2014 has been called the year of the breach, with organizations from Home Depot to Sony experiencing attacks.
Information technology failures are serious—to the point that companies can lose customers and market share.
Now the question is: what measures should be taken to encounter severe threats? After having a lot of experience through years of working with diverse people from multinational financial institutes, I conclude that only having effective and efficient IT governance in place can fulfill the expectations of stakeholders. Why do we need governance?
Stakeholders expect:
Business is secure and creates value
The organization is responsive to changing business paragons.
What do we get from governing?
The board and executives have a better understanding of IT and have a clear picture of its performance as every opportunity and mishap are totally based on decision making. This enables them to make effective decisions regarding the investment and also assures the required IT objectives. “Effective governance” leads management toward better execution of strategies to achieve a desired behavior. “Transparency in governance” develops stakeholder confidence in responsibility and accountability, provides a competitive edge to the enterprise, and is helpful in improving the customer satisfaction level.
Enterprise IT governance provides balanced operations, which means IT can respond to the business needs and at the same time maintain and improve the stability and quality of services in a cost-effective manner. Outsourced services can be directed and controlled clearly as this approach enables effective, efficient and adaptable relationships.
Effective governance (improved return on investment and value on investment) helps to minimize failures, optimize productivity, enhance efficiency, and provide a compliance with rules and regulations by eliminating redundancy, overlap and lack of clarity.
How do we implement enterprise governance of IT?
Companies based on matured IT strategic plans that enable the business tend to be the most successful, having an established and fully integrated operating environment. With these best practices they are securing their information assets in terms of their confidentiality (reveal to authorized individuals only), integrity (confidence in data and assets) and availability (accessible when required).
So, taking all these benefits into account, how do we get started in generating, transforming and sustaining IT governance? First and foremost, one thing we must keep in mind is that we cannot adopt IT governance using a one-size-fits-all approach. Each organization is distinctive, with unique needs and priorities, so it should adapt or form its own governance model based on the nature of its business. Organizations that have no IT governance at all should take a slow start (perhaps with an advisory body, external consultant with strategic planning, standards making, and project prioritization) and add more functions to the governing body as the organization matures. Those organizations that are employing some variety of IT governance may wish to widen their body further into decision-making and performance management.
Best practices for information system governance can be evaluated within the perspective of industry-wide accepted standards, such as processes like information workflow, application and infrastructure development and maintenance, and support services (both operational in-house and external). These need to be gauged and then should be benchmarked with similar industry leaders and peer organizations of a similar size and IT infrastructure. After benchmarking, performance advancement activities can be started using industry standards and/or frameworks such as ITIL. I personally prefer and recommend ISACA’s COBIT 5 as a framework for effective governance and management of enterprise IT.
COBIT 5 has integrated all industry best practices into one framework, and this single integrated framework makes the point that to achieve alignment of best practices to business requirements COBIT 5 can be used at the highest as well as lowest level. This provides a framework for overall control based on a model of IT processes that should generically suit most organizations regardless of industry and whether private or public.
Security breaches? Their proactive/reactive defensive approaches? Strategic alignment? Value delivery? Risk and resource management? Performance measurement? The only answer to all these questions is to have effective and efficient enterprise governance of IT in place.
Organizations with highly effective IT governance prioritize and communicate the structure and essential changes across the organization. Involving both IT and business leaders and bringing them together at the upper management level is vital for ensuring how closely IT is related to business performance. Effective IT governance is a journey, but success can be realized by those who understand the path and the best IT governance practices that keep them on course.
Ali Nouman, CISA
Information Security at The Bank of Punjab, Pakistan
Large-scale network architectures, including private cloud and service provider networks, rely on a complex mix of routing protocols, virtualization, SDN, and Orchestration/Programmability priorities to function properly. Palo Alto Networks virtual firewalls fit into many of these large-scale network architectures, supporting multiple hypervisors, private and public cloud vendors, multiple routing protocols, and orchestration integration via our open APIs.
In this interview by Ivan Pepelnjak, we talk about some of these networking priorities and how Palo Alto Networks virtual firewalls can be deployed into these architectures, without adding unnecessary complexity. Networking teams are focused largely on scale, routing support, and orchestration, and Ivan’s interviews have a wide reach into this community and what these teams care about.
Please listen to hear a broad overview of how Palo Alto Networks integrates into these large-scale network environments.
Many retailers, large and small, brick-and-mortar and online, had their brands tarnished by cyberattacks in 2014. While news stories focused on Point-of-Sales (POS) breaches, often the initial intrusion took place in the back-office and through a business partner. Bottom line, to protect their reputation and the trust of their customers, retailers must reevaluate the level of security currently in place not only in their POS environments but also throughout their value chain and across their business partners and customer touch points.
As a crucial starting point, all applications and servers in the datacenter that generate traffic with a POS should be segmented in one if not several network zones to allow for better scrutiny. Palo Alto Networks next-generation firewall can effectively manage, control, and inspect all traffic coming in and out of the POS datacenter zone(s) and apply security policies that eliminate unnecessary applications, ensure least-privileged access by users (including contractors), and inspect all traffic for malicious payloads to identify and block known and unknown malware.
This segmentation step is critical to prevent cyberattacks, which penetrate the enterprise network through a weak point, and then move laterally into zones that communicate with POS terminals and handle sensitive information such as customer data or credit card information.
Additionally, we recommend additional security for the edge of the network and endpoints. Palo Alto Networks offers two products that are natively part of our Enterprise Security Platform and strengthen security at the POS:
Our advanced endpoint protection product, Traps, can be deployed on POS endpoints to prevent malware infection. Taking an innovative approach that is completely different from traditional AV products, Traps detects and blocks malware before it installs on the endpoint. Traps can be updated with the latest from the threat intelligence available through Wildfire, our threat detection service.
Our remote access solution, GlobalProtect, can be deployed on mobile devices and remote computers to enable a security team to enforce enterprise policies at the POS and ensure consistency of policies and security from the core to the edge of your network. GlobalProtect can also be used to enforce a secure VPN connection from the device it is installed on to your core infrastructure.
Finally, to complete the security of the POS environment and the communication between individual stores and the retailer’s datacenter, we support the following options depending on the chosen architecture for distributed stores:
For stores linked back to a central datacenter via MPLS, our Enterprise Security Platform should be deployed at the core to manage and secure all traffic going back and forth to stores. For this traditional and most common case, the security is centralized on one of our high-end next-generation firewalls.
For retailers that want to offer richer customer experiences directly at the POS with WiFi access and other advanced services or need to allow store employees to connect directly to the internet, they can deploy one of our smaller appliances like the PA-200, at the store level and benefit from more advanced security features.
Retailers often maintain a hybrid approach to support a broad range of small to large stores in a cost effective manner. They can easily combine any of the above scenarios to support a mixed environment with minimal to no integration as all offered alternatives:
Are based on the same underlying technology
Can be centrally managed with our administration console Panorama
Can easily exchange traffic logs
Use consistent security policies regardless of the appliance deployed
Seamlessly share threat intelligence
This deployment flexibility with minimal integration overhead is one key advantage of relying on the Palo Alto Networks Enterprise Security Platform.
Watch for upcoming blogs and webinars to learn how Palo Alto Networks can best secure retail operations and the highly target payment process.
The Cybersecurity Canon is official, and you can now see our website here. We modeled it after the Baseball or Rock & Roll Hall-of-Fame, except for cybersecurity books. We have 20 books on the initial candidate list but we are soliciting help from the cybersecurity community to increase the number to be much more than that. Please write a review and nominate your favorite.
The Cybersecurity Canon is a real thing for our community. We have designed it so that you can directly participate in the process. Please do so!
Book Review: Winning as a CISO (2005) by Rich Baich
Executive Summary
The latest candidate for the Cybersecurity Canon is Rich Baich’s Winning as a CISO. The roles of the chief information officer (CIO), the chief security officer (CSO), and the chief information security officer (CISO) in the modern enterprise have been constantly changing since we invented the need for such roles in the 1980s and 1990s. By the mid-2000s, the industry had settled on tucking the security function for an organization under the IT function of an organization. In other words, the CISO works for the CIO.
But Baich is an innovative thinker. He has looked at how the CISO role has evolved over the years and makes a pretty good case for where it needs to go next. By asking questions about the appropriate supervisor for a CISO, a CISO’s needed skill set, and ways to approach the CISO job function, Baich breaks new ground on how the industry should views these topics. Our industry will be slow to adopt these new ideas, but with the rash of highly publicized and impactful data breaches to the retail sector in 2014, perhaps the industry is ready to start making a change. Reviewing Baich’s book is a good place to start. It is Cybersecurity Canon-worthy, and you should have read it by now.
Introduction
The roles of the CIO, the CSO, and the CISO in the modern enterprise have been constantly changing since we invented the need for such roles in the 1980s and 1990s. I picked upWinning as a CISO because my boss handed it to me after he met the author, Rich Baich, at a security event. He said that Baich was a smart guy and had some interesting ideas about what modern CISOs in today’s environments about the modern CISO role in today’s environments. In this book, Baich explains some innovative thinking about what today’s CISOs should be responsible for, how they should fit into the organization, and how they might accomplish their tasks once they are established. In order to understand where Baich is coming from, it is useful to review the history of the CIO, CSO, and CISO roles in modern business.
Because of General Motors’ success with this new P&L model, business leaders across the world adopted it for their own organizations. That model lasted some 60 years until the 1980swhen CEOs realized that in order to drive organizational change, they needed executives with technical and functional specialties. CEOs began creating new C-level executive positions like chief marketing officers (CMOs), chief financial officers (CFOs), and, yes, CIOs. The idea of a C-level executive dedicated to security did not really emerge until the late 1990s, 10 years after the CIO position had become firmly established in modern business.
The first practitioners came out of the technical ranks. Vendor solutions to mitigate the cyber threat ran on networks and workstations. In order to manage those solutions, it was helpful to have people who understood that world, but this was a new thing for the techies; trying to translate technical risk to a business leader did not always go very well. Security techies have always been, and still are, passionate about their responsibilities. The early trailblazers tended to say “no” to any new project because of the potential security risk. The business leaders did not want to deal with these people who wanted to make organizational decisions with no thought about the bottom line. It became convenient to tuck these kinds of people underneath the CIO organization. CISOs began working for the CIO because, from the C-suite perspective, all of that technical stuff belonged in one basket, and the security people did not know how to talk to the business people.
As business leaders began applying resources to mitigate cyber risk, other areas of security risk started to emerge: physical security, compliance, fraud prevention, business continuity, safety, ethics, privacy, brand protection, etc. The idea of the CSO role began to gain popularity with business leaders because they needed someone to look at the entire business, not just cybersecurity risk to the business, but general security risk to the business. CSO Magazinelaunched in 2002 to cater to that crowd.
By the mid-2000s, the industry had settled on tucking the security function for an organization under the IT function for an organization. In other words, the CISO works for the CIO. This is not bad, per se, and this arrangement works in many organizations. The IT folks generally handle the daily automation functions while the security teams have more of an oversight role in terms of security architecture, policy, risk assessment, and security operations.
But since then, the industry has been in flux. Not every company is organized the same way. While the CIO role has made its way to the senior executive suite in some companies (Intel Corp. and McAfee to name two), that is by no means the norm. The CSO role is likewise lagging. Both tend to be lodged at the second tier of executives in many companies. And while it is not universal, the CISO tends to work for the CIO.
The Story
All of this history is essential background to the key messages in Baich’s book Winning as a CISO. He published it in 2005 and was quite rightly taking a look at where the CISO role was heading next. He organized the book as a fictional story about an established company in which the CEO had decided to hire his first CISO. His executive leadership team – the CIO, the general counsel, and the chief operating officer (COO) – had to decide what the new CISO’s responsibilities were and where this individual would fit in the organizational structure. Once the CEO made those decisions, the newly hired CISO had to decide how to execute this new role.
The Tech
The book is a quick read, with only 115 pages including the end credits, but it is a primer on what a CISO should do for any organization. In essence, any organization could use Baich’s book as a basic job description for a new CISO hire.
What Are a CISO’s Responsibilities?
When the story’s CEO brought his executive staff together to discuss the new position, he had them develop a list of responsibilities for the new hire. Here is the list:
Security Architecture
Incident Response
Security Awareness
Identity Management
Security Policy Development and Compliance
Due Diligence for Acquisitions and Mergers
Risk Management
I think this is a pretty good list of high-level responsibilities. Anything that comes up later that we might want the CISO to do can be easily shoehorned into one of these broad categories. Once the staff agreed to the responsibilities, the next step was to determine which senior executive should own them. In other words, which senior executive should the CISO work for?
To Whom Does the CISO Report?
All of the senior staff members had their perspectives. The CIO said, “The CISO should report to the IT Department because the focus of information security is related to technology. Information security solves technology related risks.” The general counsel said, “The CISO should report through the legal structure. [The] focus can be placed on compliance.” The COO said, “The CISO will have to collaborate with all departments, and everyone, including the sales team will benefit, but the team member who will need to utilize the resulting information the most will be the COO. A clear understanding of the operational risk factors will enable the successful CISO to present to the COO with a rubric of important options.”
The CEO weighed each of these perspectives and had a few of his own. He said that he did not want the new CISO to have to wrestle with any artificial organizational conflicts because he chose to put the position under one senior executive as opposed to another. He said that putting the CISO under the CIO had a number of problems, but the most important one was that it created a conflict of interest. “Reporting to the CIO would be like putting your boss on report.” The CISO’s job is to make things more secure, and sometimes that job may be in direct conflict with the CIO’s job of making things more efficient. With the CISO under the CIO, the organization automatically weights efficiency needs over security needs, and that obviates the reason to hire the CISO in the first place.
An opposing view comes from Forbes reporter Howard Baldwin. Baldwin complained in March 2014 that he did not like recent changes he was seeing within organizations that had broken out the security function to be a peer to the CIO. He says that these CIOs are highly paid executives who can handle competing priorities. In other words, the CIO can handle making decisions between security and efficiency. In other words, that is what we pay a person in this position to do.
In Baich’s story, the CEO had reservations about putting the CISO under other staff organizations too. He said that putting the CISO under the general counsel “would potentially position the Information Security department as an arm of the audit department.” According to Baich, auditing support is something the new CISO should help with, but based on the responsibilities the executive staff developed, the CISO’s role is much bigger.
The CEO ultimately put the CISO under the COO. To him, it made sense that the CISO position be perfectly positioned to support the entire organization and not one specific staff element. I think this makes sense. If loss associated with security is something that will potentially materially affect the business, it makes total sense to raise the platform of the person in charge of it to have a view of the entire organization and the power to affect change. If that is the case, then what skill sets are needed for the person who takes on that responsibility?
What Skill Sets Does a CISO Need?
Once he decided whom the CISO should work for, the CEO turned again to his senior staff to determine what skill sets would be essential for success. Without fanfare, Baich lists these five attributes:
Must have an MBA
Prior budget or P&L experience
A proven ability to lead an effective information security organization
Experience and skill as a change agent
Ability to serve as an information security expert for the executive team
The last three skills are fairly standard for many senior job positions in any organization. The first two are where Baich is providing some innovative thinking. Requiring an MBA and P&L experience for a CISO, as a mandatory requirement, is not the common thinking in the industry, but it is spot on for where the industry needs to go. As I said earlier, most CISOs have come up through the technical ranks and have little if any business experience. This is probably the main reason that security teams and business teams have a hard time communicating with each other. By requiring a CISO to have business experience first, Baich flips the typical experience equation on its head. Instead of training highly technical employees to be proficient in business concerns at the mid- to latter parts of their careers, he is suggesting that we take traditional business people and train them to be proficient in managing security operations.
“If performing vulnerability assessments, configuring firewalls, and performing network forensics makes you happy then becoming Chief Information Security Officer may not be the right career choice for you.”
Just like a traditional business person might find himself or herself as a general manager, product manager, finance officer, or marketing officer, Baich is suggesting we add security officer to the list, and I agree with him.
How Do You Be a CISO?
In Baich’s story, the CEO placed the CISO under the COO in order to give the position a matrixed view of the business. In that kind of environment, how does a CISO succeed? In spite of all the listed responsibilities this CISO has for the organization, Baich says that the most important implied responsibility for the CISO is running his or her organization like a business. The CISO needs to become the general manager of the security program.
“Ultimately, the success of any business, new or old, depends on a leader’s ability to build a team, market and sell the product, and run the business, still meeting the established measurements necessary to effectively operate the business.”
Although the CISO in this story will bring in no revenue, this individual has to demonstrate to the business leadership the value of the position in other ways. The CISO must become a world-class internal marketing person for every aspect of the security program. It is not enough to make the organization more secure. The CISO’s efforts to do so must demonstrably show how the security program is helping the organization grow.
Conclusion
Baich is an innovative thinker. He has looked at how the CISO role has evolved over the years and makes a pretty good case for where it needs to go next. By asking questions about the appropriate supervisor for a CISO, a CISO’s needed skill set, and ways to approach the CISO job function, Baich breaks new ground on how to think about these topics. Baich published the book in 2005. Back then, there was not a lot of impetus to change the current situation, and I do not see the industry adopting these ideas any time soon. But with the rash of highly publicized and impactful data breaches to the retail sector in 2014, perhaps the industry is ready to make a change. It is obvious that the way we are doing it now is not working. Because of Baich’s innovative thinking about the next step in the evolution of the CISO role, Winning as a CISO is Cybersecurity Canon-worthy, and you should have read it by now.
