Managing Risk and Information Security: Protect to Enable (Second Edition)

Front matter

Protect to Enable

Second Edition

OPEM

Foreword

Security and first-person shooter video games have one obvious thing in common: if you re not continuously moving, you're dead. In this second edition of Managing Risk and Information Security, Malcolm Harkins helps us move our thinking into areas of risk that have become more prominent over the last several years.

Because there is so much new content in this edition, I will focus on a topic that has risen to greater prominence since the first edition: people are the perimeter. When we reflect on what has changed in recent years, with an eye to the vulnerabilities that result in real-world compromises, a pattern emerges: virtually all the major breaches that we have seen involve manipulation of people. When nearly everyone has heard of phishing, we have to ask ourselves: why is it still such an effective tool?

The obvious theory is that we haven’t managed people risk as well as we should. Perhaps we have been standing still and need to learn how to dodge and experiment with the way we drive better people-security outcomes. Unfortunately, the path is not 100% clear. Unlike technology, the field of influencing human behavior in security is remarkably complicated and supported by limited research.

Malcolm provides us with a great foundation and framework to build our “security engagement” functions. I like to use the word “engagement” because it speaks to how the security organization relates to the workforce in a manner that isn’t simply bounded by the more traditional term “training and awareness.” Engagement encompasses anything that shifts the desired behavior outcome in the direction we want it to go. I have seen remarkable shifts in measured behavior from the use of non-traditional tools such as security gamification and simulation.

The way Malcolm differentiates between “compliance” and “commitment” is key. Managing Risk and Information Security is an ever-evolving classic in the field of security management.

—Patrick Heim Head of Trust & Security, Dropbox

XV

Praise for the second edition of Managing Risk and Information Security

We assign Malcolm’s book to our Carnegie Mellon CISO-Executive Program students on their first day of class. It is relevant, pragmatic, and solution oriented. Our adversaries are changing their practices and so must we. Malcolm’s book is a terrific tool for the modern-day info sec leader who wants to shift from security as a restriction to security as a business enabler.

Malcolm is a top-notch executive, security leader, and innovator, with a keen ability to convey thought-provoking and valuable insights. His latest effort demonstrates remarkable foresight into the skills necessary to excel as a security leader today and tomorrow.

—Clayton J. Pummill Executive Director, Security Advisor Alliance

I could go on and on about what I liked specifically—there was much, including the discussion about governance models and social responsibility—but here is the net: this is the first time I’ve seen someone be able to speak to security specifics while also raising the conversation to a much higher level. It begins to take on an Alvin Toffler feel from his astounding book, The Third Wave. Malcolm’s thoughts are philosophically sweeping while at the same time imminently practical.

—Todd Ruback, Esq., CIPP-US/E, CIPT Chief Privacy & Security Officer & V.P. Legal Affairs, Ghostery xvii

PRAISE FOR THE SECOND EDITION OF MANAGING RISK AND INFORMATION SECURITY

Malcolm Harkins is a foremost expert at managing risk and information security. In this latest book, he further expands his Protect to Enable philosophy and does so in a way that offers practical and actionable initiatives that any risk manager or CISO can implement to protect their enterprise while enabling business growth. A must-read for CISOs and their teams!

—Tim Rahschulte, Ph.D.

Chief Learning Officer & Content Officer, Evanta

Malcolm Harkins is a visionary thought leader on cyber security and risk management. Managing Risk and Information Security is a must read. Malcolm helps readers immediately take the information and apply it to their own organizations. You will find that this book cuts through the fog and provides a clear picture of where and what to focus on to effectively manage cyber business risk.

—Phil Ferraro Global CISO and Cyber Security Consultant

The CISO is more than just a technology expert; she must be savvy about leadership, influence, and change across complex organizations; someone who sees her mission not to just drive implementation of a large system, but to foster sustainable culture change at every level. As an organizational psychologist, I recognize Harkins’ keen eye for group dynamics and leadership tactics that enable CISOs to enhance enterprise security. He puts his finger on the habits, assumptions, and decision processes typical of many employees and teams, as they unknowingly increase security risk, and for that alone this book is a gem. It should be required reading for aspiring CISOs and for anyone who has a role in the recruitment and hiring of CISOs.

—Marc Sokol, PhD Executive Editor, People + Strategy

Malcolm Harkins’ take on information security and risk is a refreshing change from the increasingly frequent alarm bells raised in the press with regard to the “brave new world” where technology is presented as an ever-escalating conflict between our seemingly insatiable appetite for connectivity, cool applications, and customized information, on the one hand, and a desire to control who has our information and how they may use it, on the other. Harkins instead offers a cool, clear-eyed perspective where managing information and risk are placed in a wider context. His prescriptions and frameworks are recipes for well-managed organizations in the broadest sense. They allow us to embrace our new-found xviii

PRAISE FOR THE SECOND EDITION OF MANAGING RISK AND INFORMATION SECURITY technological abilities without fear because we have defined their purpose capaciously enough to be a positive good, to be of service to alla company’s stakeholders. That is, once we set a truly human course, technology serves rather than threatens us. Organization purpose, when defined in this way, is an expression of our values and is empowered by that fuel. Harkins’ book is a practical as well as purposeful guide to a values-driven implementation of information technology.

—Mary C. Gentile, PhD Author of Giving Voice To Values: How To Speak Your Mind When You Know What’s Right (Yale University Press)

In today’s rapidly evolving security landscape, security professionals are navigating a complex set of dynamics across the enterprise. In Managing Risk and Information Security, Malcolm Harkins draws on his rich security experience to present a connected view of where companies should be focused. He puts forth a valuable perspective, as organizations around the world look to create a necessary balance of protection and innovation, which ultimately enables business success.

Malcolm generously shares through personal experiences and story telling the formula for a successful 21st century CISO. It is one part multi-disciplinary leader and one part trusted advisor to the business, combined with behavioral models required for balanced risk decision making. A must-read for all new CISOs. Malcolm lives his beliefs.

—Nasrin Rezai GE Corporate Security & Compliance Officer

In the second edition of his book, Malcolm seamlessly articulates the future horizon of cyber security and the critical role that the CISO and security professionals will need to fulfill in order to defend both the company and consumers they serve. The guidance he provides into the skills, leadership, and approach required for successfully navigating the emerging challenges of securing a digital economy is invaluable. Regardless of your current role, this is a must-read for everyone who has accepted this great responsibility and privilege.

—Steven Young CISO, Kellogg Company xix

PRAISE FOR THE SECOND EDITION OF MANAGING RISK AND INFORMATION SECURITY

XX

While other security officers are looking to the traditional or the latest “cool” product, Harkins goes against the tide and asks the questions that need addressing. His forward-thinking mindset and Protect to Enable approach inspire others to innovate and go beyond the mainstream. If you cannot bring Harkins to your company for mentoring, this book will at least spark thought and will change how your engineers view security within the business.

—Charles Lebo Vice President and CISO, Kindred Healthcare

Malcolm's vast experience makes him one of the most credible security leaders on the international stage and serves as the perfect platform for this book. Rational, compelling, and authoritative writing is far too rare in the world of risk and information security, but Malcolm completely nails it in Managing Risk and Information Security with invaluable advice and recommendations for anyone planning a future in the security world. His extensive experience in business before becoming a CISO is one of the missing ingredients in many security executives’ professional toolbox, which is which is why this is such an important book. Make sure to keep a highlighter and notepad handy because there are a lot of nuggets in here you'll want to remember on your journey to becoming a better security professional.

—Mark Weatherford

Chief Cybersecurity Strategist at vArmour and

former Deputy Under Secretary for Cybersecurity

at the US Department of Homeland Security

Tve had the privilege of working with many talented CISOs over the years and Malcolm is one of the best. His logical, methodical approach to solving the most complex cybersecurity problems is reflected in his lucid style. An enlightened approach to understanding risk that unites all stakeholders and a systemic intelligence-based approach to security infrastructure are the only ways to reduce the threat to manageable levels. This is our best path forward if we are ever to realize the vast potential of the innovative digital world we are creating. In Managing Risk and Information Security, Malcolm shines a light on that path in a comprehensive yet very readable way.

—Art Coviello Former CEO and Executive Chairman, RSA

About the Author

Malcolm Harkins is the Chief Security and Trust Officer (CSTO) at Cylance Inc. In this role, he reports to the CEO and is responsible for enabling business growth through trusted infrastructure, systems, and business processes. He has direct organizational responsibility for information technology, information risk, and security, as well as security and privacy policy. Malcolm is also responsible for peer outreach activities to drive improvement across the world in the understanding of cyber risks and best practices to manage and mitigate those risks.

Previously, Malcolm was Vice President and Chief Security and Privacy Officer (CSPO) at Intel Corporation. In that role, Malcolm was responsible for managing the risk, controls, privacy, security, and other related compliance activities for all of Intel’s information assets, products, and services.

Before becoming Intel’s first CSPO, he was the Chief Information Security Officer (CISO) reporting into the Chief Information Officer. Malcolm also held roles in finance, procurement, and various business operations. He has managed IT benchmarking and Sarbanes-Oxley-compliance initiatives. Harkins acted as the profit and loss manager for the Flash Product Group at Intel; was the general manager of Enterprise Capabilities, responsible for the delivery and support of Intel’s Finance and HR systems; and worked in an Intel business venture focusing on e-commerce hosting.

Malcolm previously taught at the CIO Institute at the UCLA Anderson School of Management and was an adjunct faculty member at Susquehanna University in 2009. In 2010, he received the RSA Conference Excellence in the Field of Security Practices Award. He was recognized by Computerworld as one of the Premier 100 Information Technology Leaders for 2012. (ISC)? recognized Malcolm in 2012 with the Information Security Leadership Award. In September 2013, Malcolm was recognized as one of the Top 10 Breakaway Leaders at the Global CISO Executive Summit. In November 2015, he received the Security Advisor Alliance Excellence in Innovation Award. He is a Fellow with the Institute for Critical Infrastructure Technology, a non-partisan think-tank that provides cybersecurity briefings and expert testimony to the U.S. Congress and federal agencies. Malcolm is a sought-after speaker for industry events. He has authored many white xxi

ABOUT THE AUTHOR papers and in December 2012 published his first book, Managing Risk and Information Security. He also was a contributing author to Introduction to IT Privacy, published in 2014 by the International Association of Privacy Professionals.

Malcolm received his bachelor’s degree in economics from the University of California at Irvine and an MBA in finance and accounting from the University of California at Davis.

xxii

Acknowledgments

I received valuable feedback from many readers of the first edition of this book. That feedback helped me to expand the book with additional insights, clarifications, and updated examples. It also encouraged me to add two more chapters to the second edition: one on corporate social responsibility, and the other on performance coaching.

Special thanks to Mike Faden: without his help this book would not have happened.

As I noted in the first edition, many people during my journey at Intel helped me learn and grow. A number of them published material that is still referenced in this second edition.

Other experts who have helped me come from a variety of different peer groups. They include members of the Bay Area CSO Council, the Executive Security Action Forum, the members and staff of CEB and its Information Risk Leadership Council, participants in the Evanta CISO Executive Summits and the CISO coalition, as well as the Security Advisor Alliance.

Finally, I wish to thank Stuart McClure for giving me the opportunity to join Cylance.

xxiii

Preface

If you don’t believe in the messenger, you won't believe the message. You can’t believe in the messenger if you don’t know what the messenger believes.

You can’t be the messenger until you're clear about what you believe.

—James Kouzes and Barry Posner, in The Leadership Challenge

A great deal has transpired since the first edition of this book was published in January 2013, both in the world of information risk and in my personal life and career. To briefly cover the latter, in January 2013, I was named Intel’s Chief Security and Privacy Officer.

My broad role was one of the first of its kind in corporate America: I was charged with managing and mitigating risk for Intel’s products and services worldwide, in addition to Intel’s internal IT environment. In June 2015, I left Intel to become CISO at Cylance Inc., and in May 2016, I was named Cylance’s Chief Security and Trust Officer.

These career changes occurred during an extraordinary period of escalating information risk, as evidenced by an almost continuous stream of major hacks and breaches, and a corresponding rise in society’s awareness of risk. Some key examples:

May 2013: Edward Snowden flies to Hong Kong after leaving

his job at an NSA facility in Hawaii. The following month, he reveals thousands of classified NSA documents. The disclosures, including previously unknown government surveillance programs, continue to cause worldwide repercussions today.

December 2013: The blog Krebs On Security reports a massive data breach at Target. The company confirms the breach the next day. Within months, Target’s CIO and CEO both resign amid the fallout.

May 2014: A U.S. grand jury indicts five Chinese military officers on charges of hacking American companies and stealing trade secrets.

November 2014: Employees at Sony Pictures arrive at work to discover their network has been hacked. Attackers steal and then erase data on thousands of systems, forcing studio employees to revert to using fax machines and pen and paper. The attackers then dump huge batches of confidential business and personal information online.

XXV

PREFACE e March 2015: Google’s Project Zero hacking team demonstrates the ability to exploit a fundamental flaw in DDR3 SDRAM to perform privilege escalation attacks on systems containing the chips. Some mitigation approaches are available, other than replacing the DDR3 memory in millions of systems worldwide.

e June 2015: The US Office of Personnel Management announces a data breach targeting the personal data of up to 4 million people. The attack, which includes security clearance-related information, is one of the largest-ever breaches of government data. By July, the estimated number of stolen records increases to 21.5 million.

e February 2016: The Hollywood Presbyterian Medical Center in Los Angeles says it has paid a bitcoin ransom to attackers who held its systems hostage, encrypting data and blocking access by hospital staff. Some believe the healthcare industry is the next major target for cyber criminals.

Given this escalating cycle of risk, and the potential catastrophic societal implications of today’s attacks, we must all be ready to be held accountable. This may require a large mental shift for those used to simply assigning responsibility and blame for a breach to the people who traditionally perform post-attack cleanup: corporate IT departments, internal information security teams, and investigations and computer forensics groups. Everyone, from corporate executives to security practitioners, shares responsibility for security and privacy. We must all step back and contemplate our own personal responsibilities, not only to the organizations we work for and the customers we serve, but also to society as a whole.

The challenge we sometimes face is how to characterize that responsibility. Is our responsibility to limit liability for our organizations? Or is it a duty of care to the people whose information we store? What values are we using when we make decisions about cyber risk, and what bias do those values create in our decisions? Are we forwardlooking enough, or will the decisions we make to fix our problems today create other problems in the future? As Benjamin Franklin once said, “All human situations have their inconveniences. We feel those of the present but neither see nor feel those of the future; and hence we often make troublesome changes without amendment, and frequently for the worse.”

As security and privacy professionals, a key part of our role is to ensure the right dialogue and debate occurs. We need to ask “high-contrast” questions that sharply define the implications of the choices our organizations make. We need to make sure that the opportunities are as clearly defined as the obligations to mitigate risk, so that our organizations make the right decisions. And we need to take equal responsibility for the outcomes of those choices, as opposed to abdicating that responsibility solely to the business. Once the choice is made, we must transition out of the debate about what is right and focus on taking the right actions—on making tomorrow better than today.

We can think of this as doing what’s right. We can think of it as protecting our customers and partners and keeping our markets healthy for everyone. No matter what motivates us, thoughtfully building systems to support a culture of genuine responsibility for privacy and security is not only good corporate responsibility; it is also good for xxvi

PREFACE business. For computing to continue to improve the world we live in rather than endanger it, it needs to be trustworthy. And for that trust to be deliverable, we need to ensure the data we enter into our computers is both secure and private. As an organization, we demonstrate and build trust through our approach to solving these cyber-risk challenges. In the preface of the first edition, I said “Managing Risk and Information Security is a journey, but there is no finish line. Our approach to managing information risk must continue to evolve as rapidly as the pace of business and technology change. My hope is that people will read this book and begin their own journey.” I still firmly believe what I said then. But I also believe that, as General George Marshall once said, “The only way human beings can win a war is to prevent it.” We are at war against adversaries who wish to harm the users of technology. But there is also a battle among those responsible for protecting security and privacy. On one side are organizations that would like to continue on the current path because they profit from the insecurity of computing, or that approach the duty of care with a bias towards limiting liability rather than protecting their customers. On the other side are those who believe that our role is to generate trust. We do that by protecting to enable people and businesses. It’s a hard road; I know, because I experience it every day. But we shouldn’t back away from something just because it is hard. We need to plant our feet and stand firm. The only question is where we plant our feet.

xxvii

Introduction

There are two primary choices in life: to accept conditions as they exist, or accept the responsibility for changing them.

—Denis Waitley

In January 2002, I was hired to run a new Intel internal program called Security and Business Continuity. The program had been created following the major security events of the previous year (9/11 and the Code Red/Nimda viruses) and it focused primarily on the availability risks at that time. I had no background in technical security, but I had been at Intel for nearly 10 years in a variety of business-related positions, mostly in finance. As I learned about information risk during the first few months, it became apparent to me that the world was starting to change rapidly and that a “perfect storm” of risk was beginning to brew. In June 2002, I put together a diagram (Figure 1-1) to explain the risks to my manager, Intel’s CIO, and anyone who would listen to me.

The diagram has been updated slightly since then to more explicitly highlight the geo-political forces that are a key part of the threat, vulnerability, and regulatory

risk landscape.

© Malcolm W. Harkins 2016 1 M.W. Harkins, Managing Risk and Information Security, DOI 10.1007/978-1-4842-1455-8_1

The Perfect Storm of Risk

GEO Political

Confidentiality Vulnerabilities Integrity

Availability

Legislation

Business Risks

Business Impacts

Identity Management

Causin Assurance

Figure 1-1. The perfect storm of information risk

Today, it is clear that my view of the world was essentially accurate. Security breaches and intrusions are reported almost daily at organizations of all sizes, legal and regulatory issues related to technology use continue to grow, and geo-politics have surged to the forefront of some of these discussions in a post-Snowden era. Cyber attacks and data breaches are now considered the biggest threats to business continuity, according to a recent survey (Business Continuity Institute 2016).

But the key question that I asked in the first edition of this book is still valid. Is information security really effective? Given the rapid evolution of new technologies and uses, does the information security group even need to exist?

Obviously, this is a somewhat rhetorical question. I cannot imagine that any sizeable organization would operate well without an information security function. But the real issue is whether the information security group should continue to exist as it does today, with its traditional mission and vision. It is clear from the prevalence of breaches and compromises that we have not kept up with the threats, and we appear to be slipping farther behind as the world grows more volatile, uncertain, and ambiguous. It is no wonder that we have fallen behind: as the world of technology expands exponentially, so do the technology-related threats and vulnerabilities, yet our ability to manage those security and privacy risks has progressed only at a linear rate. As a result, there is a widening gap between the risks and the controls. In fact, many organizations have essentially given up actively trying to prevent compromises and have defaulted to reliance on after-the-fact detection and response tools.

As information risk and security professionals, we should be asking ourselves pointed questions if we wish to remain valuable and relevant to our organizations. Why do we exist? What should our role be? How are new consumer and Internet of Things (IoT) technologies shaping what we do, and can we shape the world of these new technologies and usage models? How is the evolving threat landscape shaping us, and can we shape the threat landscape? Given the bewildering pace at which technology changes and new threats appear, how do we focus and prioritize our workload? What skills do we need?

Traditionally, information security groups in businesses and other organizations have taken a relatively narrow view of security risks, which resulted in a correspondingly narrow charter. We focused on specific types of threats, such as malware. To combat these threats, we applied technical security controls. In an attempt to protect against attacks and stop them reaching business applications and employees’ PCs, we fortified the network perimeter using firewalls and intrusion detection software. To prevent unauthorized entry to data centers, we installed physical access control systems. Overall, our thinking revolved around how to lock down information assets to minimize security risks, and how to reactively detect and respond to risks as they presented themselves.

Today, however, I believe that this narrow scope not only fails to reflect the full range of technology-related risk to the business; it is detrimental to the business overall. Because this limited view misses many of the risks that affect the organization, it leaves areas of risk unmitigated and therefore leaves the organization vulnerable in those areas. It also makes us vulnerable to missing the interplay between risks and controls: by implementing controls to mitigate one risk, we may actually create a different risk. And by focusing primarily on detection and response, we are not preventing harm; we are just trying to limit the damage.

As I'll explain in this book, we need to shift our primary focus to adopt a broader view of risk that reflects the pervasiveness of technology today. Organizations still need traditional security controls, but they are only part of the picture.

There are several reasons for this. All stem from the reality that technology plays an essential role in most business activities and in people’s daily lives.

Technology has become the central nervous system of a business, supporting the flow of information that drives each business process from product development to sales. In addition, as I’ll discuss throughout this book, almost every company is becoming a supplier of technology in some form, as technology becomes a vital element of most products, services, and infrastructure from cars and household appliances to the power grid.

The role of technology in peoples’ personal lives has expanded dramatically, too, and the boundaries between business and personal use of technology are blurring. Marketers want to use social media to reach more consumers. Employees want to use their personal smartphones to access corporate e-mail.

Meanwhile, the regulatory environment is expanding rapidly, affecting the way that information systems must manage personal, financial, and other information in order to comply—and introducing a whole new area of IT-related business risks.

Threats are also evolving quickly, as attackers develop more sophisticated techniques, often targeted at individuals, which can penetrate or bypass controls such as network firewalls, traditional antivirus solutions, and outdated access control mechanisms such as passwords.

In combination, these factors create a set of interdependent risks to a business’s information and technology, from its internal information systems to the products and services provided to its customers, as shown in Figure 1-2.

Other Things e Cyber Secunty Legislation © Emerging Threats © GEO Political

© Cyber Terrorism © Cyber Warfare

Information Security

© Security Tools

© Detailed Techrical Analysis

© Intellectual Property Protection © Emerging Threat Analysis

Core Elements

Privacy

© Safe Harbor

© Data mapping, control, and registration

© Design & Engineering

Business Continuity / Disaster Recovery

© Mission criticality

e Response Processes

© Life/Safety

e Environmental

Legal/Regulatory

+ Export Control

e Financial regulations e Health Information

e Other emerging items

Product & Service Security © Security Development Lifecycle e Validation

© Product Seaunty Inadent Response (PSIRT)

Figure 1-2. Managing the interdependent set of technology-related risks

Traditional security or other control type thinkers would respond to this situation by saying “no” to any technology that introduces new risks. Or perhaps they would allow a new technology but try to heavily restrict it to a narrow segment of the employee population. An example of this over the past few years was the view at some companies that marketers should not engage consumers with social media on the company’s web site because this meant accumulating personal information that increased the risk of noncompliance with privacy regulations. Another example was that some companies didn’t allow employees to use personal devices because they were less secure than managed business PCs.

The reality is that because IT is now integrated into everything that an organization does, security groups cannot simply focus on locking down information assets to minimize risk. Restricting the use of information can constrain or even disable the organization, hindering its ability to act and slowing its response to changing market conditions. A narrow focus on minimizing risk therefore introduces a larger danger: it can threaten a business’s ability to compete in an increasingly fast-moving environment.

THE CHALLENGES OF RISING SECURITY COSTS AND SKILLS SHORTAGES

Growing recognition of the importance of security and privacy, triggered largely by highly publicized breaches, has led to sharply increasing security spending and

an accompanying skills shortage. If the current trajectory continues, Gartner Inc. predicts that by 2017 the typical IT organization will spend up to 30 percent of its budget on risk, security, and compliance, and will allocate 10 percent of its people to these security functions. That is triple the levels of 2011 (Gartner 2015b). At the same time, skill shortages may worsen; more than a third of security managers surveyed in 2015 reported significant obstacles in implementing security projects due to inadequate staffing (Morgan 2015). One question is how much of the projected cost increase is due to under-investment in the past, and how much is due to the fact that organizations have invested in technologies that do not adequately reduce risk. To break the cycle, as I'll explain in Chapter 7, we need a new security model and tools that create a demonstrable decrease in the risk curve, with a greater focus on effective prevention and machine learning to reduce cost and manual effort.

Protect to Enable®

To understand how the role of information security needs to change, we need to re-examine our purpose. We need to Start with Why, as author Simon Sinek argues convincingly in his book of the same name (Portfolio, 2009). Why does the information security group exist?