Information Security and its Impact on Project Managers · C-Suite Changes to replace upper...

55
Information Security and its Impact on Project Managers Convergency™ May 9, 2018 PMI Chicagoland Chapter Meeting Brian Nigl, Convergency LLC

Transcript of Information Security and its Impact on Project Managers · C-Suite Changes to replace upper...

Page 1: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

Information Security and its Impact on Project Managers

Convergency™

May 9, 2018PMI Chicagoland Chapter MeetingBrian Nigl, Convergency LLC

Page 2: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

The significant vulnerabilities present on an average enterprise

server typically take 5 minutes or less

to remediate, each

Page 3: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince
Page 4: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince
Page 5: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince
Page 6: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince
Page 7: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

to exploit

Page 8: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

AGENDA

• An Exciting Time

• Data Privacy Regulation on the Rise

• Risk Management Challenges

• Information Security Problem Solving

Page 9: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

“The world’s most valuable resource is no longer oil, but data.”

The Economist

May 2017

The Economist, May 6, 2017

Page 10: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

The Power to Augment Human Intelligence

Page 11: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

COMPETING PRIORITIES THROUGH 2021

Digital Innovation

Page 12: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

COMPETING PRIORITIES THROUGH 2021

Operational Transformation

Page 13: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

COMPETING PRIORITIES THROUGH 2021

End of Life

Page 14: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

COMPETING PRIORITIES THROUGH 2021

Risk & Compliance

Page 15: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

DATA PRIVACY REGULATION ON THE RISE

Page 16: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

Why Does Privacy Matter?

Page 17: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

U.S. PATCHWORK OF REGULATION

• Patchwork of federal laws – Gramm-Leach-Bliley Act (GLB), Video Privacy Protection Act, Electronic Communications Privacy Act (ECPA), Fair Credit Reporting Act, Children’s Online Privacy Protection Act (COPPA), Health Information Portability & Accountability Act (HIPAA)

• U.S. State Data Privacy Laws with lack of uniformity – for example, breach notification

Page 18: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

RECENT DATA PROTECTION REGULATIONS

Country Effective Date Significant Issues Global GDP Share

China June 1, 2017 Migrating more than one terabyte requires consent

18.1%

Russia July 1, 2017 Notice to authorities 30 days before processing data; significant control of approved systems; VPN ban

3.6%

Page 19: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

RECENT REGULATIONS

• PCI 3.2 – February 1, 2018

• PCI 3.2 Encryption in Transit Hardening – July 1, 2018

• NY State Dept of Financial Services – Certification –February 15, 2018

• Arizona Data Breach Notification – April 11, 2018

• Delaware Data Breach Notification – April 18, 2018

Page 20: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

UPCOMING REGULATIONS

• EU General Data Protection Regulation – May 25, 2018

• EU e-Privacy Regulation – Approval Pending

• Unsolicited Marketing

• Cookies

• Confidentiality (all communication channels)

Page 21: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

GDPR IMPACT

• 72 hour notification period – citizens and regulator

• Companies must assign someone to the role of Chief Data Officer

• Companies must conduct and provide a Data Privacy Impact Assessment (public record)

Page 22: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

GDPR IMPACT

• EU citizens have the right to be forgotten, except where law requires data to be retained (taxes, financial records, etc.)

• Companies must collect and retain only data which is relevant for processing

• EU citizens have the right to know where and how their data is being used

Page 23: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

GDPR PREPAREDNESS GAP

U.S. Fortune 500 Survey:

• 11% have yet to define a plan• 40% to achieve compliance after May 25, 2018• 59% not prepared for 72-hour notification• 64% not prepared to exercise data subject rights

Page 24: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

GDPR LESSONS LEARNED

GDPR Conferences Take-Away

EU Commission is looking for an early target –a U.S.-based corporation

Page 25: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

GDPR IMPACT ON PROJECTS

How will this project…..

• Align with personal information classification?• Adhere to 72-hour notifications?• Permit “right to be forgotten”?• Adhere to the right of disclosure?

Page 26: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

RISK MANAGEMENT CHALLENGES

Page 27: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

INFORMATION TECHNOLOGY’S SECURITY CONCERNS

Security has long been

a check-the-box activity

Page 28: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

INFORMATION TECHNOLOGY’S SECURITY CONCERNS

✓Our educational system lacks “Security by Design” knowledge and training

✓IT lacks security training prerequisites for app dev, infrastructure and support roles

✓IT lacks security requirements in app dev, infrastructure and support job descriptions

Page 29: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

INFORMATION TECHNOLOGY’S SECURITY CONCERNS

✓Security has yet to be “baked in” well-enough in development languages and network devices

✓IT lacks understanding of what “good” security looks like

Page 30: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

3.5 Millionunfilled cybersecurity jobs by 2021

LABOR SHORTAGE PROJECTED

Page 31: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

When Our Projects Do Not Account for Good Security….

Page 32: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

DATA BREACH INCREASES

Page 33: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

7.8 BillionRecords exposed.

a 24.2% increase over

2016’s previous high of 6.3 billion.

* 2017 Data Breach QuickView Report

DATA BREACH RECORDS EXPOSED

Page 34: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

Only 18.6%of all breaches

were discovered by the

organization responsible

for protecting the data

* 2017 Data Breach QuickView Report

DATA BREACH RECORDS EXPOSED

Page 35: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

Penance Projects

➢C-Suite Changes to replace upper management personnel who were responsible for security.

➢Public Relations Campaigns to convince customers and stakeholders that the problem is being addressed.

➢Marketing & Advertising Campaigns to improve marketplace reputation.

Page 36: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

Penance Projects

➢Legal Action is implied. Settlements continue to rise.

➢Regulatory Action from government agencies imposing excessive fines. Europe’s GDPR carries a risk of 4% of annual revenue or 20mm EUR.

➢Walls of Shame. Long-lasting public portals that list ne’er do wells.

Page 37: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

Penance Projects

Forrester 2018 Prediction:

“One U.S.-based, Fortune 500 CEO will lose his/her job as a result of GDPR violations in 2018.”

Page 38: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

Penance Projects

$7.35 Millionthe average cost of

a US security breach in 2017.

5% increase over 2016.

Page 39: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince
Page 40: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince
Page 41: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

SECURITY IMPACT ON PROJECTS

For this project…..

• Do my resources know how to apply “good” security?

• How many hours should I allocate to fixing security gaps?

• Who is the subject matter expert that can provide remediation advice?

Page 42: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

INFORMATION SECURITY

PROBLEM SOLVING

Page 43: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

SECURITY BY DESIGN

Page 44: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

A SOLUTION

• Hire or Appoint Subject Matter Expert(s) – Security Architect(s) and Security Engineer(s)

• Training

• Security Skills Gap Assessment

• Training/Re-training on current security skills

Page 45: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

A SOLUTION

• Standards – “Good” Security Defined

• Standards must be specific

• Standards embedded in contracts

• Vendors and suppliers held accountable

• Data classifications defined

• Processor roles defined

Page 46: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

“GOOD” SECURITY DEFINED

• Encryption in Transit

• Encryption at Rest

• Device encryption

• Cell-level encryption of data

• Advanced encryption techniques (key vault, enterprise key management)

• VDI over VPN

• Multi-factor authentication

• Detailed Security Standards

• No SSLv3, TLS 1.0, TLS 1.1

• No weak or insecure ciphers

• Detailed Security Procedures

• Annual Penetration Testing

• Quarterly Vulnerability Scanning

• Monitoring intervals well-defined

• Logging criteria well-defined

Page 47: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

“GOOD” SECURITY DEFINED

• Policies and Standards documents assessed (internal and vendor/supplier)

• Privacy law matrix alignment

• End of Life planning

• Onboarding/offboarding controls reviewed quarterly

• Decommission plans well-executed

Page 48: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

A SOLUTION

• Risk Management Organization

• Alignment with Third Party Lifecycle Management program

• Participation from relevant business units (Legal, Finance, Audit, Compliance, etc.

Page 49: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

A SOLUTION

• Risk Maturity Model

• Define current maturity

• Define goals, improve, re-evaluate

Page 50: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

A SOLUTION

• Governance

• Risk assessment process defined

• Risk assessments conducted annually

• Governance board reviews exceptions

• Add Deployment Gate Checks

• Vulnerability Scans that assess compliance to

standards

Page 51: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

A SOLUTION

• Governance (continued)

• Audits conducted annually on regulated systems

• Top-down controls defined with service level agreements

• Bottom-up reporting with accountability and repercussions for failure to comply

• Changed to regulation adopted into workflows

Page 52: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

A SOLUTION

• Incident Response Plan

• Definition

• Third party organizations contracted to meet notification windows

• Practice Drills

• Actions taken noted

• Testing

• Audit

Page 53: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

A SOLUTION

• Annual Review / Recertification

Page 54: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

Q & A

Page 55: Information Security and its Impact on Project Managers · C-Suite Changes to replace upper management personnel who were responsible for security. Public Relations Campaigns to convince

Thank You for the Opportunity


The Architect is Not Convince

The Architect is Not Convince

How did the Food Administration Convince … did the Food Administration convince Americans to make ... analysis of primary and secondary sources. ... Administration convince Americans

How did the Food Administration Convince … did the Food Administration convince Americans to make ... analysis of primary and secondary sources. ... Administration convince Americans

A Practical Security Handbook for Activists and Campaigns ...€¦ · A Practical Security Handbook for Activists and Campaigns (v 2.7) This guide is dedicated to all those who have

A Practical Security Handbook for Activists and Campaigns ...€¦ · A Practical Security Handbook for Activists and Campaigns (v 2.7) This guide is dedicated to all those who have

A View from Washington: The Latest in Cyber Security Doug_DHS.pdf2010 – 1108 emails (143 campaigns) 2011 – 1312 emails (157 campaigns) 2012 – 1497 emails (102 campaigns) Targeted

A View from Washington: The Latest in Cyber Security Doug_DHS.pdf2010 – 1108 emails (143 campaigns) 2011 – 1312 emails (157 campaigns) 2012 – 1497 emails (102 campaigns) Targeted

Convince Me Unit

Convince Me Unit

Microsoft Security Guidance for Political Campaigns …...Microsoft Security Guidance for Political Campaigns Election campaigns around the world are run by fast-moving organizations

Microsoft Security Guidance for Political Campaigns …...Microsoft Security Guidance for Political Campaigns Election campaigns around the world are run by fast-moving organizations

Privacy & Data Security€¦ · information—including Social Security numbers, bank account numbers, or the names and contact information of relatives—to convince consumers that

Privacy & Data Security€¦ · information—including Social Security numbers, bank account numbers, or the names and contact information of relatives—to convince consumers that

How to convince a boardroom?

How to convince a boardroom?

How to Convince People Effectively

How to Convince People Effectively

Successfully convince people with data visualization

Successfully convince people with data visualization

Convince Woody!

Convince Woody!

Online Giving Campaigns - Keep Art Happening AE... · 2019-08-06 · Online Giving Campaigns The Arts and Education Council now ... (PCI DSS) and the Payment Application Data Security

Online Giving Campaigns - Keep Art Happening AE... · 2019-08-06 · Online Giving Campaigns The Arts and Education Council now ... (PCI DSS) and the Payment Application Data Security

Convince Your Boss

Convince Your Boss

Manipurated - Daniel Lemin, Convince and Convert

Manipurated - Daniel Lemin, Convince and Convert

Acknowledgment & Response Or, how to convince doubters.

Acknowledgment & Response Or, how to convince doubters.

Convince me

Convince me

Writing to Convince

Writing to Convince

Can You Convince Me Seminar

Can You Convince Me Seminar

Convince me! Understanding Persuasive Text

Convince me! Understanding Persuasive Text

Convince Me! The Argument Paragraph

Convince Me! The Argument Paragraph