Demystifying CyberSecurity & BScDA, CPA, Preparing for the - - PowerPoint PPT Presentation

Demystifying CyberSecurity & Preparing for the Board Room

Rick Ouellette, BScDA, CPA, CGA, CISA, CISSP, CGEIT

Find me on LinkedIn: rick-ouellette-5b1573a

Source: https://cdn-images- 1.medium.com/max/1600/1*Yac5ryyS0kdQvSxSwoUscQ.png

Consider Perspectives

We Need To Work Together

Source: Rick Ouellette

We need a simple formula –

To focus ourselves & collaborate

Foundation

• f

Accounting A=L+OE Assets = Liabilities + Owner’s Equity Foundation that enables finance performance measures

Foundation of Risk Management

T – VM = R Threats – Vulnerability Management = Risk Posture Foundation that enables risk management performance measures

Key Document: Institute of Internal Auditors - “GTAG 6”

Vulnerability Management

80 / 20?

Source: IIA’s Global Technology Audit Guide – Managing and Auditing IT, 2006

Vulnerability Management Highlights

Performance Management -

Leading and Lagging Indicators

CyberSec VM Performance Management

Leading Indicators

Before

Lagging Indicators

After Balanced Scorecard SOMIA

(measure)

Corporate Alignment

Now

VM Capability Components

• People
• Process
• Technology
• Information

For Example, Leading: People

• 52 work roles in the NICE Framework (next slide)
• Do we have the required roles defined?
• Do we have the required functions mapped?
• Required experience, skills and certs defined?
• Roles filled?
• 100% filled with 100% of experience, skills, certs?
• 50% filled with 70% of essential qualities?

Source: http://www.auditscripts.com/free-resources/critical-security-controls/

VM: Critical Controls Self- Assessment

Lets Bring It Home……… Build a Bridge to The Board

Source: https://corpgov.law.harvard.edu/2017/06/27/ten-questions-every-board-should-ask-in-overseeing-cyber-risks/

K e y

Examples from -Ten Questions Every Board Should Ask in Overseeing Cyber Risks

Quoted from the Harvard Law School Forum on Corporate Governance and Financial Regulation

• 1. Has management given serious consideration to how much of the budget and how much

staff is adequate for proper cyber risk management?

• 2. Has management taken steps to mitigate the cybersecurity risks associated with
• utsourcing business functions to third parties?
• 3. Has management installed adequate technology not only for preventing the downloading
• f malicious software but also for detecting and alerting the organization to attempted

breaches?

• 4. What steps does management take to safeguard sensitive non-digital information?

Bridge to the Board’s Perspective

Thank you!