In short, CEOs and board members are looking for the bigger picture in risk calculations.

According to The Cyber Balance Sheetsurvey of more than 80 board members, CISOs and subject matter experts, “Board members were five times as likely to cite ‘risk posture’ as a key security metric compared to CISOs. They are also 13 times as likely to say the same about ‘peer benchmarking’ – showing boardrooms’ greater concern for the big picture.”

That same report found that board members are inundated with security data and often just assume CISOs have things under control. Hence, they tend to “tune out” and simply expect the CISO to keep everything secured. So when something does go wrong, all fingers point to the CISO—an untenable situation, to say the least.

Speaking in Business Tongues

“When discussing cybersecurity risks with the CEO, or the C-suite in general, it’s critical to bridge the gap from purely technical to business terms,” said Brad Arkin, CSO at Adobe. “Remember that top executives have to prioritize many aspects of the business, including investor expectations, revenue and profit, brand equity, employees, etc., so it’s your job as the CISO/security expert to illuminate the business case for security in a broader business risk management context.”

<<ALSO SEE>>
Why Your Credit Card Is Cancelled?Must Read!  

How to Make Cool Money by investing in Nigerian Fixed Deposits. 

Specifically, this means dumping technical metrics and scare tactics from the conversation. Instead, focus on calculating risks in terms of business impact.

“As far as how risk is determined, the key is not to think primarily in terms of technical metrics, such as unpatched OS vulnerabilities or average password strength, but in terms of business impact,” advised Nir Gaist, founder and CTO of Nyotron, a security products and services provider. “What is the probability that bad thing X could happen to us? What is the business consequence of X? What is a possible way to calculate the financial impact of that business consequence?”

Tips and Pitfalls

Here is a quick list of dos and don’ts from your peers to help you build a conversation framework that will truly connect your message with the powers-that-be:

Speak to risk/reward appetites, not in absolutes. Businesses cannot survive, let alone prosper, if all risk is eradicated. “CISOs can fall into the trap of an engineering mindset that seeks technical perfection. This can undermine credibility and set up unfulfillable expectations. And it misses the central reality of business, which is that risk is essential to reward,” said Gaist.

Understand how your company makes money, and speak to that.“Effectively translating technical risk into business risk terms means you have to understand how your company makes money. A web-based company selling to consumers is going to be far more sensitive to web-server vulnerabilities than will a B2B logistics firm,” said Kip Boyle, founder and CEO of Cyber Risk Opportunities, a risk management consultancy and service.

Expect disbelief of your numbers, present them strategically.“Remember that no one believes the numbers on your deck right out of the box, and you’ll wind up in a debate over how good those numbers are. Instead, use numbers sparingly. If someone wants more numbers from you, let them ask for them,” said Gaist.
<<SEE ALSO>>
The most damaging hacks and data breaches of 2017, so far.

Amazon launches cloud SSO service for managing multiple AWS accounts.

Set up a business report rather than a security report. “CEOs and other C-levels all follow clear forecasting, tracking and reporting. The closer the CISO can align to this methodology, the more impactful they will be,” said Tom Pageler, chief risk officer and chief security officer at Neustar and  formerly chief risk officer at Docusign and deputy CISO/executive of global security and investigations director at JPMorgan Chase.

Make the impact more personal.Whatever you are describing or pitching, bring the point closer to the audience’s personal domain. “For example, if the discussion is with the VP of Sales, describe sales forecast impact. If the discussion is with the CFO, discuss the exposure to lawsuits and other activities that will stem from a breach and cause additional monetary damages,” said Jason Sinchak, CTO of mobile security company Sentegrity and CISO of Emerging Defense, a cyber-security penetration testing and breach investigation consulting firm.

Now you’re all set. Go forth with confidence, speaking in business terms and with the understanding that there is no “us versus them”—there is only “we.”
 

Join Us On TwitterFacebookGoogle PlusInstagramEmail For hottest Updates

The new AWS Single Sign-On service will make it easier for business users to centrally manage access to applications and accounts.

On Thursday, Amazon Web Services (AWS) announced AWS Single Sign-On (SSO), a new cloud SSO service that will make it easier for users to manage multiple AWS accounts with a single set of credentials.

According to a press release, users will be able to sign in to a central portal using their existing corporate credentials. From there, they can access and manage all of their accounts and applications in one place.

The tool also works with Microsoft Active Directory (AD), so users will be able to authenticate with their AD credentials. Through AD, admins can manage SSO access and permissions for users and groups in their directory as well.

"For instance, you can grant the DevOps AD group access to your production AWS accounts. When you add users to this group, they are granted access to your production AWS accounts automatically. This makes it easy to on-board new users and give existing users SSO access to new accounts and applications quickly," according to the product site.

AWS SSO will configure and maintain the permissions automatically. Admins will be able to assign specific permissions based on the functions or requirements of a user's role, and further customize them to fit security or policy requirements, the website noted.

In terms of permissions, one example offered on the website was giving a security team admin access only to AWS accounts that run the security tools, while providing auditor access everywhere else.

Must Read==> Best cheap smartphones: $300 (or much less) buys a great holiday gift

The service can also be integrated into other business applications. Through the application configuration wizard in AWS SSO, Security Assertion Markup Language (SAML) 2.0 integrations can be created to allow for AWS SSO to be used with any proprietary apps that are SAML-enabled, the release said.

Built-in SAML integrations exist for third-party apps like Salesforce, Box, and Office 365 as well, the release noted.
Any SSO activity will be recorded in AWS CloudTrail, for compliance and auditing purposes. This includes the time that account access was attempted, and the IP address that the attempt originated from.

AWS SSO is available in the firm's US East (North Virginia) Region, and there is no additional cost associated with the service.

Must Read: Whale Watching: Many companies earn a huge portion of sales from a few customers.

The 3 big takeaways for TechRepublic readers
Amazon has launched AWS Single Sign-On (SSO), an SSO service that will make it easier for users to manage multiple AWS accounts with their corporate credentials.

AWS SSO integrates with Microsoft Active Directory, allowing for further management of account access and permissions through the service.

AWS SSO can be integrated with other SAML-enabled applications, including proprietary apps, Salesforce, Box, and Office 365.

Also Read:  iPhone X Latest Price And Full Specification In Nigeria, Ghana, Uk.


Follow us on TwitterFacebookGoogle PlusInstagramEmail For latest update
Previous PostOlder Posts Home