Demystifying CyberSecurity & BScDA, CPA, Preparing for the - PowerPoint PPT Presentation

Rick Ouellette, Demystifying CyberSecurity & BScDA, CPA, Preparing for the Board Room CGA, CISA, CISSP, CGEIT Find me on LinkedIn: rick-ouellette-5b1573a

Consider Perspectives Source: https://cdn-images- 1.medium.com/max/1600/1*Yac5ryyS0kdQvSxSwoUscQ.png

We Need To Work Together Source: Rick Ouellette

We need a simple formula – To focus ourselves & collaborate

A=L+OE Assets = Liabilities + Foundation Owner’s Equity of Accounting Foundation that enables finance performance measures

T – VM = R Threats – Vulnerability Management = Risk Foundation of Posture Risk Management Foundation that enables risk management performance measures

Vulnerability Management Key Document: Institute of Internal Auditors - “GTAG 6”

Vulnerability Management Highlights 80 / 20? Source: IIA’s Global Technology Audit Guide – Managing and Auditing IT, 2006

Performance Management - Leading and Lagging Indicators

CyberSec VM Performance Management Balanced Scorecard SOMIA Now (measure) Corporate Alignment Leading Indicators Lagging Indicators Before After

VM Capability Components • People • Process • Technology • Information

For Example, Leading: People • 52 work roles in the NICE Framework (next slide) • Do we have the required roles defined? • Do we have the required functions mapped? • Required experience, skills and certs defined? • Roles filled? • 100% filled with 100% of experience, skills, certs? • 50% filled with 70% of essential qualities?

VM: Critical Controls Self- Assessment Source: http://www.auditscripts.com/free-resources/critical-security-controls/

Lets Bring It Home……… Build a Bridge to The Board

Bridge to the Board’s Perspective K e y Examples from -Ten Questions Every Board Should Ask in Overseeing Cyber Risks Quoted from the Harvard Law School Forum on Corporate Governance and Financial Regulation 1. Has management given serious consideration to how much of the budget and how much staff is adequate for proper cyber risk management? 2. Has management taken steps to mitigate the cybersecurity risks associated with outsourcing business functions to third parties? 3. Has management installed adequate technology not only for preventing the downloading of malicious software but also for detecting and alerting the organization to attempted breaches? 4. What steps does management take to safeguard sensitive non-digital information? Source: https://corpgov.law.harvard.edu/2017/06/27/ten-questions-every-board-should-ask-in-overseeing-cyber-risks/

Thank you!