Transform The Security Conversation

David Lynas Consulting Limited 2017

Transform the Security ConversationEnablement : Excellence : Value

eCrime Singapore, 4 May 2017

David Lynas

CEO David Lynas Consulting Ltd

CEO The SABSA Institute CIC

COSAC Chairman

David Lynas Consulting Limited 2017 1

Your Presenter – David Lynas

36th year in Information Security

Co-author of SABSA

CEO SABSA Institute

SABSA Accredited Education Provider

Co-author “Enterprise Security Architecture”

ISBN 1-57820-318-X

Architecture & strategy clients on every continent

Fellow BCS & CSI Lifetime Achievement Award

Founder and chair of COSAC

Agenda – Use SABSA to Transform

the Security Conversation

The World’s Leading ESA Method & Framework

Free-use Methodology & Framework

Certified Architects in 60+ Countries

Formal regulated Professional Institute

Official & de facto Standard

Government, Finance & Industry

Change the Landscape of Security & Risk

Management, Enable Business and Bring

Demonstrable Value to Your Security Program

SABSA Top Ten Applications

Security Architecture

Enterprise Architecture

Traceability & Alignment of Solutions to Business Requirements

Enterprise Risk & Opportunity Management

Assurance, Compliance & Audit

Governance & Policy Architecture

Technical Solutions Design

Integration & Alignment of approaches, framework & standards

Security Service Management Framework

Critical National Infrastructure Strategy

The Security Language Barrier

What are your

security

requirements?

I don’t know

– that’s what

I pay you for!

I can give you

Confidentiality!

But I didn’t go

into Business

to achieve

confidentiality

Do you lose

sleep worrying

about scary

threats?

I lose sleep

worrying about

opportunities

I can’t grasp!

What about

DDOS, ZeroDay,

Bots, Phishing,

Malware and

RootKits?

¿Qué?

Say what?

Requirements are lost in

translation

We ask the wrong question

We offer a non-business solution

to a business problem

We talk the wrong language

We sell negatives to

stakeholders who desire……

enablement, excellence & value

What Really Matters

Seraph to Neo – The Matrix Reloaded

“I protect that which matters most”

Transform Language of Requirements

SABSA Attributes Profiling Technique

Engineering technique for modelling Business

Requirements into normalised, measureable,

demonstrable, re-usable, reportable form

The “Things that matter most”

Instinctive to stakeholders at all levels

Measureable to define performance targets and risk

appetite

Populates the missing link between Business and Security

Delegates Risk Appetite & Performance Targets

Example: Values of an NHS Trust

Patient

Focussed

Respectful

Trusted

Example: Values of an NHS Trust

Prioritised

ResponsibleProfessional

Communicative

Innovative

Example: NHS Trust Strategic Plan

Quality

Effective

Error-Free

Financially

Sustainable

Available

Accessible

Mobile

Scaleable

Timely

Reliable

A Hierarchy of Systemic Understanding

Systemic Interactions

Vertically

Peer-to-peer

Delegation of risk appetite

Governance, Ownership & delegation of responsibility

Every subdomain contributes performance to

superdomain

Subdomains exist to serve the risk & performance

appetite of the superdomain

Transform the Language of Security

Patient

FocussedPrioritised

Financially

SustainableTrusted Responsible Error Free

Culture

SensitiveAvailable

EffectiveAccountable Compliant Protected

Identified

Authenticated

Authorised

Access

Controlled

Reliable

Resilient

Recoverable

Standards

Compliant

Integrity

Assured

Educated &

Confidential

Auditable

Re-usable Monitored

Affordable

Accessible

Attributes for Two-Way Traceability

The Language of Horseshoe Nails

Risk Appetite Distribution, Policy Delegation & Systemic Risk

But HOW does the King check the horseshoe nails?

“For want of a nail the shoe was lost.

For want of a shoe the horse was lost.

For want of a horse the rider was lost.

For want of a rider the message was lost.

For want of a message the battle was lost.

For want of a battle the kingdom was lost.

And all for the want of a nail.”

— George Herbert, Jacula Prudentum, 1651

Transform the Language of Governance

Accountable

Responsible

Performance Target /

Risk Appetite

Distributed

Downwards

Contributing

Performance

Aggregated

Upwards

The Secret to Measures & Metrics: “What Have you Done for me Lately?”

Transform the Language of Governance

Customer

FocussedUser Centric Profitable Reputable Trusted Crime Free

Culture

SensitiveAvailable

Identified

Authenticated

Authorised

Access

Controlled

Reliable

Resilient

Recoverable

Standards

Compliant

Integrity

Assured

Educated &

Confidential

Auditable

Re-usable Monitored

Affordable

Accessible

Attributes for Reporting: Governance & Compliance

Balanced Risk Theory

Two Sides of the Same (Attribute) Coin

Measurable

Performance target

Risk Appetite

Risk v Reward

The Language of Risk Balance

Protect Enhance

Control Enablement

Maintain

Prevent Damage

Increase

Enable

The Language of Risk Balance

Protect life Prevent Crash Go Faster Increase Trust

Control

Objective

Enablement

Objective

Control Enabler

SABSA Risk Balance Model

Transform the Language of Risk

Patient

FocussedPrioritised

Financially

Culture

SensitiveAvailable

Identified

Authenticated

Authorised

Access

Controlled

Reliable

Resilient

Recoverable

Standards

Compliant

Integrity

Assured

Educated &

Confidential

Auditable

Re-usable Monitored

Affordable

Accessible

Attributes for Risk & Opportunity Management

The Language of “The Boss”

“Either you demonstrate support for my business objectives or

you are a business prevention department getting in my way!”

Transform the Language of Strategy

Patient

FocussedPrioritised

Financially

Culture

SensitiveAvailable

Identified

Authenticated

Authorised

Access

Controlled

Reliable

Resilient

Recoverable

Standards

Compliant

Integrity

Assured

Educated &

Confidential

Auditable

Re-usable Monitored

Affordable

Accessible

Attribute for Strategic Road Mapping

Current-state Target-state

More Information

The World’s most experienced

SABSA Delivery Team

Contact info@davidlynas.com

More Information

Visit David Lynas Consulting / SABSAcourses in the Exhibition

Hall and enter draw for a free place on our next Singapore course

Singapore Official Training

12 – 16 June 2017

Sabsacourses.com

THANK YOUDavid Lynas

David@davidlynas.com

www.sabsacourses.com

Transform The Security Conversation

Technology

Transcript of Transform The Security Conversation

TRANSFORM YOUR IT SECURITY IN 3 STEPS - …...Transform Your IT Security in 3 Steps As people, devices, and objects become more connected, protecting all these connections and environments

Conversation Ads Bring the Conversation to the Conversation

conversation peace - Adobes7d9.scene7.com/.../005706020_ConversationPeaceMB_Samplepdf.pdf · speech from the inside out. Conversation Peace ... For the final word on how to transform

Changing the Conversation - New College › sites › default › files › ... · 1 Changing the Conversation Articulating the Value of Programmatic, Holistic Security by Kim L.

People-Centric Security: Transform Culture, Reduce Risk, Drive Success

Cal Answerscalanswers.berkeley.edu/sites/default/files/Cal Answers Brochure.4.2… · the conversation about how data-driven insights can transform our campus operations and keep

The Journey – Revolutionizing Employment Brand to ... GE Journey_Final.pdf · The Journey – Revolutionizing Employment Brand to Transform Talent Strategy A conversation with General

Conversation Manual Manuel de Conversation

The Chocolate Conversation: Lead Bittersweet Change, Transform Your Business

Conversation Patterns: Interactions between … Patterns: Interactions between Loosely Coupled Services Gregor Hohpe gregor@hohpe.com June 18, 2008 Abstract As applications transform

A Scientific Research and Development Approach to Transform Cyber Security

Using virtualisation to transform security · Using virtualisation to transform security 1 1. We need to secure services on infrastructure we can’t always trust The need to secure

“Disappearances” by Security Forces in Nepal · PDF file“Disappearances” by Security Forces in Nepal ... Conversation between Human Rights Watch researchers, ... friends, who

Engaging The Conversation ( Homeland Security Conference)

Innovators’ Challenge: Going Beyond the Conversation ... · 7. Inspire for change: System transformation Courage, innovation and change leadership are imperative to transform seniors’

Upfront Conversation Reoccurring Conversation Constant Conversation.

Enterprise Security and Management Data Center ... · Data security compliance ... Transform enterprise security and management ... Security Management pg 4 Control Compliance Suite

Transform workforce experiences with an intelligent ... · Security 5 Protect your data with Endpoint Security in the Unified Workspace > We believe security shouldn’t slow your

Think. Transform. Making the possible practical - ISACA. Transform. Integrated Identity Management and its Impact on Governance, Audit, and Security October 2012 A forward look at

Copyright Security-Assessment.com 2004 Security-Assessment.com Hacking VoIP Is your Conversation confidential? by Nick von Dadelszen and Darren Bilby.