good afternoon and welcome to this
week's serious security Symposium from
Purdue University before we start I want
to ask you to please mark your calendars
for the 24th annual serious cyber
security Symposium our signature event
this year will be an in-person event at
Purdue University on March 28th 29th it
is open to the general public uh the
agenda has not yet been posted but will
here within the month and we're looking
forward to to the event it'll also
coincide with the 25th anniversary of
Sirius
so with that I am pleased to kick off
this session Gideon Rasmussen has a long
history in the cyber security industry
dating back to his military career
before we called anything cyber his
experience includes a number of security
positions in several Industries within
the commercial within commercial
companies he's a prolific LinkedIn
poster where he and I first became
friends as I started following his many
thoughts and realized that I saw my
found myself nodding my head to many of
the things that he was sharing so he
shares his thoughts and insights often
on the evolving field of cyber security
I encourage you to take a look at him
he's known online as the virtual CSO
which is also the name of his consulting
company he spoke at the serious security
seminar a bit over a year ago and we're
delighted to have him back today to get
in welcome
terrific thanks so much Joel so we're
gathered here today to speak about
program maturity and
within the cyber security and also
operational risk context so a little bit
of a different flavor there
we're going to move quickly through the
agenda and cover a great deal of
information we're going to start with
minimal compliance and pivot into common
controls and then risk management and
finally strong risk management which is
for companies that have very very low
risk tolerance
we will take some time to talk about
influencing funding so that's part of
really the strategy beyond having a
maturity model is you have to get the
funding and support to move through
those different tiers I am speaking
today to cyber security students as an
audience
and I will be using U.S Air Force crash
course format so we're going to move
very very quickly the good thing is that
this session is being recorded and if
you'd like to send me an email or a
LinkedIn message at the end I can also
get you a copy of the slides so just let
the information wash over you and you're
going to have access to the deck and to
Links within the deck after the session
has concluded I will ask you to hold
your questions until the end but you can
use the the zoom feature
to
um create a question within that queue
and we'll get to it as we start to
conclude this session
so let's talk a little bit more about
program maturity within cyber security
and and operational risk management so
level one will be minimal compliance and
some organizations start there
um you might have a startup company
um or you may just have an organization
that is at a lower level of maturity and
typically minimal compliance will be
with some sort of control framework like
then this cyber security framework
or there may be some minimal compliance
to laws or regulations
next level two we have common controls
so the control Frameworks are not meant
to be very very specific or prescriptive
so there are controls that were all
accustomed to within cyber security such
as a web application firewall
which will fall into this second level
of maturity it may not be called out
explicitly in the control framework but
these are controls that as cyber
Security Professionals we expect to see
in place and we view them as necessary
level three is risk management which is
called for and and most of the control
Frameworks and laws and regulations but
may sometimes be skipped over in
practice so we'll get down a little
deeper into what types of
analysis assessment and mitigation
should be in place and then finally
we'll get to level four strong risk
management and again this is typically
for organizations that have a very low
risk tolerance think financial
institutions
federal government and then also
pharmaceutical companies
so starting with minimal compliance
maturity level one most organizations
will use either than this cyber security
framework or internationally it's more
likely that they'll use ISO 27001
I'm a proponent of the cyber security
framework it's 108 controls which
provide a foundation so we'll have a
requirement for example for encrypting
data at rest but I also like the
presentation layer that it provides for
executives so if we were walking over to
an elevator and we were to get into the
elevator with an exec and they were to
ask tell me about our cyber security
program
you could say something like
first we look to identify risk to the
organization and then we deploy
protective controls to prevent
cyber security issues we detect
suspicious activity and then we respond
uh either with an incident response plan
disaster recovery
and or crisis Communications and finally
when we recover we look for things like
root cause analysis to reap to prevent
reoccurrence so if you notice there I
didn't really get deep into technical
controls or some of the traditional
domains of information security such as
access control or physical security and
it's for good reason if we're talking to
a business leader who spent most of
their their life in accounting as an
example be before becoming a CEO we
start to leave them behind if we get too
far in the weeds of cyber security
also at this minimal level of compliance
it's necessary to include
requirements from laws regulations and
contractual obligations such as the PCI
Data security standard if your
organization stores processes or
transmits
payment card or credit or debit card
numbers
be mindful though when you think in
terms of laws
Etc from regulatory bodies that they're
biased towards their interests so as an
example the payment card brands that
require adherence to the PCI Data
security standard only care about the
security of their payment card numbers
and and if your organization has some
sort of disaster and cannot recover
that's not really a concern to them so
it's important to really focus on your
organization rather than minimal
compliance
so still at this first tier of minimal
compliance I did want to take a little
bit of time to talk about data
management because oft times it's
overlooked or may not be done well and
obviously we need to know where our data
is as a first step if we're going to try
to secure it so oftentimes when I first
get involved with an organization I'll
ask for a very very high level view of
what types of data we have and where
it's stored so you see the data
repository field
it's also good to understand not only
the types of data that we have
but the volume of it so if we have a
very small volume of data and a data
repository we may
place a higher priority on on a
different area that has similar
sensitive information and significantly
more records
and then we we get a little deeper into
data management with the data owner who
would be the person or the role that
would give permission for data to be
stored in a certain area for example
they would give permission before moving
it outside of our on-premises I.T
environment to a vendor environment and
then also you have the data custodian so
that's the role that's responsible for
protecting that information
thank you
[Music]
so to get a little deeper Beyond just
having a system or application inventory
we'll talk about having a configuration
management database and
some fields that I recommend so first
off it's good to have an understanding
of the system contacts in the event that
we need to take the system down to patch
it or
um
we're responding to some sort of an
incident it's also good to have
management and Tech exec contacts in the
events that we need to escalate so if
we're having difficulty either getting a
patch installed getting the maintenance
window for that or we have a custom
application running uh in this
environment and we're trying to get a
code fix uh created and tested
in a critical situation then it's
important to be able to reach out
potentially to the management and Tech
exec contact to get that priority and to
get that response to them we can also
obviously
have specific metrics and reporting that
then goes to the right people associated
with the systems and applications you
can see on the left side towards the
bottom there the application record
that's meant to be a link So within a
configuration management database you
can come in on an infrastructure record
maybe a server or a virtual machine and
then click over to the application
record or you could come into the
application record and connect to the
information about the underlying
infrastructure production status is this
a production system is it Dev and then
you can see some more risk-based
information in the right Fields so uh
business criticality uh does this system
need to be up on five nines
is it internet facing is it vendor
hosted what types of data is on it and
then you can see that the CI data
certified by and certified date CI is
configuration item so we're going to
want someone at least once a year
typically the system owner to look at
this record and see if it still currents
and if it needs to be updated oftentimes
you might have someone move uh into a
different role so maybe the alternate
system owner or one of the data owners
has changed that during this process the
system owner would update that and that
would be the new certified date
it's also important to use some sort of
Discovery tool to detect new systems as
they come up online especially with VMS
and in in Cloud environments and also to
use some sort of Discovery tool to
detect unstructured data in areas where
we don't expect it so that in the
Privacy career field they talk that talk
about that as data linkage so if we
expect
primarily our sensitive data to be in
our production environments and maybe we
might have some sensitive data on
laptops and we have we're finding it all
over the place then
we want to make sure that we get it to
the areas where we expect it where we
have enhanced security controls so so
some additional thoughts around
inventory there
so level two we're going to talk about
common controls quickly so again control
Frameworks such as then this cyber
security framework or ISO 27001 are not
meant to be prescriptive or very very
specific so that leaves what I would
refer to as gaps that we need to fill
um and and typically we start to fill
the gaps with common controls so some
examples of controls that you will not
see explicitly called out and then this
cyber security framework or patching
penetration testing having a phishing
test program having a security
operations center and or active
monitoring by cyber Security
Professionals 24 7 365. so as I
mentioned those controls to you
they're not Arcane They're Not Unusual
we would by and large expect them to be
in place in an environment that hosts
sensitive data
so those are some examples and some
easier ways to identify gaps rather than
just by our experience or knowledge is
to look at something like the center for
internet Securities critical security
controls listing and we may decide okay
one we're going to call out some of
these controls because they're already
in place but also
maybe something like a web content
filter isn't in place today and that
kind of reminds us that we think we want
to get to that maybe next year or the
year after that
I did want to talk about risk-based
deployment of controls so we're not just
going to have a cyber security control
and deploy it everywhere ideally what we
do is if we're adding controls to the
environment we're adding them based on
risk severity so I'll get into an
example for web applications so
in in this model we're saying
we're going to conduct source code
scanning of all web applications
throughout the organization
and for those applications that store
process or transmit sensitive data
we're going to have source code scanning
and we're going to add as a second layer
of dynamic application scanning of those
web apps with sensitive data
and for internet exposed web
applications that host sensitive data
we're going to have all three of those
bullets so source code scanning Dynamic
application scanning and penetration
testing so you can see as
the perceived risk grows we're going to
deploy controls in that manner and as I
go through this common controls
maturity level two
I'm quite certain that those of you on
the line are are seeing these as
necessary controls the really common
sense if you're familiar with cyber
security and really all we're doing is
filling holes in the control framework
and this is basic due diligence so
nothing to be proud of but we do need to
go that second layer Beyond The Bare
Bones foundational controls in a control
framework
so let's step into maturity level three
risk management and I did want to call
out examples of how control Frameworks
actually call for risk management there
are times in the industry where people
will say that control framework is
compliance and it really doesn't
address risk and I I don't agree with
that and we're looking at uh I guess six
controls on the screen from the cyber
security framework requiring risk
management processes
organizational risk tolerance and we're
gonna have a slide on that next
uh but also really to have some sort of
risk analysis risk assessment and then
prioritized risk mitigation
so from a risk management perspective we
really have four options we can accept
risk and typically that's done with a
risk registry entry or plan of action
and Milestones which is more on the
federal government but if we have a risk
register entry or a poem
we're going to make sure that we have a
thermal process around that and the
right levels of management are signing
off based on the risk severity
we can also avoid risk so there are
times where a line of business or a
business unit will say I'm not doing
business in that country their decision
risk mitigation is something that we're
much more accustomed to in cyber
security so as an example we'll run a
vulnerability scan and we need to
remediate that within standards and
oftentimes we'll patch or will apply a
configuration within infrastructure
and risk transference with as fast as we
need to go during this presentation the
easiest example I could give you is
cyber security insurance
so let's talk about a risk tolerance
statement which is alluded to in one of
the cyber security framework
requirements and this is really
management or senior Executives
conveying tone from the top when it
comes to cyber security
so in this example management is saying
they have a low tolerance for external
intrusions and operational risk
a moderate tolerance for compliance risk
so we're not just going to adhere to
every compliance requirement uh that
were subjected to we may take some risk
there
trying to keep that balance between what
controls are required and what
additional controls are we going to
deploy on our own and that sometimes
leaves compliance requirements that
we've addressed a different way would be
an example
also legal risk so in this case
management is saying in in some rare
cases we may need to go to court uh over
something like an unenforceable contract
and we'll accept that risk but again
management pivots back and says
reputational risk we only have a low
tolerance for that so what's great about
a risk tolerance statement is if it's
not in place and as cyber Security
Professionals or leaders we can convince
executive management to publish
something like this when we come back
for funding or we need to implement a
new control we can tie it back to this
tone from the top
I do want to talk about threat landscape
and controls analysis which is a very
simple methodology that I I've created
and you're welcome to use and really
the idea behind it is we start from
business and I.T Executives side of the
table and we spend a good deal of time
in their space before we gradually
transition to cyber security so if you
think about many of the assessment
reports that are out there there's one
page which is an executive summary and
and sometimes that can leave a foul
taste in the mouth of Executives so
let's jump into it
so we start with inherent risk of the
organization so what is the company
profile what industry is the
organization in what types of digital
physical assets does does the
organization have and logically what
types of potential adversaries do we
have that want to take
control of those assets
then also we start to think about the
adversary right so what are their
techniques for compromising data what
are their capabilities
oftentimes they will leverage the cyber
crime ecosystem so if they reach an
impasse where they can't get by a
certain control they may leverage or
contract with another criminal
organization to get in
let's talk a little bit about potential
impact and we can leverage reputable
sources like the Verizon data breach
investigations report or acfes
occupational fraud report which also
comes down annually
and then we'll talk about risk tolerance
now hopefully you've convinced the
executives to put out a risk tolerance
statement and that's a copy paste right
so we could take that last slide and put
it right into this section of the report
and now finally we're starting to Pivot
into
risk mitigation so we want to be fair
and balanced in this analysis so we're
going to start by saying here are the
the preventive and detective controls
that are in place that mitigate or
reduce the risk that we've been talking
about so far so we're going to talk
about protection boundaries and that's
really the data repositories where most
of our sensitive data resides
what type of control framework are we
using so we mentioned this CSF ISO 27001
and then at a very high level what are
the risk assessments so
annual audits assessments uh
vulnerability scanning pen testing so
it's not all just in that assessment
risk assessment space but by and large
what kind of uh controls do we have in
place to identify risk and obviously we
start to address that then so finally
towards the end the final section we
talk about the residual risk so we went
all the ways from what type of company
do we have what type of adversaries what
are their capabilities uh how do we
mitigate risk in a good way right and
the residual risk or recommended
controls where do we have room for
improvement so I've used this really
simple way it's more like a presentation
layer of an assessment and it really
resonates uh with Executives so I
welcome you to try that As you move
forward with your careers as well
so let's talk about
attack Centric controls and and kind of
that Focus right in in Risk Management
so we're going to talk briefly as we go
from top to bottom about how an
adversary May gain access to an I.T
environment
find sensitive data and try a few
exfiltrate it or export it from the
organization and we want to have
controls in place that make that
difficult or at the very least detect
that suspicious activity
so first off an adversary is going to
want to deliver malware and I think most
of you on the line know that that's
oftentimes by a phishing message a
social engineering email uh with a
malicious link or a file attachment that
helps that adversary get a foothold and
gain access to a system within the it
environment
so that the next row the adversary has
gained system access so
how can we make that difficult right so
one we want to make sure that end users
do not have
administrative access to their
workstations to their company owned PCS
or laptops because if malware gains a
foothold and someone's logged in as
admin
it's going to be more effective that way
then we need to make sure that there's
some sort of advanced endpoint
protection in place commonly referred to
as EDR and xdr now but really good
endpoint protection to protect against
malware and then also integrated with
log monitoring and event correlation or
a Sim
foreign
of allow listing which is software that
only allows known software and
executables binaries to run on the
system so if malware and or ransomware
gets introduced to the system
the allow listing software won't let it
run so a terrific way to bolster your
security there and then having
two-factor or multi-factor
authentication for servers is another
good approach
so next with the adversary having gained
access to one system thankfully they
probably don't have access to the
sensitive data that they need yet
so they're going to try to Pivot and
move laterally east to west across the
network so how can we make that
difficult Well Network segmentation
right so let's say we have
payment card data or research and
development data if we have that
sensitive information on its own
networks and we require a second level
of authentication that's going to make
it difficult for adversaries to get to
that data so to give you an example if
if I've met if I'm meant to have access
to that research and development data in
the morning I log into the network on I
really just have access to the common
use Network and how to get to that
research and development data I have to
authenticate to a jump box or a Bastion
host hopefully we've got multi-factor
authentication for that too and now once
I've got that second layer of
authentication completed I can get in to
the that secondary Network that
segmented and I can access the research
and development data
so next row down data exfiltration so at
this point the adversary has access to
sensitive data uh or a bad day is
getting worse right so this could also
be Insider threat right so we may have
an authorized user that has access to
sensitive data and they want to export
it or exfiltrate it so how could we make
that more difficult well granular source
and destination firewall rules and I've
got to step away from this a little bit
because we could really get dragged down
into
a a full morning long presentation a
day-long presentation where we just
talked about
how to adversaries exfiltrate data from
an I.T environment and how might we
prevent that right so obviously we want
to make sure that people can't plug a
USB drive in we want to prevent uh
access to personal email like Gmail or
going out to things like Dropbox but
unfortunately I don't have time to cover
more than that but it's important to
research how adversaries conduct data
exfiltration and how to prevent that
so next we we do have an adversary in
the environment we want to detect them
so some ways to do that are threat
hunting right so
um this is where we have qualified
Security Professionals that uh access
the SIM and we're you know we're
searching through blogs and events and
we're trying to find signs of the
adversary so rather than passively
saying
we've got endpoint protection and we've
got the Sim logging and event
correlation it's just automatically
going to notify us if there's an
adversary we really need to look and we
can do that leveraging um cyber threat
intelligence data from organizations
like sisa
it's also good to take a look at the
miter attack framework if you haven't
already
um it speaks about adversarial
techniques uh tactics and procedures
um so next we've at we've
identified an adversary in the
environment and thankfully we have our
incident response plan hopefully it has
scenarios it's not just generic right
and we leverage our incident response
plan to find
what access is the the adversary has and
eradicate them from the environment and
prevent them from getting back in it's
important to have incident response
exercises so we're not doing this for
the first time when we find an adversary
did want to discuss emerging threats and
countermeasures right we absolutely need
that in Risk Management so each time I
do this presentation I update it so
here's a couple of recent alerts from
sisa so one is around weak security
controls that are exploited for initial
access uh so it's great to get these
alerts and advisories from sisa and to
go in and see what our threat actors
doing today and what are recommendations
for controls to either prevent that
access or at least identify it and
respond
we also have another alert where there's
an exfiltration tool that was used to
steal sensitive information from a
defense contractor so I don't care
that I I'm not in a defense contract or
organization I want to know what are the
adversaries doing
um they use those tools and pass them
around so it's good to know what's going
on now with these threat actors what
techniques tactics and procedures they
have and then to take action internally
I I have some bullets there at the
bottom because there's a fair amount of
times where I'll work with security
teams and sure enough everybody's
subscribed to the sisa advisories and
alerts but the question is you know if
you've got five or seven people that are
all thinking the other person's doing
something do we have a process where
when each advisory comes in each alert
comes in we look through it and we
decide at a high level what if this
applies to us what actions should we
take and then to make plans to do that
you may have one or two things that
you're going you're saying I'm gonna do
right now and maybe have a to-do list or
a list of things that you may do this
year or next year it's great to hang on
to the things that we can't do today and
these advisories but to use the moving
forward
and I do have a link there to more
information and advice on how to set up
a cyber threat intelligence program
I did speak to you about risk register
entries and this helps to influence
mitigation of cyber security risk issues
it prevents skeletons in the closet so
if we become aware of a risk and perhaps
we have maybe
um an I.T executive you know an app
executive whomever that says that's fine
you know we're not going to deal with
this right now we'll do deal with it
next year terrific let's fill out a risk
register entry and we'll get that into
the risk governance process and we can
talk about it and sometimes just that
hey we're going to fill out a risk
registry entry and it's going to be seen
by other layers of Executives sometimes
that will spur on remediation and if not
these risk register entries either
document risk acceptance that's
typically something that's low risk high
cost
um or it can be used similar to a plan
of action and Milestone to say we are
going to mitigate this risk here's
Milestones here's the five steps which
bring us to this target remediation date
quickly here is a risk register process
diagram typically risk is identified in
the cyber security Realm by the infosec
teams though sometimes the process owner
and really what we're going to do is
work with that process owner to create a
risk registry entry this is outside of
vulnerability scans it's something else
um and when it comes to step six they're
in the risk governance swim Lane
executive leadership May rarely say look
we want you to do some more research we
want you to revise this and come back
or they may say risk accept low risk
issue high cost we'll review it in a
year or they may say we agree with your
risk mitigation plans here we we may by
the way be asking for some funding or
Staffing priority in this process but we
agree with your plan to risk mitigate we
agree with your three to five uh
Milestones or steps to get to that
Target date and then you can see when
remediation is said to be done we have
infosec confirming that that the
notification goes out that that issue
has been closed
heading down the home stretch of this
presentation so strong risk management
typically this is for financial
institutions government entities
pharmaceutical companies very low risk
tolerance
um one I would suggest that you should
not have the Cyber Security executive or
leader
um reporting into a CIO or a CTO because
it's a conflict of interest uh the the
cyber security leader should report into
someone like the CEO the chief risk
officer or the board of directors it is
important to have cyber security metrics
key performance indicators key risk
indicators and really that provides risk
transparency to the executives but it
also helps us influence risk mitigation
and sometimes funding for our program
I do think it's important for the cyber
security leader to provide updates
um to the board of directors or similar
executive group like a cyber security
committee
also
I think it's important for the the cyber
security program to not just stay at the
Enterprise level where we're comfortable
as cyber Security Professionals right or
we're talking about systems and and
networks and applications but we get
down into understanding what are the
business processes
um what are the services that the
business units the lines of business
have and
do we have the right types of cyber
Security fraud prevention controls in
place so to get to that next level and
and prevent something negative from
happening
also to be involved in things like fraud
prevention and privacy which are a
little bit peripheral to cyber um we
definitely have a role to play there
and I'm a fan of iia's three lines of
Defense model which says that the first
line of defense is operational
management right so that might just be
I.T or the average employee they are the
first line of defense developers of the
first line of defense second line is
risk management functions like cyber
security like privacy like the fraud
prevention team also compliance
functions and then the third line of
defense is internal audit
I also think it's important to have
self-identified audit issues as a
requirement uh perhaps we're saying
operational functions in line of
business have to declare self-identified
audit issues
two or four times a year and it just
reinforces that it's not just the
Securities team or internal audits team
job to identify risk
everyone has that responsibility in that
first line of defense operational
management
you've all heard about zero trust uh and
it's an architectural security model
um so that's an important place to get
into uh people have challenges with it
because as an architectural model it's a
little bit high level right and then
also that gets complicated because
vendors will say hey we've solved for
zero trust they haven't so on my website
I have a listing of 134 controls and
it's not meant to be a control based one
for zero trust it's more I've had people
say to me
I'm really struggling with the
architectural piece what's what am I
selecting from like
how do you make this real so I've had
some ideas of here are some controls
that you could select again not meaning
to solve for zero trust
Carnegie Mellon has
um 21 practices to establish and
maintain an Insider threat program
really
strongly encourage you coming out of
this to take a look at that as cyber
Security Professionals uh it's an online
book in PDF format it's about 200 pages
but carry this with you throughout your
career because we do need to be mindful
that there are authorized Personnel
employees and contractors within our
organization that may either seek to do
harm to the organization or to
exfiltrate data
a little bit more this is from miter
talking about Insider threat monitoring
uh I do want to hit on some of the
themes that they talk about so in
Insider threats routinely used
unsophisticated techniques tactics and
procedures to access and exfiltrate data
specifically they're using removable
media so we need to make sure in our
companies and corporations don't allow
people to plug in a USB drive and just
take a gig of data out on it uh on a
drive like that
also email is a common exfiltration
channel so I would recommend blocking
access to things like Gmail and then we
need to monitor outbound email from the
corporate authorized accounts that all
employees and contractors have
also cloud storage is used for
exfiltration so blocking things like
Dropbox and then maybe we have
exceptions based on business need but we
mitigate a lot of that risk I mentioned
threat hunting before again we could
have a morning or a whole day on threat
hunting but
actively searching for adversaries in
your environment we can start by looking
um for suspicious events in our logging
indicators of compromise so you'll get
an advisory from cisa that says here are
some of the malicious IP addresses
also tactics techniques and procedures
so we talked about seesa alerts and
advisories there's also the miter attack
framework and then hunting based on
hypothesis so an example is we know that
sooner or later we're gonna have an
employee that's seeking to export data
and take it to their next employer
what would they do
what would that look like what
preventive controls could we put in
place and then one of the things I love
about hunting is it feeds security
monitoring so you have ideas coming out
of that and you say you know what
we need to put some extra alerts into
the SIM
I think this is one of the final slides
in in the DAC so very important for you
as cyber Security Professionals and
students to learn how to influence
funding and it's going to be different
uh for different organizations
um depending what industry you're in and
then also
who are your Executives what what are
their drivers what motivates them
so some examples of ways to influence
funding for your security program for
new security controls and or Staffing
if you're in uh a financial institution
federal government Pharmaceuticals
sometimes it's just compliance and if
you can tie a cyber security issue or
vulnerability
um to one of the many regulatory
requirements you may be able to get
funding to get that resolved uh
operational risk so
those types of organizations also care
about that operational risk may be more
meaningful to a privately owned company
but we talked about risk tolerance
statement metrics kpis Kris having
assessments done by an external firm uh
an assessment report is a
non-repudiation vehicle right so an exec
can say I don't remember that
conversation I don't remember that email
it's hard to say I don't remember the
assessment report
also things like table top exercisers or
wargamings or uh War gaming or you
involve your senior leadership team they
get put under stress right when we're
simulating that there's an incident
going on they don't want to experience
that stress in real life may get you
some funding be careful with asking for
additional Staffing and saying you don't
have capacity
um if you ask any manager they're going
to say that they're they're understaffed
right so some ways to go down that path
if every one of your employees has 10
primary and Alternate duties
and those all look important you might
be able to convince an executive you
don't have enough staff also if a lot of
the work is documented in tickets you
may be able to use that ticket data
based on the volume and hours to get
some staffing here's some more subtle
things if continually you you as an
individual contributor in cyber security
or a leader uh are planning and
executing on your goals and delivering
you may get funding in part because of
that the execs know you know what if I
give money to this person or this
manager I know I'm going to get return
out of it Communications routines don't
just ask at the end of the year for your
funding you want to participate in
program updates meeting routines and you
know give an update every month of
what's going on and what the risk is and
what type of support you need have some
one-on-one meeting strategically with
Executives and then Financial Acumen
realize that right around at this time
of the year Executives have use or lose
money so if they don't spend it they'll
lose it at the end of the year and also
it will hurt them because next year if
they're asking for money and they didn't
spend all of it this year they're going
to take a haircut or get less funding in
their new budget so I used to years back
I had an executive and I used to kind of
stick my head in his door frame and say
got any money I've got you know three uh
invoices from vendors and and I'm ready
I'm ready to execute and spend that
money and sometimes I was successful
so with that Joel we've reached the end
of the presentation and I think we can
open it up and see what questions and
comments we have
we can thank you getting there one
question did come in on the Q a feature
uh from one of our PhD students so how
do you get by
sorry how do you get buy-in from
security teams that may see these
compliance efforts as box ticking
exercises
well I think it's important to be able
to articulate
compliance requirements from a risk
perspective and in general
most of them have some value in in terms
of how we're going to prevent
um a security issue from happening or to
to detect it
um there may be some cases where what
they're saying is legitimate though
um so if one of the things about PCI
compliance the way that payment card
security is done is there can be
compensating controls but we've got to
make sure that if we're saying we're not
going to cover One requirement we're not
citing another requirement that really
doesn't address that issue but in answer
to that question I think it's a fair
thing for the security team to say pay
your box ticking on
um final Integrity monitoring we've got
vulnerability scanning running we've got
many other ways of determining some sort
of issue file Integrity monitoring is
this Antiquated control and you know
what I might tend to agree with them so
be always be ready to see the other side
of the table will be part of my advice
yeah great answer um my take on this
because the idea of box ticking you know
oh you're not really making yourself
more secure your ticks and boxes
granted right I I also do usually try to
share is that well the reason that those
boxes are there is to make you think
about these things that sometimes you
may skip over so yes there is a
difference in just trying to do box
checking but but the reason those boxes
are there hopefully lead you towards
actually making sure you make some smart
decisions so I agree with your answer
there very much
um we are right at 5 20 which is the
official end time of the class uh if a
question comes in before I'm done
rambling here we'll be glad to get it in
here uh because we know a lot of people
typically will budget until 5 30 on this
anyways but as as we do wrap up I do
want to again uh say Gideon thank you
very much it's always great to have you
uh while this is a four credit class a
gradual level lecture class at Purdue
University uh the public is encouraged
to tune in uh and those who do so can
actually get continuing education nation
and I know that's a concern of yours as
well with as many letters as you have uh
designating the certs that you have on
this so we're pleased that the the
general public can tune into this
um and uh we uh again appreciate you
taking the time and I know that in
seeing you speak elsewhere and from our
conversations that I do hope that we are
able to get you back here in another
year or so to cover another one of these
topics that are not only uh great uh
things for our students to learn but
also for those in general in the cyber
security industry to take take interest
and take note of as I started with your
introduction I encourage all of our
attendees and participants to seek you
out on social media especially you're a
heavy um a posting that goes on on
LinkedIn where I follow you very closely
and I want to encourage everybody
getting included please show up again
next week live as Christine task a very
proud graduate of the serious program at
Purdue University uh we'll return home
air quotes will return home to to give
our our seminar again next week so with
that thanks very much and we'll see you
next week bye-bye
thanks so much Joel