Managing risk and information security : protect to enable

143 Pages·2013·3.281 MB·English

by  Harkins, Malcolm

Managing Risk and
Information Security
Protect to Enable
Malcolm Harkins
ApOrepssE?n
Managing Risk and Information Security: Protect to Enable
Malcolm Harkins
Copyright © 2013 by Apress Media, LLC, all rights reserved.
ApressOpen Rights: You have the right to copy, use and distribute this Work in its entirety,
electronically without modification, for non-commercial purposes only. However, you have the
additional right to use or alter any source code in this Work for any commercial or non-commercial
purpose which must be accompanied by the License to Distribute the Source Code for instances of
greater than 5 lines of code. Licenses (1), (2) and (3) below and the intervening text must be provided
in any use of the text of the Work and fully describes the license granted herein to the Work.
(1) License for Distribution of the Work: This Work is copyrighted by Apress Media, LLC, all rights
reserved. Use of this Work other than as provided for in this license is prohibited. By exercising any
of the rights herein, you are accepting the terms of this license. You have the non-exclusive right to
copy, use and distribute this English language Work in its entirety, electronically without modification
except for those modifications necessary for formatting on specific devices, for all non-commercial
purposes, in all media and formats known now or hereafter. While the advice and information in this
Work are believed to be true and accurate at the date of publication, neither the authors nor the editors
nor the publisher can accept any legal responsibility for any errors or omissions that may be made. The
publisher makes no warranty, express or implied, with respect to the material contained herein.
If your distribution is solely Apress source code or uses Apress source code intact, the following
licenses (2) and (3) must accompany the source code. If your use is an adaptation of the source code
provided by Apress in this Work, then you must use only license (3).
(2) License for Use Direct Reproduction of Apress Source Code: This source code, from Managing
Risk and Information Security ISBN 978-1-4302-5113-2 is copyrighted by Apress Media, LLC, all
rights reserved. Any direct reproduction of this Apress source code is permitted but must contain this
license. The following license must be provided for any use of the source code from this product of
greater than 5 lines wherein the code is adapted or altered from its original Apress form. This Apress
code is presented AS IS and Apress makes no claims to, representations or warrantees as to the
function, usability, accuracy or usefulness of this code.
(3) License for Distribution of Adaptation of Apress Source Code: Portions of the source code
provided are used or adapted from Managing Risk and Information Security ISBN 978-1-4302-5113-2
copyright Apress Media LLC. Any use or reuse of this Apress source code must contain this License.
This Apress code is made available at Apress.com/9781430251132 AS IS and Apress makes no claims
to, representations or warrantees as to the function, usability, accuracy or usefulness of this code.
ISBN978-1-4302-5113-2
ISBN978-1-4302-5114-9(eBook)
Trademarked names, logos, and images may appear in this book. Rather than use a trademark
symbol with every occurrence of a trademarked name, logo, or image we use the names, logos, and
images only in an editorial fashion and to the benefit of the trademark owner, with no intention of
infringement of the trademark.
The use in this publication of trade names, trademarks, service marks, and similar terms, even if they
are not identified as such, is not to be taken as an expression of opinion as to whether or not they are
subject to proprietary rights.
President and Publisher: Paul Manning
Lead Editors: Jeffrey Pepper (Apress); Stuart Douglas (Intel)
Coordinating Editor: Jill Balzano
Cover Designer: Anna Ishchenko
Distributed to the book trade worldwide by Springer Science+Business Media New York, 233
Spring Street, 6th Floor, New York, NY 10013. Phone 1-800-SPRINGER, fax [phone], e-mail
[email protected], or visit www.springeronline.com.
For information on translations, please e-mail [email protected], or visit www.apress.com.
About ApressOpen
What Is ApressOpen?
(cid:117)(cid:0) ApressOpen is an open access book program that publishes
high-quality technical and business information.
(cid:117)(cid:0) ApressOpen eBooks are available for global, free,
noncommercial use.
(cid:117)(cid:0) ApressOpen eBooks are available in PDF, ePub, and Mobi formats.
(cid:117)(cid:0) The user friendly ApressOpen free eBook license is presented on the
copyright page of this book.
iii
Foreword
Newly promoted CISOs rapidly realize that the scope of the position they have taken on
is often beyond what they have been prepared for. The nature of securing an enterprise
is daunting and overwhelming. There are no simple checklists or roadmaps for success.
Many of the technical security skills a CISO has acquired during the early portion of his or
her career may provide a “sixth sense” or intuition, but technical expertise alone does not
prepare the CISO for the business and leadership challenges required for success.
The Dunning-Kruger effect “is a cognitive bias in which unskilled individuals suffer
from illusory superiority, mistakenly rating their ability much higher than average”
(Wikipedia). Successful CISOs generally realize and admit to themselves how much they
don’t know. In my career, I have met many senior security professionals and have noticed
a common set of traits among those who are successful.
They generally exhibit a strong sense of curiosity, the ability to be self-aware, the
ability to “think evil” (like the adversary), and have strong communication and critical
thinking skills. They are open to new ideas, they invite debate, and they are adaptive in
their thinking and positions when new information is presented. They develop leadership
skills and build structures that enable balance. They also recognize talent and surround
themselves with teams of capable security technologists who are the true experts.
Excellent security leaders have learned that risk is not black-and-white and that balance
needs to be applied. They are empathic and likeable. My friend Malcolm meets all these
criteria.
In Managing Risk and Information Security: Protect to Enable, he distills the
hard-acquired knowledge he has learned through his career as a business and security
leader into a concise framework that enables CISOs to cut through the chaos of securing
the enterprise. Absorb the lessons in this book and enrich them by continuing to
experiment and innovate. Threats, organizational dynamics, and technology are constantly
evolving and we as security professionals must apply the lessons outlined here and
continuously adapt ourselves to the challenge.
—Patrick Heim
Chief Trust Officer
Salesforce.com, Inc.
v
Contents at a Glance
About ApressOpen ............................................................................iii
Foreword ...........................................................................................v
About the Author ............................................................................xiii
Preface ............................................................................................xv
Acknowledgments .........................................................................xvii
(cid:78) Chapter 1: Introduction ..................................................................1
(cid:78) Chapter 2: The Misperception of Risk ..........................................15
(cid:78) Chapter 3: Governance and Internal Partnerships .......................27
(cid:78) Chapter 4: External Partnerships .................................................43
(cid:78) Chapter 5: People Are the Perimeter ............................................57
(cid:78) Chapter 6: Emerging Threats and Vulnerabilities .........................71
(cid:78) Chapter 7: A New Security Architecture to Improve
Business Agility ............................................................................87
(cid:78) Chapter 8: Looking to the Future ................................................103
(cid:78) Chapter 9: The 21st Century CISO ..............................................113
(cid:78) Chapter 10: References ..............................................................125
Index ..............................................................................................131
vii
Contents
About ApressOpen ............................................................................iii
Foreword ...........................................................................................v
About the Author ............................................................................xiii
Preface ............................................................................................xv
Acknowledgments .........................................................................xvii
(cid:78) Chapter 1: Introduction ..................................................................1
Protect to Enable ......................................................................................................3
Keeping the Company Legal: The Regulatory Flood .................................................6
The Rapid Proliferation of Information and Devices .................................................9
The Changing Threat Landscape ............................................................................11
A New Approach to Managing Risk ........................................................................14
(cid:78) Chapter 2: The Misperception of Risk ..........................................15
The Subjectivity of Risk Perception ........................................................................15
How Employees Misperceive Risk ..........................................................................16
How Security Professionals Misperceive Risk ........................................................18
How Decision Makers Misperceive Risk .................................................................20
How to Mitigate the Misperception of Risk .............................................................21
Communication Is Essential ...................................................................................23
(cid:78) Chapter 3: Governance and Internal Partnerships .......................27
Information Risk Governance .................................................................................28
Finding the Right Governance Structure.................................................................29
Intel’s Information Risk Governance .......................................................................31
ix
(cid:78) CONTENTS
Building Internal Partnerships ................................................................................32
Conclusion ..............................................................................................................42
(cid:78) Chapter 4: External Partnerships .................................................43
The Value of External Partnerships .........................................................................44
External Partnerships: Types and Tiers ...................................................................46
Conclusion ..............................................................................................................56
(cid:78) Chapter 5: People Are the Perimeter ............................................57
The Shifting Perimeter ............................................................................................57
Examining the Risks ...............................................................................................59
Adjusting Behavior ..................................................................................................60
The Payoff ...............................................................................................................63
Roundabouts and Stop Signs .................................................................................64
The Security Benefits of Personal Use....................................................................65
Sealing the Gaps .....................................................................................................66
The IT Professional .................................................................................................67
Insider Threats ........................................................................................................68
Finding the Balance ................................................................................................69
(cid:78) Chapter 6: Emerging Threats and Vulnerabilities .........................71
Structured Methods for Identifying Threat Trends ..................................................72
Trends That Span the Threat Landscape.................................................................78
Key Threat Activity Areas ........................................................................................81
The Web As an Attack Surface ................................................................................82
Conclusion ..............................................................................................................84
(cid:78) Chapter 7: A New Security Architecture to Improve
Business Agility ............................................................................87
Business Trends and Architecture Requirements ..................................88
IT Consumerization .................................................................................................88
New Business Needs ..............................................................................................90
x
(cid:78) CONTENTS
Cloud Computing ....................................................................................................90
Changing Threat Landscape ...................................................................................90
Privacy and Regulatory Requirements....................................................................91
New Architecture ...................................................................................91
Trust Calculation .....................................................................................................92
Security Zones ........................................................................................................95
Balanced Controls...................................................................................................99
Users and Data: The New Perimeters ...................................................................101
Conclusion ...........................................................................................102
(cid:78) Chapter 8: Looking to the Future ................................................103
Internet of Things ................................................................................106
Compute Continuum ............................................................................107
Cloud Computing .................................................................................107
Business Intelligence and Big Data .....................................................107
Business Benefits and Risks ...............................................................108
New Security Capabilities .....................................................................................108
Baseline Security ..................................................................................................109
Context-Aware Security ........................................................................................110
Conclusion: The Implications for CISOs ...............................................112
(cid:78) Chapter 9: The 21st Century CISO ..............................................113
Chief Information Risk Officer .............................................................113
The Z-Shaped Individual......................................................................114
Foundational Skills ..............................................................................116
Becoming a Storyteller ........................................................................116
Fear Is Junk Food ................................................................................117
Accentuating the Positive .....................................................................................118
Demonstrating the Reality of Risk .......................................................119
xi
(cid:78) CONTENTS
The CISO’s Sixth Sense .......................................................................121
Taking Action at the Speed of Trust ......................................................................121
The CISO As a Leader ..........................................................................122
Learning from Other Business Leaders ................................................................122
Looking to the Future ..........................................................................123
(cid:78) Chapter 10: References ..............................................................125
Index ..............................................................................................131
xii
About the Author
Malcolm Harkins is vice president of the Information
Technology Group, Chief Information Security Officer
(CISO) and general manager of Information Risk
and Security. The group is responsible for managing
the risk, controls, privacy, security, and other related
compliance activities for all of Intel’s information assets.
Before becoming Intel’s first CISO, Harkins held
roles in Finance, Procurement, and Operations. He
has managed IT benchmarking efforts and Sarbanes-
Oxley systems compliance efforts. Before moving into
IT, Harkins acted as the profit-and-loss manager for
the Flash Product Group at Intel; he was the general
manager of Enterprise Capabilities, responsible for the
delivery and support of Intel’s Finance and HR systems;
and he worked in an Intel business venture focusing on
e-commerce hosting.
Harkins previously taught at the CIO Institute at
the UCLA Anderson School of Business and he was
an adjunct faculty member at Susquehanna University in 2009. In 2010, he received the
award for excellence in the field of security at the RSA Conference. He was recognized by
Computerworld magazine as one of the top 100 Information Technology Leaders for 2012.
In addition, (ISC)2 recognized Malcolm in 2012 with the Information Security Leadership
Award.
Harkins received his bachelor’s degree in economics from the University of California
at Irvine and an MBA in finance and accounting from the University of California
at Davis.
xiii