Rational Survivability

Here’s a piece I wrote for Optimize a few months ago.

Linky

Constant threats to our business have changed the way we prioritize
security and risk management at WesCorp, the largest corporate credit
union in the United States with $25 billion in assets and $650 million
in annual revenue.

As chief information security officer (CISO)
and director of enterprise security services, my role is to embed
security into WesCorp’s operations. The company’s goal is to use
rational information risk management to help solve business problems,
provide secure business operations, and protect our clients’ data.

We’ve
developed a business-focused "reduction of risk on investment"
approach. Because it’s difficult to consistently attach a specific
monetary value to information assets and to assess an ROI for security
initiatives, we focus on reducing risk exposure and avoiding costs by
implementing the appropriate security measures.

To effectively
prioritize our risks, WesCorp aligns with the company’s strategic
initiatives. It’s crucial to clearly understand what’s important from a
critical operational-impact viewpoint. This must be done from both
technical and business perspectives.

WesCorp uses the Octave
framework, developed by the Carnegie Mellon Software Engineering
Institute, to facilitate our information risk-management process.
Specifically, risk is defined, prioritized, and managed based on the
synergistic flow of data, including risk assessment, business
continuity, vulnerability management, threat analytics, and
regulatory-compliance initiatives. These elements provide meaningful
data that lets the company understand where it may be vulnerable, what
mitigating controls are in place, and its overall risk and security
posture. This approach lets us effectively communicate to management,
regulators, and customers how we manage risk across the enterprise.

Three recent security initiatives illustrate how we’ve reduced risk through better network and security life-cycle management.

For
some time, we’ve all been warned that the network perimeter is dead
because of the increasing number of access points for mobile workers,
vendor collaborations, and business partners. We suggest that the
perimeter is, in fact, multiplying, though the diameter of the
perimeter is collapsing. As technology gains additional footholds
throughout the enterprise, thousands of firewall-like solutions are
needed to patrol and monitor access points. The challenge is to provide
network security while allowing the free flow of information and,
therefore, business as usual. The tactical security implementations
necessary for a growing network have traditionally been expensive and
difficult to manage.

Our strategy involves segmenting the
internal network into multiple networks grouped by asset criticality,
role, and function. This provides quarantine and containment to prevent
the spread of attacks. By layering the network infrastructure on
virtual security services, we can efficiently mitigate vulnerabilities
while guaranteeing firewall-intrusion detection and prevention, virus
protection, caching, and proxy services. This network-security approach
is aligned with how the business units are structured. Instead of
deploying 30 separate devices, we’ve consolidated our hardware
platforms into a single solution with the help of Crossbeam Systems
Inc. and other vendors to recoup $1.2 million in savings.

Another security initiative involves vulnerability management. Because
vigilance is necessary to identify and isolate threats in the
enterprise, assigning vulnerability-management and remediation
activities can slow the ability to act defensively and decisively,
thereby increasing risk. We’ve set up intelligence tools to identify
direct attacks in near-real time using streamlined processes.

Using a risk-management and threat-analytics solution from Skybox
Security Inc., we set up a virtualized representation of the enterprise
and incorporated business-impact analysis and risk-assessment metrics
into our overall vulnerability-management approach.

Finally, while we developed strategies for managing data access and
reducing business risk, our concerns turned to what happens to data
after it’s accessed. We needed to focus on providing real-time, ongoing
database management, specifically, to understand and monitor
privileges, system and user behavior, metadata integrity, and the types
of content accessed.

With the help of IPLocks Inc., we
can assess the risk to critical data warehouses across our enterprise,
and integrate security life-cycle process improvements from the bottom
up. This allows for greater effectiveness in curtailing abuse, fraud,
and potential breaches.

Projects also must provide efficiency
improvements or defensive-positioning capabilities against competitors
or market forces, or demonstrate that they enable a business unit to
achieve goals that contribute to the success of the mission.
Senior-level sponsorship is key, as well.

WesCorp
has an executive-chartered operational risk-management committee
comprising senior staff from across all lines of business, including
the CIO, as well as representatives from our internal audit and
enterprise security-services teams. The committee provides oversight
and governance for our initiatives and allows for clear definitions and
actionable execution of our security and risk-management efforts.

I
report up through the VP of IT to the CIO, who ultimately reports to
the chief operating officer/CFO. I also have dotted-line relationships
to various executive committees and councils, enabling our security and
risk-management framework to be executed unencumbered.

Compliance
is a big driver of all our security and risk efforts. WesCorp, though
not a public company, is heavily regulated like financial-services
companies. We strive to demonstrate our compliance and communicate the
effectiveness of our actions. Unlike many financial-services companies,
however, we view regulatory compliance as a functional byproduct of our
risk-management efforts; a properly defined and executed strategy goes
beyond compliance and implements business improvements. We can use the
best practices of compliance requirements as guidelines to estimate how
well we’re managing our tasks.

Critical to our overall security
and risk-management strategy is effective communication with business
units. The model we’ve adopted calls for an integrated team approach
between the traditionally separate IT and security functions. Because
we’re mutually invested in each other’s successes, we have a much
easier time reengineering our business processes and implementing
technology. We also have unique business-relationship managers who
facilitate smooth communication between the business units and IT.

Security is evolving from a technology function to a core business
function because enterprises realize that a focus on the execution of
business goals means survival. Those that don’t have such a focus will
see a further erosion of their credibility and relevance. Risk
management requires common sense and protecting the right things for
the right reasons; it demands basic business knowledge and sound
judgment. Focusing solely on technology is myopic and dangerous.
Businesses that successfully manage risk are willing to think like an
entrepreneur and manage people, processes, and technology to a
leveraged advantage to reduce risk.

The security breaches
at ChoicePoint and Lexis-Nexis have reinforced the relevance,
necessity, and effectiveness of our security and risk-management
efforts. These catalytic events have galvanized us to evaluate our
program and raise awareness globally across all lines of business.
People who might otherwise not be in touch with risk-management
programs can quickly reassess and determine that security is
fundamental to business.

By integrating security and risk
directly into business processes, we gain a competitive advantage.
Because the business decides what our priorities are or should be, the
strategies we champion are automatically aligned with the business as a
whole. It’s a common-sense approach that affords uncommon comfort and
security in an increasingly at-risk business world.

From the department of really scary trends…

In a move reminiscent of the spindown of Y2K, over the last 6 months a trend has emerged in which the economics and reflexively reactive response to SOX have left an unmistakable sour taste in the mouths of the corporations down whose throats SOX was thrust.

The costs billed by consulting companies to provide SOX compliance program creation and compliance are astounding. Millions of dollars have been burned through in what goes towards yet another grudge “insurance” purchase that still does very little toward actually making things more secure.

Sadly, now that the “hard work” has been slogged through, in the eyes of those who hawk the bottom line, the relevancy and survivability of corporate information security departments has been called into question with more granular focus. Some companies
have/are contemplating taking their public companies private because the burden of “compliance” costs more than the supposed risk these programs mitigate.

…and we’re left holding the bag like bad guys.

I know of some huge Fortune X companies in several verticals that have all but spun down to minimal staff in the Enterprise Information Security space; layoffs from top security management down to SOC staffers has occured as a turn to outsourcing/off-shoring seems more fiscally favorable.

This is not the result of overall downsizing initiatives — this is a result of specific and targeted RIF’s based on an assumptive lack of need for these positions now that SOX is “over.”

Further to that, where the middle of 2003 pointed to the fact that general network spending and budgets were reduced while security budgets soared, 2005 has produced a return to investing in the network side of the house where management has bought the ad on page 3 of numerous trade mags that networks will “self-heal.”

Perhaps we’ll see a new piece from Carr on why IT SECURITY doesn’t matter…

It just goes to show that if you’re a tactical band-aid to a strategic problem, you’ll just come off in the wash.