Discussion that was held at RSA on the five steps CISO's can use to assess their enterprise security program and architect one that meets the organizations objectives and reduces its exposure to risk.

1. How CISO’s assess their Security
Program for Success
RSA Conference 2017

2. It’s about Visibility people!
As a CISO, when assessing a security program you tend to
have more questions than answers
Visibility

3. Cyber as a Business Enabler
“Cyber as a Business Enabler”
5 steps I have used for a successful security program

4. Step #1 – “Meet & Greet”
Meet & Greet – it’s about relationships

5. Building the relationships for Success
Step #1 – “The Meet & Greet”
• “Security doesn’t work in a
Vacuum, however it works well in a
Community”
• Grow your “Human Network”
• Meet your Team
• Meet Your Stakeholders
• Identify Influencers
• Meet Key Executive Leadership
• Know the responsibility & authority of
your position
• Sometimes its more than what
you realize

6. Step #2 - Inventory
Inventory – You can’t protect it if you don’t
know it exists

7. Understanding what is in your enterprise
Step #2 – “Inventory”
• “To protect your organization, know
your enterprise environment”
• People (Team Members, Contractors, Peers)
• Reports (Contracts, Metrics, Prior Audits,
Inspections)
• Architecture (Network, Location, Hardware,
Application, Cloud)
• Budgets (Security Program, Department,
Organization)
• Processes & Policies
• (Security Strategy, Policies, Workflows, Laws,
Regulations, Compliance)
• Review your Predecessor’s
documents, emails, notes.
• Now review their notes on your team
members

8. Step #3 - Assessment
Assessment – Just how mature is my program, what
issues will I need to address?

9. Time to measure your controls with a framework
Step #3 – “Assessment”
• “Continuous Assessment,
establish and verify your
baseline”
• Health of your Security Suite
• Review recent audits, policies,
projects
• Current audit findings,
recommendations?
• Measure Your Security
• Are you meeting your security
metrics?
• Are you meeting performance
metrics?
• Are you meeting 3rd Party
Assessment Frameworks?
• Are you meeting Compliance
Requirements?

10. Step #4 - Planning
Planning – Now that we know our security gaps,
what’s the plan to remediate them?

11. Putting your vision into a plan
Step #4 – “Planning”
• “Your Security Program & Team
are key to your Organization”
• Draft your “Vision” of the Security
Program
• Challenges to the current program
• Build your Strategic Security
Project Plan
• Use your Project Plan to build
your Security Budget
• Start Immediately (Momentum is
key)
• Will Correcting Issues = Clear
Business Benefits?
• Reduce Risk Exposure?
• Will Fixing the Issues = Credibility
for your Team?

12. Step #5 - Communicate
Communicate – Time to make the case for our plans
to remediate our issues and mature the program.

13. Making the case for change and the funds you require!
Step #5– “Communicate”
• Socialize your Security Vision
• Vision = “Where we want to be”
• Assessment = “Where we currently are”
• Gap Analysis = (Vision – Assessment)
• Gap Analysis = Strategic Security Project
Plan = Security Budget
• Socialize the Security Gap
• Correcting findings brings value to the
business
• “Visibility = Executive Sponsorship = Budget”

14. Some takeaways to assist you
Some points to remember
• You will be collecting and
reviewing an enormous amount of
data
• This will take time, normally between
3-6 months
• Leverage your “Human Network”
• Use your team, your peers, vendors
and stakeholders
• Don’t be afraid to ask for help
• Collaborate
• Share your information
• Visibility is crucial for your Team and
Security Program

15. At the end of this path
Conclusion
• At the end of this 3-6 month journey, you will
have:
• A “Human Network” to help you drive Cyber in your
organization
• An updated Inventory of your Organizations
Enterprise IT assets
• You will know the maturity of your Security Program
and your assessment baseline
• You will have created your Strategic Security Project
Plan
• This plan will help you create your Security Program
budget
• Better understanding of how “Cyber = Business
Value”
• Some Questions for you:
• So did you miss anything?
• When You get home, what are you going to verify?

16. The Full Picture

17. RSA 2017 – Path to Success
Questions, Rants, Discussions?
Gary Hayslip
Deputy Director
Chief Information Security Officer
@ghayslip
https://www.linkedin.com/in/ghayslip
https://app.box.com/v/Five-Step-CISO-
Mindmaps