Selling Security to
the C-Level:
A Security Strategy
ISACA - Malta Chapter
Donald Tabone
22 November 2012

1
Agenda
[Part one]
■ Introduction: Realities we face
■ Information on the move
■ The balancing act
■ A matter of economics
■ The triggers
■ Going forward
[Part two]
■ Implementing a security strategy
■ Conducting a risk assessment
■ Conclusions

2
Introduction: Realities we face
Investments in security don’t produce revenue
When data breaches happen, the hammer falls
on IT
IT has to justify investments..
• .. and make sure security policies are up to date
CEO’s primary objectives
• Ensure that the company remains profitable
• Ensure that the company has a solid system in place

3
Information on the move
Company data resides in virtual NOT physical hands
According to Forrester, corporate data loss and security breaches occur as a result of
1. Employee misuse and
2. Non-comprehensive IT security policies
31% of breaches were as
a result of theft
27% of breaches were as
caused a result of
mishandling
As a result organisations face legal, financial and
reputational crises
As much as 70% of a company’s intellectual property (IP) lies in email
A huge percentage of data assets are “out there” on somebody’s smartphone / tablet
Trends show that volumes of data that need to be protected are proliferating..
.. as fast as the devices themselves
• Examine employees’ devices in greater detail
• Implement a Mobile Device Management (MDM)
solution
One typical solution to
manage the concern

4
The balancing act
Bring Your own Device (BYOD)
Some companies are more at risk than others, but no company is completely protected
from risk (or ever can be)
Choices regarding security policies and solutions can dramatically impact a company’s
bottom line
At the same time, compliance must be met
What about employee privacy?
Secure data in the enterprise whilst protecting access to non-work related areas on
employee-owned devices
Privacy concerns often result in fines and lawsuits
C-Levels often don’t see employee privacy as a bottom-line concern
But the damage of non compliance
can be costly to the corporate wallet
Ensuring
Enterprise
Security and
Compliance
Protecting
employee
privacy
Compliance has become untenable

5
A matter of economics
Securing the enterprise with the lowest investment possible
If a security policy results in one lost hour of productivity per employee per
week may result in massive costs to the organisation
The least expensive solution ≠ the cheapest solution
Technology cannot
dictate policy.
Policies need to flexible..
.. to deal with today’s
rapidly changing
technology environment
Scalable
solutions
Though investing in security measures may not turn a profit, it will ensure the sustainability
of a company by eliminating compliance concerns and reducing the risks of data breaches
It will also maintain workforce productivity in the event of a breach or unforeseen intrusion
A secure enterprise is a productive one
Mobile, social and cloud technologies have forced IT Departments to adapt policies
and procedures

7
The Triggers..1
Cyber Crime
• The cyber crime threat is actual and here to stay
• It’s NOT a question of if but when
• Be prepared for incidents
• Ensure adequate crisis management between departments
• Ensure security awareness between departments
• Align individual goals with the organisations’ cyber security ambitions
Incidents
• From panic to business as usual
• Dealing with incidents in state of panic is inefficient and ineffective
• Assign topic ownership and setup management reporting
• Discuss what reporting and information the board needs to govern
information security properly
• What information and resources can the organisation acquire itself?
• What resources, intelligence and threat information is to be acquired
externally?

8
The Triggers..2
Perspectives
• Take a look at your organisation from an attacker’s perspective
• What is interesting for an attacker might not be immediately obvious to
the organisation itself
• Identify your crown jewels and your position in the ecosystem / supply &
demand chain. Understand what attackers are doing (and why!)
• Make sure that these risks and your defences are aligned.
100% Security
• 100% security is not possible. And undesirable!
• Every large organisation has security holes. Period.
• Completely securing all technology, processes and people is impossible
and undesirable from a risk management perspective
• Goal should be to be free from incidents, but able to properly react when
inevitable incidents happen.

9
Going forward
Challenges
• Policies
• Security
awareness
• Risk averse
attitudes
• Security strategy
• Governance
• System scalability
Solutions
• Technical controls
• Risk
management
• Perspectives
• Being proactive
rather than
reactive
• Security Strategy
Triggers
• New technology
• Cyber crime
• Incidents
• Culture
Push for a security strategy ... ... backed by a risk management mindset
Prevention is
insufficient.
Invest in
detection and
response.
Organisations
have bet on
prevention of
security
incidents for
decades.
During the last
few years
(APT, zero
days attacks,
etc) we have
learned that
prevention
alone will not
protect us.
Make
significant
investments in
detection and
response
Proactive
cost effective
resilience

10
Implementing a security strategy – a holistic approach
Information security requirements
• Business objectives
• Legal and regulatory compliance
• New technologies
• New vulnerabilities
Obtaining management commitment
• Will require an understanding of high-level
information security concepts
• Will facilitate the implementation of a
strategy
• Not crucial for a risk based approach but
ideally should be present at each stage
“ As shown during the survey,
having management
commitment greatly helps
towards the implementation of
a strategy. ”
Information Security
Strategy
Technical
Controls
Risk Assessments
Information Security
Requirements
Policies
ManagementCommitment
Awareness
Periodic reviews
Information Security
Strategy
Awareness
Technical
Controls
Risk Assessments
Periodic reviews
Information Security
Requirements
Policies
ManagementCommitment
Information Security
Strategy
Awareness
Technical
Controls
Risk Assessments
Periodic reviews
Policies

11
Implementing a security strategy – a holistic approach
“ Risk is the potential for unwanted event to
have a negative impact upon an activity, by
exploiting an exposure. ”
The process of conducting a risk
assessment involves
• Identifying associated threats,
vulnerabilities and impact
• Determine the acceptable risk and report
• Determining the significant risks
A risk assessment will
• Build the foundation for employing
safeguards
• Help align the safeguards with the IS
requirements
• Allow for a better understanding of the
organisations exposure to risk
• Reduce the risk of over or under spending
on Information Security
• Help bolster top management commitment
Information Security
Strategy
Awareness
Technical
Controls
Risk Assessments
Periodic reviews
Information Security
Requirements
Policies
ManagementCommitment
Information Security
Strategy
Technical
Controls
Risk Assessments
Information Security
Requirements
Policies
ManagementCommitment
Awareness
Periodic reviews
Information Security
Strategy
Awareness
Technical
Controls
Risk Assessments
Periodic reviews
Information Security
Requirements
Policies
ManagementCommitment
Information Security
Strategy
Awareness
Technical
Controls
Risk Assessments
Periodic reviews
Policies
Risk Assessments

12
Implementing a security strategy – a holistic approach
When mitigating it is critical that safeguards
are focused on the following 3 areas
1. Policies formally define the structure for a
consistent and cohesive approach towards
implementing controls
2. Awareness concerns the need to make
employees aware of their obligations and
responsibilities
3. Technical controls reflect the need to secure
systems and the information within them
Treating the risk
• Once risks are identified, they need to be
treated by either accepting, transferring,
avoiding or mitigating it.
“ Security is only as good as the
weakest link therefore its imperative
that each process is given the right
importance. ”
Information Security
Strategy
Awareness
Technical
Controls
Risk Assessments
Periodic reviews
Information Security
Requirements
Policies
ManagementCommitment
Information Security
Strategy
Technical
Controls
Risk Assessments
Information Security
Requirements
Policies
ManagementCommitment
Awareness
Periodic reviews
Information Security
Strategy
Awareness
Technical
Controls
Risk Assessments
Periodic reviews
Information Security
Requirements
Policies
ManagementCommitment
Information Security
Strategy
Awareness
Technical
Controls
Risk Assessments
Periodic reviews
Policies
Risk Assessments
Awareness
Technical
Controls
Policies
Risk Assessments

13
Implementing a security strategy – a holistic approach
Periodic reviews have the following
objectives
• Verify the effectiveness of the policies,
awareness levels and technical controls
• Verify the validity of previous risk
assessments taking into account any new
information security requirements
• Renewing management commitment
Why are periodic reviews necessary?
• Is the residual risk at an acceptable level?
• Are the implemented controls effective?
• Do company policies need to be updated?
• How effective are your awareness efforts?
“ The overlying process ensures that any
required corrective measures are taken in a
timely manner to ensure a sound security
strategy. ”
Information Security
Strategy
Technical
Controls
Risk Assessments
Information Security
Requirements
Policies
ManagementCommitment
Awareness
Periodic reviews
Information Security
Strategy
Awareness
Technical
Controls
Risk Assessments
Periodic reviews
Information Security
Requirements
Policies
ManagementCommitment
Information Security
Strategy
Awareness
Technical
Controls
Risk Assessments
Periodic reviews
Information Security
Requirements
Policies
ManagementCommitment
Information Security
Strategy
Technical
Controls
Risk Assessments
Information Security
Requirements
Policies
ManagementCommitment
Awareness
Periodic reviews
Information Security
Strategy
Awareness
Technical
Controls
Risk Assessments
Periodic reviews
Information Security
Requirements
Policies
ManagementCommitment
Information Security
Strategy
Awareness
Technical
Controls
Risk Assessments
Periodic reviews
Policies
Risk AssessmentsRisk Assessments
Periodic reviews

14
Example of a Risk Assessment for Organisation XYZ Ltd
Potential Security
Incident
Result Likelihood Impact Risk Action
Error in use due to
lack of awareness of
how to use a system’s
function
Compromise of the
integrity of critical
information
Abuse of rights due to
no ‘logout’ when
leaving the
workstation
Compromise of the
Confidentiality and
integrity of information
Theft of documents
(or media) due to lack
of physical protection
of the building, doors
and windows.
Compromise of
confidentiality
Failure of network due
to single point of
failure
Loss in the availability
of information

15
Example of a Risk Assessment for Organisation XYZ Ltd
Calculation of the likelihood
Security Incident Likelihood
Error in use due to lack of awareness of how to use a system’s function High
Abuse of rights due to no ‘logout’ when leaving the workstation Medium
Theft of documents (or media) due to lack of physical protection of the building, doors and windows. Low
Failure of network due to single point of failure Very high
Likelihood is the
probability of a threat
occurring and
exploiting a
vulnerability.
Very Low An event that is highly unlikely to occur
Low
An event that is unlikely to occur; perhaps once every 3
years
Medium
An event likely to occur relatively frequently; perhaps
once a year
High
An even that is fairly probable, and could be expected to
occur several times a year
Very high
An event that could be reasonably expected to occur at
least every month or more frequently

16
Example of a Risk Assessment for Organisation XYZ Ltd
Calculation of the impact
Security Incident Impact
Error in use due to lack of awareness of how to use a system’s function Medium
Abuse of rights due to no ‘logout’ when leaving the workstation Low
Theft of documents (or media) due to lack of physical protection of the building, doors and windows. High
Failure of network due to single point of failure Very High
Impact is the result
of an information
security incident,
caused by a threat,
which affects an
assets.
Potential
impact
Business operations and
financial health
Legal and regulatory
obligations
Reputation and loss of
goodwill
Low
Little or no disruption /
financial loss
No legal or regulatory
obligation
Minor and limited
embarrassment internal to
the organisation
Medium
Detrimental to business
efficiency or financial
health
Technical breach of a legal
or regulatory obligation
Adversely effect relations
with customers or
shareholders
High
Causes serious disruption
/ financial loss
Serious breach of legal or
regulatory obligation
Seriously effect relations
with customers or
shareholders
Very high Could lead to bankruptcy
Could lead to the
organisation being closed
down
Threaten the future of the
business

17
Example of a Risk Assessment for Organisation XYZ Ltd
Calculation of the impact
Potential
impact
Business operations
and financial health
Legal and regulatory
obligations
Reputation and loss
of goodwill
Low
Little or no disruption /
financial loss
No legal or regulatory
obligation
Minor and limited
embarrassment internal
to the organisation
Medium
Detrimental to business
efficiency or financial
health
Technical breach of a
legal or regulatory
obligation
Adversely effect
relations with customers
or shareholders
High
Causes serious
disruption
/ financial loss
Serious breach of legal
or regulatory obligation
Seriously effect relations
with customers or
shareholders
Very high Could lead to bankruptcy
Could lead to the
organisation being
closed down
Threaten the future of
the business

18
Example of a Risk Assessment for Organisation XYZ Ltd
Calculation of the risk
Security Incident Likelihood Impact Risk
Error in use due to lack of awareness of how to use a system’s
function
High Medium 5
Abuse of rights due to no ‘logout’ when leaving the workstation Medium Low 3
Theft of documents (or media) due to lack of physical protection of
the building, doors and windows.
Low High 4
Failure of network due to single point of failure Very High Very high 8
The risk is identified
by mapping the
likelihood of a threat
exploiting a
vulnerability to the
impact if such
incident scenario
occurs.
Likelihood Very low Low Medium High Very high
Businessimpact
Low 1 2 3 4 5
Medium 2 3 4 5 6
High 3 4 5 6 7
Very High 4 5 6 7 8

19
Example of a Risk Assessment for Organisation XYZ Ltd
Security Incident Result Likelihood Impact Risk Action
Error in use due to lack of
awareness of how to use a
system’s function
Compromise of the
integrity of critical
information
High Medium
5
Mitigate through
awareness and
training
Abuse of rights due to no
‘logout’ when leaving the
workstation
Compromise of the
Confidentiality and
integrity of
information
Medium Low
3
Accept residual risk
since it lower less than
the acceptable level
Theft of documents (or
media) due to lack of
physical protection of the
building, doors and
windows.
Compromise of
confidentiality
Low High
4
Accept residual risk
since it lower less than
the acceptable level
Failure of network due to
single point of failure
Loss in the
availability of
information
Very High Very high
8
Mitigate by eliminating
single point of failure
by duplicating
equipment within the
network
Risk treatment
After having communicated the results to the interested parties, top management has decided that the
acceptable risk level should be less than 5.

20
Conclusions
• Take a holistic approach to implementing a sound security system which is dynamic
• Vulnerabilities need to be looked at from different angles to assess risk
• Adopt a robust risk management process to assessing risk
• Ensure business alignment when adopting a security strategy
• No two approaches to implementing a strategy will be the same
• Ensure continuous reviewing to maximise the effectiveness of controls
• C-Level buy-in is achieved by giving repeated clear messages that suit their
influence level (which is culture, strategy and governance - definitely not
technology)
• Keep in mind that you are only as secure as your weakest link
The threat of what an organization could lose is worth the investment to keep enterprises
secure in a constantly evolving IT era

Thank you!
Donald Tabone LL.M (Strath.), B.Sc (Hons.)
 donaldtabone@kpmg.com.mt