Archive for the ‘Management’ Category

Blueprint for Security in 2013

I’ve worked with a number of organisations this year that have been refreshing or redesigning part or all of their security function. It’s brought into focus for me the tension between new security practices and organisational inertia. These have all been organisations that cared greatly about security and were in no way dysfunctional. However, they have all been fighting the battle of five to ten years ago and were only now were undergoing the discovery and self-analysis to understand how to deliver on the aspirations they have in the new context of cyber security and the changed threat landscape.

It has brought home to me the need to focus on continual improvement activities, not limited to finding greater efficiency and effectiveness in what we are doing now but regularly challenging the scope of our activities to see if we need to do more or less or do different things.

(more…)

Business Partner and Supply Chain Cyber Security

I’ve recently been involved in some strategic cyber security work in the UK financial services sector. The financial services sector is a complex and coupled system. While some components are clearly more important there are few components that are inconsequential if they cannot be relied upon. No financial services organisation is independent in what is a highly cooperative sector.

Currently the Information Assurance aspects of reliance on partners and supply chain throughout the sector is handled through third party assurance. Every organisation assesses and is assessed by every other organisation breeding an expensive and distracting industry of rolling security controls assessments.

(more…)

Cyber’s Dirty Secret?

In 2011 the U.S. Securities and Exchange Commission (SEC) issued guidance on the disclosure of Cyber risks and Cyber incidents where they may significantly affect the risk of investing in the company reporting to the SEC.

This was controversial at the time and has led to an interesting revelation recently; many of the biggest US companies reporting Cyber incidents to the SEC have stated they suffered no major financial losses as a result. The context should be remembered in that on one hand these companies would like to reduce their reporting requirements and would love not to have to show their dirty laundry to the world but on the other hand these financial reports are personally signed off by the C-level executives in these companies and errors, inaccuracies, omissions and lies can all lead to fines and jail time for the individuals involved.

(more…)

Alignment vs Compliance vs Certification

I have had a series of conversations recently where the concepts of alignment, compliance and certification of ISO 27001 were very confused. Certification was seen as horribly costly and alignment was held out as a good enough goal that was entirely achievable.

In this particular environment they were already ‘aligned’ and had achieved most of what they needed to do to be ‘compliant’ but were still scared of the impact of certification. I ended up having to come to a common set of definitions of alignment, compliance and certification to explain to a variety of security specialists and business stakeholders what they were discussing to try and defuse the fear that was starting to set in. Here are the definitions I ended up with.

(more…)

6 Questions about security the board care about

Another short post to break up the big essays I tend to write.

These are the questions any Security Manager worth his salt needs to have prepared answers for anytime he attends the board of the company or socialises with board members:

  1. Are we safe ?
  2. Can I take responsibility for the actions of the company ?
  3. Who handles our data ?
  4. Who are we doing business with ?
  5. Are they accountable ?
  6. What is everyone else in our sector doing ?

If you focus your metrics away from the numbers of technical security events and away from the numbers of deployed security controls and towards answering those questions you’ll get a much more engaged board who will be happier to hear you speak.

Twitter RSS