Creating Order from Chaos: Metrics That Matter
•
0 gostou•144 visualizações
Decision-makers need reliable data in order to understand risk and determine value of investments. With the amount of data available in a multinational company, one would assume that answers would be easy to find. But how does one identify which data is reliable and make it meaningful? This talk will provide best practices and lessons learned on how ADP built an effective security metrics program. Learning Objectives: 1: Understand use cases in which metrics can be applied to business-driven security. 2: Gain a structured approach to leveraging data for security decision-making. 3: Learn through practical lessons how to communicate results of your metrics program. (Source: RSA Conference USA 2018)
Recomendados
Recomendados
Mais conteúdo relacionado
Mais procurados
Mais procurados (20)
Semelhante a Creating Order from Chaos: Metrics That Matter
Semelhante a Creating Order from Chaos: Metrics That Matter (20)
Mais de Priyanka Aash
Mais de Priyanka Aash (20)
Último
Último (20)
Creating Order from Chaos: Metrics That Matter
- 1. SESSION ID: #RSAC James Lugabihl CREATING ORDER FROM CHAOS: METRICS THAT MATTER GRC-W04 Director, Execution Assurance- Global Security Organization, ADP Marta Palanques Security Lead Consultant, Execution Assurance- Global Security Organization, ADP
- 2. #RSAC Uncomfortable questions 2 The executive asks What controls need to be implemented? Where do those controls need to be implemented? Where do we allocate resources? How can investments be rearranged? What you have available to answer Multiple systems of record Manual processing Data skepticism Disjointed reporting
- 3. #RSAC Our solution Executive self service Self-service platform that enables security decision making Oriented to answer leadership questions Allows to intuitively navigate data leveraging conceptual relationships Uses data that is currently available in multiple environments Operational Services Cost Resources Projects Coverage and Maturity Business Value Risk Incidents Vulnerab ilities Unit Cost
- 4. #RSAC Retrospective Where is our program today • Reduced time to execute 3 previous manual reports by 70% • Added 12 more services • Currently using 6 data sources • Monthly report on our key goals and risk areas • 140 users, 54 of which are active What did it take 18 months 3 resources Approximately 3,000 work hours to build
- 5. #RSAC What to expect • A pragmatic 5-step approach to implement metrics • Survival tips • Ideas on integration with risk framework • Visualization techniques for your audience
- 6. #RSAC Where to start How do you eat an elephant? Stick to your goal!!! Accelerate decision making Ensure we’re doing the right things the right way Achieve more with less: identify focus areas (“low hanging fruit”) Survival tip #1
- 7. #RSAC Application of the DIKW pyramid 7 Wisdom Knowledge Information Data (Raw) Understanding, applied knowledge Enabling decision making Missing meaning Missing context List of vulnerabilities in your environment Grouped by host, OS or application Grouped by Data Center or product or line of business Execution plan to eliminate the issues/gaps from the environment
- 8. #RSAC Wisdom Knowledge Information Data (Raw) Understanding, applied knowledge Enabling decision making Our philosophy Missing meaning Missing context Focusonthevulnerabilities Focusontheplan
- 9. #RSAC Step 1 – define your requirements Objectives Identify business objectives that establish the need for resilience and cybersecurity Goal Develop one or more goals for each objective Question Develop one or more questions that, when answered, help determine the extent to which the goal is met Indicator Identify one or more pieces of information that are required to answer each question Metric Identify one or more metrics that will use the selected indicators to answer the question Source: Lisa Young, Measuring What Matters
- 10. #RSAC Places to find “Goals” Security strategy Risk Register Audit/Controls Policies Executive’s questions Survival tip #2
- 11. #RSAC Step 2 - Searching for data sources Potential sources Process bi-products Technologies assets interact with Peripheral processes External sources Don’t need an inventory
- 12. #RSAC Step 3 - Choosing your data source Aspects to consider Automatic vs manual Ownership/source Does it align with other sources? Use a common dictionary? Completeness Data variability Refresh frequency Does it contain stale/old data
- 13. #RSAC Progressive data improvement 13 Find data sources Gather data Report Follow up questions Identify missing data elements Survival tip #3
- 14. #RSAC Trust curve 14 Data improvement cycles Datatrustlevel Questioning the data Questioning the measured object
- 15. #RSAC Step 4 - Analyze Don’t need tools Needs to be repeatable Agreed upon approach Analyze deeper than needs to be presented Complexity of metrics
- 16. #RSAC Step 5 – Communicate / Present Draw attention to the most relevant items
- 17. #RSAC Step 5 – Communicate / Present Use familiar formats and charts
- 18. #RSAC Step 5 – Communicate / Present Repeated colors and patterns Why? Because of this
- 19. #RSAC Relationship between data sources 19 Vulnerabilities Service Technology Risk Result in Identified through Identified usingIncidents cause Supported byDetected by Asset Owner manages Related to Owned by has Impact / affect
- 20. #RSAC Recap on 5 steps Define requirements • Relevant and meaningful • Use the executive’s questions as guidance Identify potential data sources • Organic data sources • Be creative – an inventory isn’t always the best option Data evaluation / data quality • Doesn’t need to be perfect • Ownership is important Analysis • Make it repeatable • Agree on approach to reduce bias Communicate • Focus on the story • KISS • Make it interactive
- 21. #RSAC Integration with Risk framework 21 RISK MONITORING RISK RESPONSERISK ANALYSIS RISK IDENTIFICATION Refine scope Prioritize plan of action Set clear goals Use metrics as input for analysis Report on key risk indicators Measure success of plans
- 22. #RSAC What is next • Continue adding more data points and reports • Leverage reports to drive change in the organization (and measure that change) • Leverage metrics as inputs to FAIR analysis • Reduce operational overhead of maintenance
- 23. #RSAC Apply it Next week you should: Identify one of your organizational goals In the first three months following this presentation you should: Define your reporting requirements for that goal List potential data sources for your metrics, obtain a sample and compare them to select one Within six months you should: Use the data to answer the following questions: — Is my organization achieving this goal? — If not, what should I focus on first to get closer to it?
- 24. #RSAC References and Resources 24 Lisa Young, Measuring what matters; https://www.rsaconference.com/writable/presentations/file_upload/ grc-r05_measuring_what_matters.pdf
- 25. #RSAC Any questions? 25 James Lugabihl James.Lugabihl@adp.com Marta Palanques Marta.Palanques@adp.com