Strategy If you dont know where youre going

Strategy: If you don’t know where you’re going, you’ll never get there Don Welch, Ph. D. CISO Be Cyber. SMART. Get Cyber. SECURE.

Be Cyber. SMART. Get Cyber. SECURE.

Agenda • Introduction • Risk • Strategy Basics • IT and Business Strategy • Strategic Analysis • Design Framework • Communicating the Strategy Be Cyber. SMART. Get Cyber. SECURE.

Introduction Be Cyber. SMART. Get Cyber. SECURE.

Why listen to me? Be Cyber. SMART. Get Cyber. SECURE.

Cyber Security Environment Be Cyber. SMART. Get Cyber. SECURE.

Be Cyber. SMART. Get Cyber. SECURE.

Be Cyber. SMART. Get Cyber. SECURE.

Foreign Intelligence Be Cyber. SMART. Get Cyber. SECURE.

Criminals Be Cyber. SMART. Get Cyber. SECURE.

Hacktivists Be Cyber. SMART. Get Cyber. SECURE.

C-Level Leaders Be Cyber. SMART. Get Cyber. SECURE.

Risk Be Cyber. SMART. Get Cyber. SECURE.

Be Cyber. SMART. Get Cyber. SECURE.

Be Cyber. SMART. Get Cyber. SECURE.

Strategy 101 Be Cyber. SMART. Get Cyber. SECURE.

Strategy: Definition High level plan to achieve one or more goals under conditions of uncertainty • Wiki. Pedia Be Cyber. SMART. Get Cyber. SECURE.

Strategy: Definitions A pattern in a stream of decisions • Henry Mintzberg, Mc. Gill University Be Cyber. SMART. Get Cyber. SECURE.

Strategy: Definitions Planning and marshalling resources for their most efficient and effective use • Business Dictionary Be Cyber. SMART. Get Cyber. SECURE.

Strategy: Definitions • Plan to achieve long-term goals • Guide for decisions at all levels • Efficient and effective resource allocation Be Cyber. SMART. Get Cyber. SECURE.

Be Cyber. SMART. Get Cyber. SECURE.

Be Cyber. SMART. Get Cyber. SECURE.

Asymmetry and Adversaries Be Cyber. SMART. Get Cyber. SECURE.

Be Cyber. SMART. Get Cyber. SECURE.

Strategic Environment Analysis Threat Asset Impact Attacker Payoff Capability Be Cyber. SMART. Get Cyber. SECURE.

Be Cyber. SMART. Get Cyber. SECURE.

Constraints • Funding • Regulations and Laws • Staff Time and Talent • Business Overhead • Political Capital • Accountability • Calendar Time Be Cyber. SMART. Get Cyber. SECURE.

Be Cyber. SMART. Get Cyber. SECURE.

Be Cyber. SMART. Get Cyber. SECURE.

Coverage Matrix People Process Technology Identify Protect Detect Respond Recover Be Cyber. SMART. Get Cyber. SECURE.

Example Nested Matrix Detect/Technology Near Real-Time Network Payload Endpoint Post Compromise Be Cyber. SMART. Get Cyber. SECURE.

Example Nested Matrix Protect/People Mandatory Optional Users IT Staff Security Be Cyber. SMART. Get Cyber. SECURE.

Be Cyber. SMART. Get Cyber. SECURE.

Written Plan • One Pager • < 10 Pages • Full Document Be Cyber. SMART. Get Cyber. SECURE.

Be Cyber. SMART. Get Cyber. SECURE.

Be Cyber. SMART. Get Cyber. SECURE.

Be Cyber. SMART. Get Cyber. SECURE.

Be Cyber. SMART. Get Cyber. SECURE.

Be Cyber. SMART. Get Cyber. SECURE.

Information Security Strategy Low Moderate Identify Protect High + (Restricted) Watch Respond Recover Be Cyber. SMART. Get Cyber. SECURE.

Be Cyber. SMART. Get Cyber. SECURE.

Be Cyber. SMART. Get Cyber. SECURE.