Panelists

The Security Dashboard

Visualizing IT and Business Risk

Information Security DecisionsOctober 6, 2004

Panelists

Pete Lindstrom, Spire Security

Shon Harris, Logical Security

Bill Boni, Motorola

Moderator: Andy Briney, InfoSecurity

What’s a Security Dashboard?

Dashboard Wish List

1. Simplifies the management of operational and IT security activities.

2. Correlates data from multiple sources and turns it into actionable information.

3. Maximizes technology investments by integrating with existing products.

4. Measures compliance with accepted practices, internal standards and government regulations (ISO 17799, GLBA, HIPAA, Basel II).

5. Tracks vulnerabilities and remediation status.

6. Prioritizes remediation activities by business impact.

7. Maintains historical information for trend analysis.

8. Maintains prioritized remediation action plans.

9. Facilitates communication between the Business, Information Security, Operations, Audit/Compliance and Risk Management.

10. Produces a meaningful management console/dashboard.

Source: Steve Katz

In a Nutshell…Asset discovery and management

Vulnerability remediation

Threat correlation and assessment

Compliance/policy management

Reporting/audit

Prioritizes risks, remediation workflow

Treats operational risk as a lifecycle

How realistic is Andy’s wish list?

1. It’s real: I’m running a management system that

does most of this

2. Likely to happen, but not for a few years

3. Unlikely to happen in the near future

4. What you’re asking for is impossible.

5. I dunno enough about this to have an opinion.

Now, for a dose of realityDASHBOARD OBSTACLES

Poorly conceived and executed risk analysis models and processes

Constantly changing risk environment

Evolving (immature?) technologies

Immature communications protocols and standards: No lingua franca

Poor understanding of relationship of technical risk to business risk