1. Rev2 IT Information Security Risk Management February 26, 2010

2. Today’s Discussion Agenda Rev2 Introduction RiskView Framework Examples Next Steps Goals Introduce RiskViewTM a decision support system which helps identify and focus on business- material risks Understand your risk-management focus areas & processes 2

3. Rev2 Risk Management InfoSec Risk Supply Chain Risk Service Delivery Risk RiskView replaces ad-hoc processes with a Fact-based, Scalable, Repeatable Framework Identify under controlled risk via business views Focus on the most material drivers “What-if” controls testing

5. Perception vs. facts

6. Wasted money

8. Inconsistent data

9. Wrong metrics

10. Changing process

11. Inadequate toolsHow do you prioritize 1 Million vulnerabilities?

13. Metrics—Consistent metrics for materiality of business impact

14. Risks and Policies—To identify risks and define policies to limit exposure

15. Compliance—Regular evaluations to learn policy compliance and violations

16. Risk Updates—Regular reviews for materiality score changes

17. Measures and Actions—Regular risk assessments with next steps to fix key findings

18. Risk Algorithm—To calculate materiality scores

19. Analytic Engine—To compare risks and identify drivers

20. Scenario Testing— To pre-test potential program changes

21. Visualization—To facilitate analysis and understandingRequirements Effective risk management requires specialized structures, tools and systems that most companies lack 5

28. Recognize differences in asset value Strategic Data supports a fact-based, scalable, repeatable process 6

30. What is RiskViewTM? A software Risk Data Warehouse platform that collects vulnerability data Business-specific modules with customizable views and analytics Advanced Visualization to create a packaged decision support system Highly-extensible platform, for fact-based, scalable, repeatable Risk Management Decisions 8

32. Reputational

33. Regulatory

35. Cause

36. Business Unit

37. Geography/Location

38. Process9

39. 10 RiskView Examples

40. Vertical View- InfoSec 11

41. Horizontal View- Geography 12

42. Business Unit View 13

43. Filters = Focus Not every vulnerability is equal in terms of materiality Once aggregate material risk is identified and unacceptable levels detected, need to identify and profile drivers Date Range (trending) What-if (testing) Materiality (finding the “Critical Few”) 14

44. Exploded View 15

49. Rev2 time: ~ 2 weeks start to finish17