The ever-increasing threat of cyber-attacks on organisations around the world and their potentially devastating financial, reputational, or operational impact on the business means it has never been more important to position Cyber Security as a major issue in front of the C-Suite. The C-Suite holds ultimate accountability for an organisation’s approach to risk in both setting the appetite for Cyber risk for the business and ensuring sufficient budget & resource is assigned to manage Cyber risk to within the appetite. If they are not appropriately informed of the risks associated with Information Security (IS), the organisation may not put in place the correct and appropriate mitigations to protect the organization from their top threats and risks.

Failure to effectively protect against these cyber threats can have both organisational and personal consequences for executives. For example, The Senior Managers and Certification Regime (SMR) is an FCA enforced regulation that assigns responsibility for Information Security to executive level employees, making them liable for correct implementation of cyber protections for IS.

This article will provide you with a 4-stage approach on how to better engage the C-Suite in your organisation on Information Security, to build a fruitful partnership between these executives who direct budget & resource towards Information Security and the Cyber teams who are responsible for the oversight & implementation of security.

Stage 1: Introducing the Execs to Cyber Security

In this first session with the C-Suite, it is imperative that you initiate the conversation by focusing on an introduction to Cyber Security that provides an overarching view of the organisation’s Cyber Security capabilities and operating model, that will encourage future more in-depth discussion.

Outline the responsibilities the organisation and executives have towards Information Security and how these align with the strategic priorities of the organisation & Cyber team. This should include a presentation of the top threats to the organization (both internal & external), the risks that they expose the organisation to and the existing roadmap to mitigating these risks. This will provide a high-level overview of the organisation’s Cyber capability and will set the tone ready for future conversations with the C-Suite.

Provide an overview showing the blueprint for Information Security and how security integrates and adds value to the rest of the business. It is important to include metrics that can be used to compare the organisation’s approach to Cyber Security against peers within the market. A difference in budget or team size compared to a competitor can provide guidance on whether the organisation is assigning adequate resources and budget to the issue. 

Stage 2: 360 Audit

After successfully introducing the C-Suite to Information Security, it is now essential that you lock in that second session where you can provide a more granular breakdown of the organisation’s Cyber Security capability with a clear focus on where resources need to be focussed.

Industry standard frameworks, such as ISO and NIST, should be deployed to measure an organisation’s Cyber Security maturity and provide analysis on potential improvements that can be presented to the C-Suite executives. These frameworks offer controls against which the organisation can be benchmarked, to identify areas that require maturing to mitigate risk from the organisation’s top threats. While these frameworks in their original state offer a good measurement of maturity, it is important to refine the controls so that the framework is tailored towards the organisation, taking into consideration the industry sector and regulatory environment. Wavestone recommends taking the NIST framework as a basis and fitting it to the specific stakes of the organisation to overcome any framework limitation and focus it on the businesses’ needs.

Wavestone have built our own framework, called the Cyber Benchmark, that leverages the best of industry frameworks to provide a comprehensive approach to maturity assessment with organisational & technological perspectives included. We recommend organisations follow a similar approach to accelerate their framework improvements to increasing their Cyber maturity.

Capturing the attention of senior executives to invest time & resources into developing a framework to improve Cyber maturity can be difficult. A good methodology is to provide real life evidence of their security vulnerabilities, for example by presenting evidence of how an internal ‘Red Team’ gained access to the mailboxes of the senior executives present, with an explanation of how few days it took. 

Stage 3: Programme and Framework

Once this more granular breakdown has been presented, a key priority must be to ensure the C-Suite has bought into the Cyber Security strategy & roadmap; developed using the maturity improvement opportunities identified through the framework assessment. Buy in from the C-Suite on the roadmap will guarantee the required funding & resources required to implement these enhancements.

Using the customised framework, develop a roadmap that focuses on maturing controls that will most effectively reduce the risk from the organisation’s top threats. This roadmap will become the building blocks for the security programme. The security programme should be defined so that it provides clear targets to be met to ensure compliance with the customised framework controls, beginning with a remediation approach that will guarantee a standard Cyber maturity across the organisation, and followed by steps to achieve the Cyber maturity goals. Ensuring a standard maturity across the organisation will alleviate the risk from current threats, while building on this to achieve maturity targets will reduce the potential risk from over-the-horizon threats.

Programme support can be leveraged from a specialised Project Management Office (PMO) that will supervise the execution of the programme. It is important that this PMO curates a good relationship between IT who will implement the roadmap to maturity and the business, so that the benefits are understood and extracted across the organisation.

Stage 4: Risk Quantification and Business Accelerators

The final stage of engaging with the C-Suite requires you to demonstrate the return on investment (ROI) that Cyber Security can deliver, both through risk reduction from top threats and as a business enabler that encourages expansion into new territories and engaging new client relationships.

Implementing the appropriate customised framework to the organisation and following the established roadmap to Cyber Security maturity will require an increased budget allocation. However, it is important to emphasise to the board that the return on this investment will far exceed the initial cost due to a dramatic decrease in the scale and severity of risk that the organisation is exposed to. Use calculations to demonstrate this Return on Investment (ROI) quantitively and link this to the efforts and changes delivered by the security programme. It should also be explained that this initial outlay required to deliver the security programme is far less than the potential financial, reputational, and personal (e.g., SMR) repercussions that would result from a failure to adequately protect information systems during a cyber-attack.

As well as preventing the serious repercussions of failing to protect information systems in an attack, Cyber Security can also become an important business enabler. Effective Cyber Security will ensure that your customers are retained in the event of a properly managed security breach, as well as confirming your organisation as a secure manager of customer data & details, increasing your attractiveness to new customers. A secure organisation can move swiftly into new business environments & seize opportunities with confidence that their Cyber Security maturity will be able to resist potential additional threats that may arise from this expansion; opening the door for the organisation to safely engage a wider client base.

Conclusion

Following the 4-stages outlined in this article will allow you to foster a strong relationship with the C-Suite on Information Security, ensuring they are aware of their responsibilities for Cyber Security under the SMR and that they assign budget & resources appropriately to deal with the top threats facing the organisation. The customised framework will allow these executives to understand the current Cyber Security posture of the organisation and buy in to the roadmap for future maturity. Once this vision of mature Cyber Security has been delivered, the business incentives can be leveraged to ensure the C-Suite continues to invest in developing Information Security within your organisation.

Cet article Engaging the C-Suite on Information Security est apparu en premier sur RiskInsight.

To dive deeper into IAM, our experts have created an IAM maturity assessment tool.

Interview with Anatole CATHERIN, Manager and IAM expert for almost 10 years at Wavestone.

Hi Anatole, thanks for your time! First of all, can you explain what IAM really is?

Identity and Access Management (IAM) is a discipline that sits at the crossroads of three worlds:

1. Cybersecurity strengthening: It comprises managing identities, the rights granted to these identities and user access to company resources. Each user has access confined to the limits of their role within an organization. To successfully achieve this, organizations need to know who, within their information system, can perform which actions and why. IAM is therefore an essential component of cybersecurity, especially during implementation of a Zero Trust policy.
2. Business enablement: Identity and Access Management is also a business enabler and a facilitator for successful digital transformation within organizations as it increases operational process efficiency to employees and customers. For example, IAM enables the control and fluidity of arrivals, departures or mobility by ensuring that new employee benefit from accurate accesses. In case of subsequent mobility or departure, the relevant accesses are removed and no information is lost.
3. UX enhancement: IAM facilitates a seamless user experience for employees within an organization. Moreover, the best IAM systems operate behind the scenes to enable work on arrival and enhanced connectivity based on security requirements.

Why is it so difficult to build an IAM system that works?

As you can imagine, the challenge and complexity of IAM is striking (and maintaining) the balance between security and fluidity of navigation.

To successfully implement IAM, it is important to assess the current state. With good reason, clients have difficulty measuring the effectiveness of their existing IAM system. There is no dedicated benchmark in the market evaluation.. The NIST pillars are high-level and do not cover all the challenges related to IAM; the existing benchmarks only deal with the cybersecurity aspect of IAM and ignores the impact on the operational efficiency of an organization’s internal procedures and the fluidity of the user experience.

The goal in creating the IAM Framework was to create a framework that evaluates the entire discipline and that can be used to build an efficient roadmap.

Can you tell us a bit about the IAM maturity assessment tool?

More than a tool, it’s a framework and a tool-based methodology that supports customers and provides them an overview of their IAM maturity.

The Framework enables the understanding of an organization’s current state (which IAM perimeters are deployed (or not), which IAM axes require further work, etc.). It provides an overview, with the right framework, the right angle and the right resolution to cover all IAM topics.

The maturity assessment consequently allows the prioritization of workstreams that culminates in an IAM action plan!  Thanks to this framework, we can identify the main areas for improvement, while accounting for organizational nuances by introducing the notion of scope.

In short, it meets three objectives: Evaluate, Improve and Extend IAM to other perimeters (beyond internal and service providers, with customers or partners). It was intended to be exhaustive to highlight our customers’ shortcomings and subsequently measure their progress and the effectiveness of their transformation program.

Our ambition is to make it the primary evaluation standard, entirely dedicated to IAM, with a sufficient level of granularity to cover all issues!

How is it structured?

Concretely, our tool is composed of about fifty questions that cover the 6 IAM themes:

1. Governance
2. Identity management
3. Entitlement management
4. Access control
5. Privileged access management
6. Reporting and controls

It can be used in several cases, here are 2 examples:

Can you tell us about the last time you used it with a concrete example?

We tested the questionnaire in the field through several missions, during which the use of the IAM Framework helped accelerate the process. These missions comprised:

• the definition of an IAM roadmap for a large energy company
• the framing of a migration to an IAM tool for a banking group, which allowed the measurement of gaps between their existing solution and the new one
• IAM maturity assessment for an insurance company, to identify friction points and areas for improvement and to establish a roadmap

For these three projects, the assessment grid made it possible to identify all addressable topics (regardless of whether the client was aware of them at the outset) in order to provide an actionable roadmap covering all IAM issues. In other words, the Framework can be used as an analysis framework for the implementation of a project.

We plan to launch new missions on the subject and we are looking forward to supporting new customers in their journey to improve their IAM structure!

A final word?

I will end by reminding you of the key components of the Framework:

• It is “ready to use”: the fifty questions encompassed in the framework designed by Wavestone experts covers all IAM topics
• It offers a standardized and formalized vision of its maturity on the subject of access and identity management: this assessment is also an opportunity to involve all the key players impacted by IAM: cyber teams, IT teams, internal audit teams and business teams,
• It facilitates the prioritization of actions within a transformation program:as explained above, it can be used at different times and can therefore be used as a support for a broader reflection,
• Finally, it is a flexible means of use: It can be used at a very high level (a strategic level) or to develop very specific actions.

Want to evaluate yourself? Please contact us!

Cet article [INTERVIEW] IAM Maturity Assessment – Where do you stand and why is it crucial? est apparu en premier sur RiskInsight.