ANALYSIS & ASSESSMENT OF TECHNOLOGY FROM A BOARD S PERSPECTIVE STEPHANIE L. BUCKLEW SLB CONSULTING

Size: px

Start display at page:

Download "ANALYSIS & ASSESSMENT OF TECHNOLOGY FROM A BOARD S PERSPECTIVE STEPHANIE L. BUCKLEW SLB CONSULTING"

Angelina Pope
6 years ago
Views:

1 ANALYSIS & ASSESSMENT OF TECHNOLOGY FROM A BOARD S PERSPECTIVE STEPHANIE L. BUCKLEW SLB CONSULTING

2 WHAT IS TECHNOLOGY RISK? Any threat to information technology within your organization and the consequence of any exposure encountered.

3 FBI DIRECTOR, ROBERT MUELLER, 2012 There are only two types of companies. Those that have been hacked and those that will be. This Photo by Unknown Author is licensed under CC BY-SA

4 ASK YOURSELF.. PROTECTED DATA EXTERNAL STORAGE DELIVERY CHANNELS PII: Personally Identifiable Information PHI: Protected Health Information 3rd Party Service Providers Cloud Usage Send or Receive Sensitive Information Receive Electronic Payments

5 CYBERSECURITY 2017 Shadow Brokers WannaCry Petya Wikileaks Cloudbleed *Trend Micro This Photo by Unknown Author is licensed under CC BY-SA

WANNACRY Ransomeware 1. Unsolicited e-mail received prompting the user to perform a function 2.

6 WANNACRY Ransomeware 1. Unsolicited received prompting the user to perform a function 2. Operating system runs the ransomware code 3. Ransomware encrypts files and demands a payment This Photo by Unknown Author is licensed under CC BY-ND

7 EXPOSURE GENERAL THREATS CRIMINAL THREATS 3 RD PARTY EXPOSURE NATURAL DISASTERS

8 GENERAL THREATS Hardware/Software Failure Malware Viruses Spam, Scams & Phishing Human Error This Photo by Unknown Author is licensed under CC BY-NC-SA

9 CRIMINAL THREATS Hackers Fraud Password Theft Security Breach Data Theft or Misuse This Photo by Unknown Author is licensed under CC BY-NC

10 3 RD PARTY EXPOSURE Vendors Service Providers Partnerships This Photo by Unknown Author is licensed under CC BY

11 NATURAL DISASTERS Flood Fires Earthquakes Electrical Outages This Photo by Unknown Author is licensed under CC BY

12 MEASURING & MANAGING TECHNOLOGY RISK? This Photo by Unknown Author is licensed under CC BY 4 Step Process: Risk Identification Risk Measurement Risk Mitigation Risk Monitoring

13 I. RISK IDENTIFICATION INVENTORY Networks Data Storage Hardware Internet Software

14 CONSIDERATIONS Technology & Connection Types Delivery Channel Online/Mobile Products & Services External Threats This Photo by Unknown Author is licensed under CC BY-SA

15 II. RISK MEASUREMENT Technology & Connections Types Risk Rating (High, Medium, or Low) Develop a rating system with definitions that are clear and easily understood by staff, executive management and the board.

16 III. RISK MITIGATION IT Policies & Procedures IT Internal Controls Procedures for New Hires and Terminations Software Development & Acquisition Procedures 3 rd Party Management Disaster Recovery Plan

17 III. RISK MITIGATION (CON T) Board & Executive Director Oversight Segregation of Duties Background Checks Whistleblower Policy Audit/Compliance Function This Photo by Unknown Author is licensed under CC BY-SA

18 IV. RISK MONITORING Metrics/Benchmarking Service Level Agreements Timely & Effective Reporting Governance Over IT P&P Compliance/Audit This Photo by Unknown Author is licensed under CC BY- NC-SA

19 IV. RISK MONITORING (CON T) Considerations Board Involvement IT Executive Escalation Process This Photo by Unknown Author is licensed under CC BY-SA Disaster Recovery Plan Communication Policy

20 GOVERNANCE Establishment of Policies and Continuous Monitoring of Their Implementation by the Governing Bodies of the Institution. This Photo by Unknown Author is licensed under CC BY-NC-SA

21 PERSPECTIVE Office of the Comptroller of the Currency (regulatory) Compliance Regulatory Consulting (alltel, kpmg) Audit PNC (corporate compliance)

22 WHAT IS SLB CONSULTING? The goal of SLB Consulting is to empower organizations to continue to serve their communities in the highest capacity, while ensuring the mitigation of reputation risk by assessing and strengthening corporate governance practices and achieving operational efficiencies.

23 Q&A

Evaluating Your Company s Data Protection & Recovery Plan

Evaluating Your Company s Data Protection & Recovery Plan CBIA Cybersecurity Webinar Series 11AM 12PM Part V. Presented by: Stewart Tosh Charles Bellingrath Date: December 7, 2017 Today s presenters Stewart