Information Assurance Planning to Succeed Aaron Weller Got

Information Assurance Planning to Succeed Aaron Weller @Got. Privacy 1

A bit about me… Privacy strategy stuff. Some Info. Sec Ex-CEO, ex-CISO, recovering auditor Gamer, Physicist, Traveler, Foodie, INTJ, OCD Aussie, Brit, American…possibly others…

My Corporate Persona Lead Western US Privacy & Data Protection practice for Pw. C Help organizations better understand manage the personal and sensitive information that they hold. www. linkedin. com/in/aaronweller

What is success anyway? “. . . I don't have to be faster than the bear, I only have to be faster than you. ” i. e. I don’t have to be perfect, so long as my employer doesn’t get in the paper for an Info. Sec failure.

Overview • Planning 101 • Planning for Information Assurance • Practical issues and pitfalls • Q&A

Risk Management Theory • Planning: Bringing the future into the present so that you can do something about it before it happens • Risk: An event with a probability of occurring that will result in an impact if it does occur • Risk Management: Understanding things that could happen that would have a negative impact, prioritizing the ones where action should be taken and putting in place controls to reduce either the significance of an impact, or the likelihood of an event occurring (or both).

Risk Management Practice…nothing is simple • What risks are we trying to manage? • Which ones are the most important? • Even if we can agree what’s important, which ones should we take action to manage? • What are appropriate responses to important risks? • Who is accountable (and responsible) for ensuring that the right actions are taken? • Who is on the hook if you make the wrong decisions and something bad happens…? Planning for Success October 2013 Slide 8

Planning 101 “Planning is bringing the future into the present so that you can do something about it now. ” Alan Lakein

Why don’t people plan? Lack of comfort with planning process Lack of distinction between urgent and important No history of planning Organizational culture Perception that planning = procrastinating

Urgent vs. Important From First Things First by Steven Covey

Prioritization “There is never enough time to do everything, but there is always enough time to do the most important thing”. Brian Tracy

Seeing the Mountain 13 A good plan is like a road map: It shows the final destination and you can use it to work out the best way to get there. © Concise Consulting Group LLC - 2009

Rumsfeld Technique There are knowns. These are things we know that we know. There are known unknowns. That is to say, there are things that we know we don't know. But there also unknowns. There are things we don't know. Donald Rumsfeld

“Does anyone know it” axis Rumsfeld Matrix TM Co. Unknown llab. Knowns orate Priorit ize Reduce Resear ch Unknowns Knowns Known Unknowns “Do we know it” axis

Information Assurance Planning “There is nothing so useless as doing efficiently that which should not be done at all”. Peter F. Drucker

Spot the Information Assurance Professional Where is IA in this picture? ? ?

Outcomes from planning What needs to be secured (information assets) Major risks to your information assets Overview of current state controls and gaps Management’s risk appetite (i. e. how much can you fix and how much with they accept risk) Better idea of what to do and what not to do

Balance Current vs. Future “The IA community’s challenge is to address today’s challenges while also developing new and innovative capabilities to avert and mitigate tomorrow’s threats”. Do. D Interim IA Strategic Plan, 2008

How far out should you plan?

Microsoft Vision for 2019 http: //www. istartedsomething. com/20090228/microsoft-office-labs-vision-2019 -video/

Augmented Reality - 2009

Augmented Reality – 2019?

Timeline Long Medium Short (<6 m) (<18 m) (3 yrs)

Dissecting an IA Plan What? • Provide IA services that the business requires in a way that enables the achievement of business objectives. Why? • Demonstrate that IA is focused on assisting the business achieve its objectives, both through providing existing services and deploying new services and solutions. How? • Do the right things, in the right way, confirm they are done well (i. e. effectively and efficiently), so that the business gets the benefit • The underlined items are outward facing (how the business benefits from the strategy) • The italicized items are inward facing (how IA achieves the strategy)

The Val. IT Cycle Do the right things Confirm business gets benefit In the right way Confirm they are done well

Balanced Scorecard Operations How can we improve our processes? Finances How can we contribute to improving financial performance? Customer How should we be perceived by our customers? Evolution How can we maintain our ability to evolve and improve?

Why Compliance is not enough “I skate to where the puck is going to be, not where it has been. ” Wayne Gretzky

Transition from Strategy To Reality • Identify Gaps • Prioritize business requirements • Develop plans to migrate from current state to desired state • Track and communicated progress in terms of business value Services offered Today Services Required Today Ideal IA Strategy Services Required Tomorrow

Practical Issues and Pitfalls “I cannot give you the formula for success, but I can give you the formula for failure: which is: Try to please everybody”. Herbert B. Swope

Where Rubber hits Road

Common issues • • Organizational culture Too ambitious / shelf-ware Look – shiny! Lack of feedback loop Inability to deliver Too much theory – not enough results “We know what’s best”

Feedback Loop Do the right things Confirm business gets benefit In the right way Confirm they are done well

Questions or Comments?

Aaron. weller@us. pwc. com @Got. Privacy