SlideShare une entreprise Scribd logo
1  sur  19
From Decision to Implementation…
who’s on first?
Agenda
 The Challenge
 Governance Structures (NIST)
 Obstacles
 Know Your Audience
 Desired Outcomes
What to do with unmanaged risk?
3
s
Physical
Technology
Administrative
Governance Structure
4
A common flow of information and decisions at
the following levels within an organization:
• Executive
• Business/Process
• Implementation/Operations
Risk Management to Implementation
5
Negative Influences
 Unrealistic Expectations
 Decentralized IT
 Resource Availability
 Architecture Limitations
 Priorities
6
Priorities - typical
7
Executive
Business/Process
Implementations/
Operations
Priorities cont…
8
Transform: Acquisitions, New
Service Lines, Research and
Development
Grow: Do more with less,
more revenue, Staff
Development
Run: Deploy new systems,
upgrade applications, fix
desktops, timesheets and
status reports
What can you do?
9
Know your audience:
• Executive
• Business
• Operations
What’s your desired
outcome at each level?
Use words they
understand…
Is it really top down?
10
Decisions
Controls
Each process is more linear
with various stops and
starts…
Who’s on first?
11
…You have to decide:
Who do you need to talk to?
What do you want to happen?
How do you need to say it?
Decisions
Controls
Translation May WILL Be Required…
12
We need Advanced
Malware Protection
and Next Generation
Firewalls!!!
Your Boss
Said…Deploy a
Sandbox Tool!!!
The Board Said…Stop
the Bad Guys!!!
Try a different approach…
13
…You have to decide:
Who do you need to talk to?
What do you want to happen?
How do you need to say it?
REMEMBER: They all have
different priorities!!!
Buy in…From Executive Level to Transform
14
Who do you need to talk to? Executive Level
What do you want to happen? Documented support to
invest in Next Generation Tools to combat current threats
How do you need to say it? The bad guys are using more
sophisticated attacks, I need IT Leaders to allocate resources
to identify tools that will reduce our threat surface!!!
Resources…From the Business Level
(Growth?)
15
Who do you need to talk to? Business Level
What do you want to happen? Staff assigned to identify
tools that will reduce our threat surface
How do you need to say it? The Board expects IT
Resources will be assigned to investigate tools that address
the latest types of malicious attacks. I need to report back
next month!!! Who can I work with?
Results…Operations…this is the NEW RUN!!!
16
Who do you need to talk to? Operations Level
What do you want to happen? A tool is identified that will
integrate well in our environment and address current threats.
How do you need to say it? Your boss said get a list of tools
that can be used to prevent/detect ransomware…I need the
list in 2 weeks…
Governance Structure – New Outlook
17
Recap
18
1) Take the Time to Know your audience
2) Define your desired outcome before starting the
conversation
3) Ask for what you want in terms that they
understand
4) ACTIVATE YOUR SUPER POWER!!!
QUESTIONS?
19

Contenu connexe

Tendances

Chris Clymer & Jack Nichelson - How to Secure Things & Influence People: 10 C...
Chris Clymer & Jack Nichelson - How to Secure Things & Influence People: 10 C...Chris Clymer & Jack Nichelson - How to Secure Things & Influence People: 10 C...
Chris Clymer & Jack Nichelson - How to Secure Things & Influence People: 10 C...centralohioissa
 
Ruben Melendez - Economically Justifying IT Security Initiatives
Ruben Melendez - Economically Justifying IT Security InitiativesRuben Melendez - Economically Justifying IT Security Initiatives
Ruben Melendez - Economically Justifying IT Security Initiativescentralohioissa
 
Building Human Intelligence – Pun Intended
Building Human Intelligence – Pun IntendedBuilding Human Intelligence – Pun Intended
Building Human Intelligence – Pun IntendedEnergySec
 
William Diederich - Security Certifications: Are They Worth the Investment? A...
William Diederich - Security Certifications: Are They Worth the Investment? A...William Diederich - Security Certifications: Are They Worth the Investment? A...
William Diederich - Security Certifications: Are They Worth the Investment? A...centralohioissa
 
Steven Keil - BYODAWSCYW (Bring Your Own Device And Whatever Security Control...
Steven Keil - BYODAWSCYW (Bring Your Own Device And Whatever Security Control...Steven Keil - BYODAWSCYW (Bring Your Own Device And Whatever Security Control...
Steven Keil - BYODAWSCYW (Bring Your Own Device And Whatever Security Control...centralohioissa
 
Achieving Compliance Through Security
Achieving Compliance Through SecurityAchieving Compliance Through Security
Achieving Compliance Through SecurityEnergySec
 
Aaron Higbee - The Humanity of Phishing Attack & Defense
Aaron Higbee - The Humanity of Phishing Attack & DefenseAaron Higbee - The Humanity of Phishing Attack & Defense
Aaron Higbee - The Humanity of Phishing Attack & DefenseJason Luttrell, CISSP, CISM
 
NESCO Town Hall Workforce Development Presentation
NESCO Town Hall Workforce Development PresentationNESCO Town Hall Workforce Development Presentation
NESCO Town Hall Workforce Development PresentationEnergySec
 
Cybersecurity for Energy: Moving Beyond Compliance
Cybersecurity for Energy: Moving Beyond ComplianceCybersecurity for Energy: Moving Beyond Compliance
Cybersecurity for Energy: Moving Beyond ComplianceEnergySec
 
Security initiatives here and down under
Security initiatives here and down underSecurity initiatives here and down under
Security initiatives here and down underRoger Hagedorn
 
Data Security: What Every Leader Needs to Know
Data Security: What Every Leader Needs to KnowData Security: What Every Leader Needs to Know
Data Security: What Every Leader Needs to KnowRoger Hagedorn
 
What your scanner isn't telling you
What your scanner isn't telling youWhat your scanner isn't telling you
What your scanner isn't telling youCore Security
 
Everything is not awesome: The rising threat of Cyber-attack and what to do a...
Everything is not awesome: The rising threat of Cyber-attack and what to do a...Everything is not awesome: The rising threat of Cyber-attack and what to do a...
Everything is not awesome: The rising threat of Cyber-attack and what to do a...Robi Sen
 
SFScon 21 - Matteo Falsetti - Cybersecurity Management in the Supply Chain
SFScon 21 - Matteo Falsetti - Cybersecurity Management in the Supply ChainSFScon 21 - Matteo Falsetti - Cybersecurity Management in the Supply Chain
SFScon 21 - Matteo Falsetti - Cybersecurity Management in the Supply ChainSouth Tyrol Free Software Conference
 
Improving Security Metrics
Improving Security MetricsImproving Security Metrics
Improving Security MetricsDoug Copley
 
MT74 - Is Your Tech Support Keeping Up with Your Instr Tech
MT74 - Is Your Tech Support Keeping Up with Your Instr TechMT74 - Is Your Tech Support Keeping Up with Your Instr Tech
MT74 - Is Your Tech Support Keeping Up with Your Instr TechDell EMC World
 

Tendances (20)

Chris Clymer & Jack Nichelson - How to Secure Things & Influence People: 10 C...
Chris Clymer & Jack Nichelson - How to Secure Things & Influence People: 10 C...Chris Clymer & Jack Nichelson - How to Secure Things & Influence People: 10 C...
Chris Clymer & Jack Nichelson - How to Secure Things & Influence People: 10 C...
 
Ruben Melendez - Economically Justifying IT Security Initiatives
Ruben Melendez - Economically Justifying IT Security InitiativesRuben Melendez - Economically Justifying IT Security Initiatives
Ruben Melendez - Economically Justifying IT Security Initiatives
 
Building Human Intelligence – Pun Intended
Building Human Intelligence – Pun IntendedBuilding Human Intelligence – Pun Intended
Building Human Intelligence – Pun Intended
 
William Diederich - Security Certifications: Are They Worth the Investment? A...
William Diederich - Security Certifications: Are They Worth the Investment? A...William Diederich - Security Certifications: Are They Worth the Investment? A...
William Diederich - Security Certifications: Are They Worth the Investment? A...
 
CISO's first 100 days
CISO's first 100 daysCISO's first 100 days
CISO's first 100 days
 
Steven Keil - BYODAWSCYW (Bring Your Own Device And Whatever Security Control...
Steven Keil - BYODAWSCYW (Bring Your Own Device And Whatever Security Control...Steven Keil - BYODAWSCYW (Bring Your Own Device And Whatever Security Control...
Steven Keil - BYODAWSCYW (Bring Your Own Device And Whatever Security Control...
 
Achieving Compliance Through Security
Achieving Compliance Through SecurityAchieving Compliance Through Security
Achieving Compliance Through Security
 
Assessing Your security
Assessing Your securityAssessing Your security
Assessing Your security
 
Aaron Higbee - The Humanity of Phishing Attack & Defense
Aaron Higbee - The Humanity of Phishing Attack & DefenseAaron Higbee - The Humanity of Phishing Attack & Defense
Aaron Higbee - The Humanity of Phishing Attack & Defense
 
NESCO Town Hall Workforce Development Presentation
NESCO Town Hall Workforce Development PresentationNESCO Town Hall Workforce Development Presentation
NESCO Town Hall Workforce Development Presentation
 
Cybersecurity for Energy: Moving Beyond Compliance
Cybersecurity for Energy: Moving Beyond ComplianceCybersecurity for Energy: Moving Beyond Compliance
Cybersecurity for Energy: Moving Beyond Compliance
 
RSA 2017 - CISO's 5 steps to Success
RSA 2017 - CISO's 5 steps to SuccessRSA 2017 - CISO's 5 steps to Success
RSA 2017 - CISO's 5 steps to Success
 
Security initiatives here and down under
Security initiatives here and down underSecurity initiatives here and down under
Security initiatives here and down under
 
Data Security: What Every Leader Needs to Know
Data Security: What Every Leader Needs to KnowData Security: What Every Leader Needs to Know
Data Security: What Every Leader Needs to Know
 
What your scanner isn't telling you
What your scanner isn't telling youWhat your scanner isn't telling you
What your scanner isn't telling you
 
Everything is not awesome: The rising threat of Cyber-attack and what to do a...
Everything is not awesome: The rising threat of Cyber-attack and what to do a...Everything is not awesome: The rising threat of Cyber-attack and what to do a...
Everything is not awesome: The rising threat of Cyber-attack and what to do a...
 
Mind the gap
Mind the gapMind the gap
Mind the gap
 
SFScon 21 - Matteo Falsetti - Cybersecurity Management in the Supply Chain
SFScon 21 - Matteo Falsetti - Cybersecurity Management in the Supply ChainSFScon 21 - Matteo Falsetti - Cybersecurity Management in the Supply Chain
SFScon 21 - Matteo Falsetti - Cybersecurity Management in the Supply Chain
 
Improving Security Metrics
Improving Security MetricsImproving Security Metrics
Improving Security Metrics
 
MT74 - Is Your Tech Support Keeping Up with Your Instr Tech
MT74 - Is Your Tech Support Keeping Up with Your Instr TechMT74 - Is Your Tech Support Keeping Up with Your Instr Tech
MT74 - Is Your Tech Support Keeping Up with Your Instr Tech
 

En vedette

Using infoset query %2c sap query and quick viewer
Using infoset query %2c sap query and quick viewerUsing infoset query %2c sap query and quick viewer
Using infoset query %2c sap query and quick viewerShailendra Surana
 
Pai a fahimu & saipul
Pai a fahimu & saipulPai a fahimu & saipul
Pai a fahimu & saipulFahim Knap
 
preguntas y conceptos
preguntas y conceptos preguntas y conceptos
preguntas y conceptos viridiana29
 
Frauda [read only]-1
Frauda [read only]-1Frauda [read only]-1
Frauda [read only]-1gabivn80lmg
 
U.cs101 алгоритм программчлал-7
U.cs101   алгоритм программчлал-7U.cs101   алгоритм программчлал-7
U.cs101 алгоритм программчлал-7Badral Khurelbaatar
 
Эрхэт - Онлайн санхүүгийн програмын сургалтын гарын авлага
Эрхэт - Онлайн санхүүгийн програмын сургалтын гарын авлагаЭрхэт - Онлайн санхүүгийн програмын сургалтын гарын авлага
Эрхэт - Онлайн санхүүгийн програмын сургалтын гарын авлагаMend-Orshikh Amartaivan
 
Эрхэт - Онлайн санхүүгийн програмын гарын авлага
Эрхэт - Онлайн санхүүгийн програмын гарын авлагаЭрхэт - Онлайн санхүүгийн програмын гарын авлага
Эрхэт - Онлайн санхүүгийн програмын гарын авлагаMend-Orshikh Amartaivan
 
Boletin 2 densidad 3º eso
Boletin 2 densidad 3º esoBoletin 2 densidad 3º eso
Boletin 2 densidad 3º esoauroracapel
 
Chemistry of proteins
Chemistry of proteinsChemistry of proteins
Chemistry of proteinsAshok Katta
 

En vedette (12)

Using infoset query %2c sap query and quick viewer
Using infoset query %2c sap query and quick viewerUsing infoset query %2c sap query and quick viewer
Using infoset query %2c sap query and quick viewer
 
Pai a fahimu & saipul
Pai a fahimu & saipulPai a fahimu & saipul
Pai a fahimu & saipul
 
preguntas y conceptos
preguntas y conceptos preguntas y conceptos
preguntas y conceptos
 
Frauda [read only]-1
Frauda [read only]-1Frauda [read only]-1
Frauda [read only]-1
 
Csjpu d banco_preguntas_19032012
Csjpu d banco_preguntas_19032012Csjpu d banco_preguntas_19032012
Csjpu d banco_preguntas_19032012
 
Latvia
LatviaLatvia
Latvia
 
U.cs101 алгоритм программчлал-7
U.cs101   алгоритм программчлал-7U.cs101   алгоритм программчлал-7
U.cs101 алгоритм программчлал-7
 
Bvleg 6 recursion
Bvleg 6 recursionBvleg 6 recursion
Bvleg 6 recursion
 
Эрхэт - Онлайн санхүүгийн програмын сургалтын гарын авлага
Эрхэт - Онлайн санхүүгийн програмын сургалтын гарын авлагаЭрхэт - Онлайн санхүүгийн програмын сургалтын гарын авлага
Эрхэт - Онлайн санхүүгийн програмын сургалтын гарын авлага
 
Эрхэт - Онлайн санхүүгийн програмын гарын авлага
Эрхэт - Онлайн санхүүгийн програмын гарын авлагаЭрхэт - Онлайн санхүүгийн програмын гарын авлага
Эрхэт - Онлайн санхүүгийн програмын гарын авлага
 
Boletin 2 densidad 3º eso
Boletin 2 densidad 3º esoBoletin 2 densidad 3º eso
Boletin 2 densidad 3º eso
 
Chemistry of proteins
Chemistry of proteinsChemistry of proteins
Chemistry of proteins
 

Similaire à Tre Smith - From Decision to Implementation: Who's On First?

From Vision Statement to Product Backlog
From Vision Statement to Product BacklogFrom Vision Statement to Product Backlog
From Vision Statement to Product BacklogLuiz C. Parzianello
 
ASAE Tech Conference: Don't Blame The Sofware: 5 Vital Considerations Before ...
ASAE Tech Conference: Don't Blame The Sofware: 5 Vital Considerations Before ...ASAE Tech Conference: Don't Blame The Sofware: 5 Vital Considerations Before ...
ASAE Tech Conference: Don't Blame The Sofware: 5 Vital Considerations Before ...Vanguard Technology
 
Data Driven Product Management - ProductTank Boston Feb '14
Data Driven Product Management - ProductTank Boston Feb '14Data Driven Product Management - ProductTank Boston Feb '14
Data Driven Product Management - ProductTank Boston Feb '14Quantopian
 
The Seven Most Important (Non Technical) SharePoint Success Factors
The Seven Most Important (Non Technical) SharePoint Success FactorsThe Seven Most Important (Non Technical) SharePoint Success Factors
The Seven Most Important (Non Technical) SharePoint Success FactorsRichard Harbridge
 
What is an IANS CISO Workshop? Factor 1
What is an IANS CISO Workshop? Factor 1What is an IANS CISO Workshop? Factor 1
What is an IANS CISO Workshop? Factor 1IANS
 
What We Learned from Three Years of Sciencing the Crap Out of DevOps
What We Learned from Three Years of Sciencing the Crap Out of DevOpsWhat We Learned from Three Years of Sciencing the Crap Out of DevOps
What We Learned from Three Years of Sciencing the Crap Out of DevOpsSeniorStoryteller
 
Whitepaper interview with pam morris
Whitepaper  interview with pam morrisWhitepaper  interview with pam morris
Whitepaper interview with pam morrisComputer Aid, Inc
 
Ryan ArcherTopic Panic AttacksSpecific Purpose To inform my.docx
Ryan ArcherTopic Panic AttacksSpecific Purpose To inform my.docxRyan ArcherTopic Panic AttacksSpecific Purpose To inform my.docx
Ryan ArcherTopic Panic AttacksSpecific Purpose To inform my.docxjeffsrosalyn
 
Ryan ArcherTopic Panic AttacksSpecific Purpose To inform my.docx
Ryan ArcherTopic Panic AttacksSpecific Purpose To inform my.docxRyan ArcherTopic Panic AttacksSpecific Purpose To inform my.docx
Ryan ArcherTopic Panic AttacksSpecific Purpose To inform my.docxrtodd599
 
Digital Governance in Complex Organisations philly13
Digital Governance in Complex Organisations   philly13Digital Governance in Complex Organisations   philly13
Digital Governance in Complex Organisations philly13onlineredin
 
It's not the Size of the Data - It's How You Use It: Smarter Marketing with A...
It's not the Size of the Data - It's How You Use It: Smarter Marketing with A...It's not the Size of the Data - It's How You Use It: Smarter Marketing with A...
It's not the Size of the Data - It's How You Use It: Smarter Marketing with A...Koen Pauwels
 
Fundamentals of Recruitment Analytics Outline
Fundamentals of Recruitment Analytics OutlineFundamentals of Recruitment Analytics Outline
Fundamentals of Recruitment Analytics OutlineDan Meyer
 
CIO: Standard Requirements
CIO: Standard RequirementsCIO: Standard Requirements
CIO: Standard RequirementsGerardus Blokdyk
 
Technology Roundtable Photo Essay Nov 2012 Impact Productions Group
Technology Roundtable Photo Essay Nov 2012 Impact Productions GroupTechnology Roundtable Photo Essay Nov 2012 Impact Productions Group
Technology Roundtable Photo Essay Nov 2012 Impact Productions Groupmiagd
 
EO Accelerator San Francisco Presentation 13 Jun 2016
EO Accelerator San Francisco Presentation 13 Jun 2016 EO Accelerator San Francisco Presentation 13 Jun 2016
EO Accelerator San Francisco Presentation 13 Jun 2016 RESULTS.com
 
What is an IANS CISO Workshop? Factor 6
What is an IANS CISO Workshop? Factor 6What is an IANS CISO Workshop? Factor 6
What is an IANS CISO Workshop? Factor 6IANS
 
Richard Harbridge: 7 SharePoint Success Factors
Richard Harbridge: 7 SharePoint Success FactorsRichard Harbridge: 7 SharePoint Success Factors
Richard Harbridge: 7 SharePoint Success FactorsSharePoint Saturday NY
 

Similaire à Tre Smith - From Decision to Implementation: Who's On First? (20)

From Vision Statement to Product Backlog
From Vision Statement to Product BacklogFrom Vision Statement to Product Backlog
From Vision Statement to Product Backlog
 
Xero
XeroXero
Xero
 
ASAE Tech Conference: Don't Blame The Sofware: 5 Vital Considerations Before ...
ASAE Tech Conference: Don't Blame The Sofware: 5 Vital Considerations Before ...ASAE Tech Conference: Don't Blame The Sofware: 5 Vital Considerations Before ...
ASAE Tech Conference: Don't Blame The Sofware: 5 Vital Considerations Before ...
 
Data Driven Product Management - ProductTank Boston Feb '14
Data Driven Product Management - ProductTank Boston Feb '14Data Driven Product Management - ProductTank Boston Feb '14
Data Driven Product Management - ProductTank Boston Feb '14
 
The Seven Most Important (Non Technical) SharePoint Success Factors
The Seven Most Important (Non Technical) SharePoint Success FactorsThe Seven Most Important (Non Technical) SharePoint Success Factors
The Seven Most Important (Non Technical) SharePoint Success Factors
 
What is an IANS CISO Workshop? Factor 1
What is an IANS CISO Workshop? Factor 1What is an IANS CISO Workshop? Factor 1
What is an IANS CISO Workshop? Factor 1
 
Interview with pam morris
Interview with pam morrisInterview with pam morris
Interview with pam morris
 
What We Learned from Three Years of Sciencing the Crap Out of DevOps
What We Learned from Three Years of Sciencing the Crap Out of DevOpsWhat We Learned from Three Years of Sciencing the Crap Out of DevOps
What We Learned from Three Years of Sciencing the Crap Out of DevOps
 
Wipro
WiproWipro
Wipro
 
Whitepaper interview with pam morris
Whitepaper  interview with pam morrisWhitepaper  interview with pam morris
Whitepaper interview with pam morris
 
Ryan ArcherTopic Panic AttacksSpecific Purpose To inform my.docx
Ryan ArcherTopic Panic AttacksSpecific Purpose To inform my.docxRyan ArcherTopic Panic AttacksSpecific Purpose To inform my.docx
Ryan ArcherTopic Panic AttacksSpecific Purpose To inform my.docx
 
Ryan ArcherTopic Panic AttacksSpecific Purpose To inform my.docx
Ryan ArcherTopic Panic AttacksSpecific Purpose To inform my.docxRyan ArcherTopic Panic AttacksSpecific Purpose To inform my.docx
Ryan ArcherTopic Panic AttacksSpecific Purpose To inform my.docx
 
Digital Governance in Complex Organisations philly13
Digital Governance in Complex Organisations   philly13Digital Governance in Complex Organisations   philly13
Digital Governance in Complex Organisations philly13
 
It's not the Size of the Data - It's How You Use It: Smarter Marketing with A...
It's not the Size of the Data - It's How You Use It: Smarter Marketing with A...It's not the Size of the Data - It's How You Use It: Smarter Marketing with A...
It's not the Size of the Data - It's How You Use It: Smarter Marketing with A...
 
Fundamentals of Recruitment Analytics Outline
Fundamentals of Recruitment Analytics OutlineFundamentals of Recruitment Analytics Outline
Fundamentals of Recruitment Analytics Outline
 
CIO: Standard Requirements
CIO: Standard RequirementsCIO: Standard Requirements
CIO: Standard Requirements
 
Technology Roundtable Photo Essay Nov 2012 Impact Productions Group
Technology Roundtable Photo Essay Nov 2012 Impact Productions GroupTechnology Roundtable Photo Essay Nov 2012 Impact Productions Group
Technology Roundtable Photo Essay Nov 2012 Impact Productions Group
 
EO Accelerator San Francisco Presentation 13 Jun 2016
EO Accelerator San Francisco Presentation 13 Jun 2016 EO Accelerator San Francisco Presentation 13 Jun 2016
EO Accelerator San Francisco Presentation 13 Jun 2016
 
What is an IANS CISO Workshop? Factor 6
What is an IANS CISO Workshop? Factor 6What is an IANS CISO Workshop? Factor 6
What is an IANS CISO Workshop? Factor 6
 
Richard Harbridge: 7 SharePoint Success Factors
Richard Harbridge: 7 SharePoint Success FactorsRichard Harbridge: 7 SharePoint Success Factors
Richard Harbridge: 7 SharePoint Success Factors
 

Plus de centralohioissa

Mike Spaulding - Building an Application Security Program
Mike Spaulding - Building an Application Security ProgramMike Spaulding - Building an Application Security Program
Mike Spaulding - Building an Application Security Programcentralohioissa
 
Jake Williams - Navigating the FDA Recommendations on Medical Device Security...
Jake Williams - Navigating the FDA Recommendations on Medical Device Security...Jake Williams - Navigating the FDA Recommendations on Medical Device Security...
Jake Williams - Navigating the FDA Recommendations on Medical Device Security...centralohioissa
 
Valerie Thomas - All Your Door Belong to Me - Attacking Physical Access Systems
Valerie Thomas - All Your Door Belong to Me - Attacking Physical Access SystemsValerie Thomas - All Your Door Belong to Me - Attacking Physical Access Systems
Valerie Thomas - All Your Door Belong to Me - Attacking Physical Access Systemscentralohioissa
 
Dino Tsibouris & Mehmet Munur - Legal Perspective on Data Security for 2016
Dino Tsibouris & Mehmet Munur - Legal Perspective on Data Security for 2016Dino Tsibouris & Mehmet Munur - Legal Perspective on Data Security for 2016
Dino Tsibouris & Mehmet Munur - Legal Perspective on Data Security for 2016centralohioissa
 
Jeffrey Sweet - Third Party Risk Governance - Why? and How?
Jeffrey Sweet - Third Party Risk Governance - Why? and How?Jeffrey Sweet - Third Party Risk Governance - Why? and How?
Jeffrey Sweet - Third Party Risk Governance - Why? and How?centralohioissa
 
Sean Whalen - How to Hack a Hospital
Sean Whalen - How to Hack a HospitalSean Whalen - How to Hack a Hospital
Sean Whalen - How to Hack a Hospitalcentralohioissa
 
Robert Hurlbut - Threat Modeling for Secure Software Design
Robert Hurlbut - Threat Modeling for Secure Software DesignRobert Hurlbut - Threat Modeling for Secure Software Design
Robert Hurlbut - Threat Modeling for Secure Software Designcentralohioissa
 
Harry Regan - Disaster Recovery and Business Continuity - "It's never so bad ...
Harry Regan - Disaster Recovery and Business Continuity - "It's never so bad ...Harry Regan - Disaster Recovery and Business Continuity - "It's never so bad ...
Harry Regan - Disaster Recovery and Business Continuity - "It's never so bad ...centralohioissa
 
Rafeeq Rehman - Breaking the Phishing Attack Chain
Rafeeq Rehman - Breaking the Phishing Attack ChainRafeeq Rehman - Breaking the Phishing Attack Chain
Rafeeq Rehman - Breaking the Phishing Attack Chaincentralohioissa
 
Oliver Schuermann - Integrated Software in Networking - the Mystery of SDN
Oliver Schuermann - Integrated Software in Networking - the Mystery of SDNOliver Schuermann - Integrated Software in Networking - the Mystery of SDN
Oliver Schuermann - Integrated Software in Networking - the Mystery of SDNcentralohioissa
 
Jack Nichelson - Information Security Metrics - Practical Security Metrics
Jack Nichelson - Information Security Metrics - Practical Security MetricsJack Nichelson - Information Security Metrics - Practical Security Metrics
Jack Nichelson - Information Security Metrics - Practical Security Metricscentralohioissa
 
Michael Woolard - Gamify Awareness Training: Failure to engage is failure to ...
Michael Woolard - Gamify Awareness Training: Failure to engage is failure to ...Michael Woolard - Gamify Awareness Training: Failure to engage is failure to ...
Michael Woolard - Gamify Awareness Training: Failure to engage is failure to ...centralohioissa
 
Ed McCabe - Putting the Intelligence back in Threat Intelligence
Ed McCabe - Putting the Intelligence back in Threat IntelligenceEd McCabe - Putting the Intelligence back in Threat Intelligence
Ed McCabe - Putting the Intelligence back in Threat Intelligencecentralohioissa
 
Ofer Maor - Security Automation in the SDLC - Real World Cases
Ofer Maor - Security Automation in the SDLC - Real World CasesOfer Maor - Security Automation in the SDLC - Real World Cases
Ofer Maor - Security Automation in the SDLC - Real World Casescentralohioissa
 
Jim Libersky: Cyber Security - Super Bowl 50
Jim Libersky: Cyber Security - Super Bowl 50Jim Libersky: Cyber Security - Super Bowl 50
Jim Libersky: Cyber Security - Super Bowl 50centralohioissa
 
Jim Wojno: Incident Response - No Pain, No Gain!
Jim Wojno: Incident Response - No Pain, No Gain!Jim Wojno: Incident Response - No Pain, No Gain!
Jim Wojno: Incident Response - No Pain, No Gain!centralohioissa
 
Jason Samide - State of Security & 2016 Predictions
Jason Samide - State of Security & 2016 PredictionsJason Samide - State of Security & 2016 Predictions
Jason Samide - State of Security & 2016 Predictionscentralohioissa
 
Jessica Hebenstreit - Don't Try This At Home! (Things Not To Do When Securing...
Jessica Hebenstreit - Don't Try This At Home! (Things Not To Do When Securing...Jessica Hebenstreit - Don't Try This At Home! (Things Not To Do When Securing...
Jessica Hebenstreit - Don't Try This At Home! (Things Not To Do When Securing...centralohioissa
 
Carolyn Engstrom - IT Data Analytics: Why the Cobbler's Children Have No Shoes
Carolyn Engstrom - IT Data Analytics: Why the Cobbler's Children Have No ShoesCarolyn Engstrom - IT Data Analytics: Why the Cobbler's Children Have No Shoes
Carolyn Engstrom - IT Data Analytics: Why the Cobbler's Children Have No Shoescentralohioissa
 
Sam Herath - Six Critical Criteria for Cloud Workload Security
Sam Herath - Six Critical Criteria for Cloud Workload SecuritySam Herath - Six Critical Criteria for Cloud Workload Security
Sam Herath - Six Critical Criteria for Cloud Workload Securitycentralohioissa
 

Plus de centralohioissa (20)

Mike Spaulding - Building an Application Security Program
Mike Spaulding - Building an Application Security ProgramMike Spaulding - Building an Application Security Program
Mike Spaulding - Building an Application Security Program
 
Jake Williams - Navigating the FDA Recommendations on Medical Device Security...
Jake Williams - Navigating the FDA Recommendations on Medical Device Security...Jake Williams - Navigating the FDA Recommendations on Medical Device Security...
Jake Williams - Navigating the FDA Recommendations on Medical Device Security...
 
Valerie Thomas - All Your Door Belong to Me - Attacking Physical Access Systems
Valerie Thomas - All Your Door Belong to Me - Attacking Physical Access SystemsValerie Thomas - All Your Door Belong to Me - Attacking Physical Access Systems
Valerie Thomas - All Your Door Belong to Me - Attacking Physical Access Systems
 
Dino Tsibouris & Mehmet Munur - Legal Perspective on Data Security for 2016
Dino Tsibouris & Mehmet Munur - Legal Perspective on Data Security for 2016Dino Tsibouris & Mehmet Munur - Legal Perspective on Data Security for 2016
Dino Tsibouris & Mehmet Munur - Legal Perspective on Data Security for 2016
 
Jeffrey Sweet - Third Party Risk Governance - Why? and How?
Jeffrey Sweet - Third Party Risk Governance - Why? and How?Jeffrey Sweet - Third Party Risk Governance - Why? and How?
Jeffrey Sweet - Third Party Risk Governance - Why? and How?
 
Sean Whalen - How to Hack a Hospital
Sean Whalen - How to Hack a HospitalSean Whalen - How to Hack a Hospital
Sean Whalen - How to Hack a Hospital
 
Robert Hurlbut - Threat Modeling for Secure Software Design
Robert Hurlbut - Threat Modeling for Secure Software DesignRobert Hurlbut - Threat Modeling for Secure Software Design
Robert Hurlbut - Threat Modeling for Secure Software Design
 
Harry Regan - Disaster Recovery and Business Continuity - "It's never so bad ...
Harry Regan - Disaster Recovery and Business Continuity - "It's never so bad ...Harry Regan - Disaster Recovery and Business Continuity - "It's never so bad ...
Harry Regan - Disaster Recovery and Business Continuity - "It's never so bad ...
 
Rafeeq Rehman - Breaking the Phishing Attack Chain
Rafeeq Rehman - Breaking the Phishing Attack ChainRafeeq Rehman - Breaking the Phishing Attack Chain
Rafeeq Rehman - Breaking the Phishing Attack Chain
 
Oliver Schuermann - Integrated Software in Networking - the Mystery of SDN
Oliver Schuermann - Integrated Software in Networking - the Mystery of SDNOliver Schuermann - Integrated Software in Networking - the Mystery of SDN
Oliver Schuermann - Integrated Software in Networking - the Mystery of SDN
 
Jack Nichelson - Information Security Metrics - Practical Security Metrics
Jack Nichelson - Information Security Metrics - Practical Security MetricsJack Nichelson - Information Security Metrics - Practical Security Metrics
Jack Nichelson - Information Security Metrics - Practical Security Metrics
 
Michael Woolard - Gamify Awareness Training: Failure to engage is failure to ...
Michael Woolard - Gamify Awareness Training: Failure to engage is failure to ...Michael Woolard - Gamify Awareness Training: Failure to engage is failure to ...
Michael Woolard - Gamify Awareness Training: Failure to engage is failure to ...
 
Ed McCabe - Putting the Intelligence back in Threat Intelligence
Ed McCabe - Putting the Intelligence back in Threat IntelligenceEd McCabe - Putting the Intelligence back in Threat Intelligence
Ed McCabe - Putting the Intelligence back in Threat Intelligence
 
Ofer Maor - Security Automation in the SDLC - Real World Cases
Ofer Maor - Security Automation in the SDLC - Real World CasesOfer Maor - Security Automation in the SDLC - Real World Cases
Ofer Maor - Security Automation in the SDLC - Real World Cases
 
Jim Libersky: Cyber Security - Super Bowl 50
Jim Libersky: Cyber Security - Super Bowl 50Jim Libersky: Cyber Security - Super Bowl 50
Jim Libersky: Cyber Security - Super Bowl 50
 
Jim Wojno: Incident Response - No Pain, No Gain!
Jim Wojno: Incident Response - No Pain, No Gain!Jim Wojno: Incident Response - No Pain, No Gain!
Jim Wojno: Incident Response - No Pain, No Gain!
 
Jason Samide - State of Security & 2016 Predictions
Jason Samide - State of Security & 2016 PredictionsJason Samide - State of Security & 2016 Predictions
Jason Samide - State of Security & 2016 Predictions
 
Jessica Hebenstreit - Don't Try This At Home! (Things Not To Do When Securing...
Jessica Hebenstreit - Don't Try This At Home! (Things Not To Do When Securing...Jessica Hebenstreit - Don't Try This At Home! (Things Not To Do When Securing...
Jessica Hebenstreit - Don't Try This At Home! (Things Not To Do When Securing...
 
Carolyn Engstrom - IT Data Analytics: Why the Cobbler's Children Have No Shoes
Carolyn Engstrom - IT Data Analytics: Why the Cobbler's Children Have No ShoesCarolyn Engstrom - IT Data Analytics: Why the Cobbler's Children Have No Shoes
Carolyn Engstrom - IT Data Analytics: Why the Cobbler's Children Have No Shoes
 
Sam Herath - Six Critical Criteria for Cloud Workload Security
Sam Herath - Six Critical Criteria for Cloud Workload SecuritySam Herath - Six Critical Criteria for Cloud Workload Security
Sam Herath - Six Critical Criteria for Cloud Workload Security
 

Dernier

SIP trunking in Janus @ Kamailio World 2024
SIP trunking in Janus @ Kamailio World 2024SIP trunking in Janus @ Kamailio World 2024
SIP trunking in Janus @ Kamailio World 2024Lorenzo Miniero
 
"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...
"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks..."LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...
"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...Fwdays
 
DevoxxFR 2024 Reproducible Builds with Apache Maven
DevoxxFR 2024 Reproducible Builds with Apache MavenDevoxxFR 2024 Reproducible Builds with Apache Maven
DevoxxFR 2024 Reproducible Builds with Apache MavenHervé Boutemy
 
What's New in Teams Calling, Meetings and Devices March 2024
What's New in Teams Calling, Meetings and Devices March 2024What's New in Teams Calling, Meetings and Devices March 2024
What's New in Teams Calling, Meetings and Devices March 2024Stephanie Beckett
 
Designing IA for AI - Information Architecture Conference 2024
Designing IA for AI - Information Architecture Conference 2024Designing IA for AI - Information Architecture Conference 2024
Designing IA for AI - Information Architecture Conference 2024Enterprise Knowledge
 
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)Mark Simos
 
Search Engine Optimization SEO PDF for 2024.pdf
Search Engine Optimization SEO PDF for 2024.pdfSearch Engine Optimization SEO PDF for 2024.pdf
Search Engine Optimization SEO PDF for 2024.pdfRankYa
 
Advanced Test Driven-Development @ php[tek] 2024
Advanced Test Driven-Development @ php[tek] 2024Advanced Test Driven-Development @ php[tek] 2024
Advanced Test Driven-Development @ php[tek] 2024Scott Keck-Warren
 
Gen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdfGen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdfAddepto
 
DevEX - reference for building teams, processes, and platforms
DevEX - reference for building teams, processes, and platformsDevEX - reference for building teams, processes, and platforms
DevEX - reference for building teams, processes, and platformsSergiu Bodiu
 
Powerpoint exploring the locations used in television show Time Clash
Powerpoint exploring the locations used in television show Time ClashPowerpoint exploring the locations used in television show Time Clash
Powerpoint exploring the locations used in television show Time Clashcharlottematthew16
 
WordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your BrandWordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your Brandgvaughan
 
Human Factors of XR: Using Human Factors to Design XR Systems
Human Factors of XR: Using Human Factors to Design XR SystemsHuman Factors of XR: Using Human Factors to Design XR Systems
Human Factors of XR: Using Human Factors to Design XR SystemsMark Billinghurst
 
Connect Wave/ connectwave Pitch Deck Presentation
Connect Wave/ connectwave Pitch Deck PresentationConnect Wave/ connectwave Pitch Deck Presentation
Connect Wave/ connectwave Pitch Deck PresentationSlibray Presentation
 
Vertex AI Gemini Prompt Engineering Tips
Vertex AI Gemini Prompt Engineering TipsVertex AI Gemini Prompt Engineering Tips
Vertex AI Gemini Prompt Engineering TipsMiki Katsuragi
 
The Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and ConsThe Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and ConsPixlogix Infotech
 
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptx
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptxMerck Moving Beyond Passwords: FIDO Paris Seminar.pptx
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptxLoriGlavin3
 
Streamlining Python Development: A Guide to a Modern Project Setup
Streamlining Python Development: A Guide to a Modern Project SetupStreamlining Python Development: A Guide to a Modern Project Setup
Streamlining Python Development: A Guide to a Modern Project SetupFlorian Wilhelm
 

Dernier (20)

SIP trunking in Janus @ Kamailio World 2024
SIP trunking in Janus @ Kamailio World 2024SIP trunking in Janus @ Kamailio World 2024
SIP trunking in Janus @ Kamailio World 2024
 
"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...
"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks..."LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...
"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...
 
DevoxxFR 2024 Reproducible Builds with Apache Maven
DevoxxFR 2024 Reproducible Builds with Apache MavenDevoxxFR 2024 Reproducible Builds with Apache Maven
DevoxxFR 2024 Reproducible Builds with Apache Maven
 
What's New in Teams Calling, Meetings and Devices March 2024
What's New in Teams Calling, Meetings and Devices March 2024What's New in Teams Calling, Meetings and Devices March 2024
What's New in Teams Calling, Meetings and Devices March 2024
 
Designing IA for AI - Information Architecture Conference 2024
Designing IA for AI - Information Architecture Conference 2024Designing IA for AI - Information Architecture Conference 2024
Designing IA for AI - Information Architecture Conference 2024
 
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
 
Search Engine Optimization SEO PDF for 2024.pdf
Search Engine Optimization SEO PDF for 2024.pdfSearch Engine Optimization SEO PDF for 2024.pdf
Search Engine Optimization SEO PDF for 2024.pdf
 
E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx
E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptxE-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx
E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx
 
Advanced Test Driven-Development @ php[tek] 2024
Advanced Test Driven-Development @ php[tek] 2024Advanced Test Driven-Development @ php[tek] 2024
Advanced Test Driven-Development @ php[tek] 2024
 
Gen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdfGen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdf
 
DevEX - reference for building teams, processes, and platforms
DevEX - reference for building teams, processes, and platformsDevEX - reference for building teams, processes, and platforms
DevEX - reference for building teams, processes, and platforms
 
Powerpoint exploring the locations used in television show Time Clash
Powerpoint exploring the locations used in television show Time ClashPowerpoint exploring the locations used in television show Time Clash
Powerpoint exploring the locations used in television show Time Clash
 
WordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your BrandWordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your Brand
 
Human Factors of XR: Using Human Factors to Design XR Systems
Human Factors of XR: Using Human Factors to Design XR SystemsHuman Factors of XR: Using Human Factors to Design XR Systems
Human Factors of XR: Using Human Factors to Design XR Systems
 
Connect Wave/ connectwave Pitch Deck Presentation
Connect Wave/ connectwave Pitch Deck PresentationConnect Wave/ connectwave Pitch Deck Presentation
Connect Wave/ connectwave Pitch Deck Presentation
 
DMCC Future of Trade Web3 - Special Edition
DMCC Future of Trade Web3 - Special EditionDMCC Future of Trade Web3 - Special Edition
DMCC Future of Trade Web3 - Special Edition
 
Vertex AI Gemini Prompt Engineering Tips
Vertex AI Gemini Prompt Engineering TipsVertex AI Gemini Prompt Engineering Tips
Vertex AI Gemini Prompt Engineering Tips
 
The Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and ConsThe Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and Cons
 
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptx
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptxMerck Moving Beyond Passwords: FIDO Paris Seminar.pptx
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptx
 
Streamlining Python Development: A Guide to a Modern Project Setup
Streamlining Python Development: A Guide to a Modern Project SetupStreamlining Python Development: A Guide to a Modern Project Setup
Streamlining Python Development: A Guide to a Modern Project Setup
 

Tre Smith - From Decision to Implementation: Who's On First?

  • 1. From Decision to Implementation… who’s on first?
  • 2. Agenda  The Challenge  Governance Structures (NIST)  Obstacles  Know Your Audience  Desired Outcomes
  • 3. What to do with unmanaged risk? 3 s Physical Technology Administrative
  • 4. Governance Structure 4 A common flow of information and decisions at the following levels within an organization: • Executive • Business/Process • Implementation/Operations
  • 5. Risk Management to Implementation 5
  • 6. Negative Influences  Unrealistic Expectations  Decentralized IT  Resource Availability  Architecture Limitations  Priorities 6
  • 8. Priorities cont… 8 Transform: Acquisitions, New Service Lines, Research and Development Grow: Do more with less, more revenue, Staff Development Run: Deploy new systems, upgrade applications, fix desktops, timesheets and status reports
  • 9. What can you do? 9 Know your audience: • Executive • Business • Operations What’s your desired outcome at each level? Use words they understand…
  • 10. Is it really top down? 10 Decisions Controls Each process is more linear with various stops and starts…
  • 11. Who’s on first? 11 …You have to decide: Who do you need to talk to? What do you want to happen? How do you need to say it? Decisions Controls
  • 12. Translation May WILL Be Required… 12 We need Advanced Malware Protection and Next Generation Firewalls!!! Your Boss Said…Deploy a Sandbox Tool!!! The Board Said…Stop the Bad Guys!!!
  • 13. Try a different approach… 13 …You have to decide: Who do you need to talk to? What do you want to happen? How do you need to say it? REMEMBER: They all have different priorities!!!
  • 14. Buy in…From Executive Level to Transform 14 Who do you need to talk to? Executive Level What do you want to happen? Documented support to invest in Next Generation Tools to combat current threats How do you need to say it? The bad guys are using more sophisticated attacks, I need IT Leaders to allocate resources to identify tools that will reduce our threat surface!!!
  • 15. Resources…From the Business Level (Growth?) 15 Who do you need to talk to? Business Level What do you want to happen? Staff assigned to identify tools that will reduce our threat surface How do you need to say it? The Board expects IT Resources will be assigned to investigate tools that address the latest types of malicious attacks. I need to report back next month!!! Who can I work with?
  • 16. Results…Operations…this is the NEW RUN!!! 16 Who do you need to talk to? Operations Level What do you want to happen? A tool is identified that will integrate well in our environment and address current threats. How do you need to say it? Your boss said get a list of tools that can be used to prevent/detect ransomware…I need the list in 2 weeks…
  • 17. Governance Structure – New Outlook 17
  • 18. Recap 18 1) Take the Time to Know your audience 2) Define your desired outcome before starting the conversation 3) Ask for what you want in terms that they understand 4) ACTIVATE YOUR SUPER POWER!!!

Notes de l'éditeur

  1. What your Sr. Leaders are told and expect doesn’t always equal what engineers and operators are able or willing to do???
  2. Much more of linear process that requires different information be shared at different times.
  3. At this point on your journey who’s actually in control? Just going in with the board said…blah blah blah, won’t get you very far.
  4. You’re able to be creative and leverage every the various levels of the governance to get the outcomes that you want…