What does Cyber Security Information look like?

• New threats:
• A Leading indicator of Risk...Threats are all around us, why count them?
  • What haven't we seen before -what we don't know can hurt us
  • Are new threats arriving faster?
  • Is the pattern normal?
• Security backlog:
• Identify - Protect - Detect - Respond - Recover...Repeat!
  • A workload measure - how much work is there for my security operations team?
  • Is the "haystack" of events becoming overwhelming?
  • How well is the capacity of my team being utilized?

• Defense Effectiveness:
• Bating Wire and Duct Tape...Are we treating the symptom or the cause
  • What are the most persistent threats?
  • Are we mitigating threats and vulnerabilities efficiently?
  • Which controls work and which ones need to be retired?

Economic view of risk in IT Operations:

FAIR Ontology is a good model to use.

Bringing the Model to life by:

• High Relevance
• Some Relevance
• Model Only

If Models are current, good and useful, they should be used for KRIs.

Five key areas of risk in related to CLM:

• Can you quickly search, locate and track your agreements or report on key data points?  (On average, companies use 5% of their revenue as costs of CLM)
  • Secure, central repository
  • Capture contract type centric data
  • Report on key data points
• Key dates and obligatiions
  • Proactive email alerts.
  • Action item tracking.
  • Calendars and to do lists.
• Business rules and compliance
  • Create business rules and workflows.
  • Analyze requirements and KPI's.
  • Uncover bottlenecks while improving compliance.
• Contract language and redlining
  • Create agreements using approved language
  • Complete document routing
  • Version control and auto-compare
• Role-based security
  • Robust security controls
  • Enforce security at different stages
  • Integration with Active Directory.

Internal Audit (IA) is uniquely positioned to use its cross functional / external perspective to provide strategic guidance to the business while balancing the need to perform its traditional work.

Align IA with the most significant business risks:

• Lead the enterprise wide business risk assessment focused on business risk, not solely financial statement or auditable risks.
• Keep the business risk assessment refreshed with emerging risks and business changes.
• Set the audit plan to address highest potential risk areas.  Continuously re-assess and adjust real time.
• Facilitate dialogue on acceptable levels of risk tolerance and alternative risk mitigation.

Shift hours from compliance to advisory work:

• Specific hours set aside in the audit plan.
• Partner with the business to address control issues identified, process challenges, business changes, etc.
  • Trade spend optimization
  • Control Health Checks
  • Process / control documentation for business implementations
  • Contingency planning for sole source providers

• Audit Committee and / or executive management requests early in the process.
• Focus on the business risk.
• Customize solutions.

Balance objectivity with strong relationships:

• Partner with the business.  Understand business goals / objectives and how audit can help enable them.
• Relationships matter.
• Establish credibility
• Audit is intimidating.  Being approachable is critical.
• Watch out:  maintaining independence (perception of not being objective)

Practice what you preach:  eliminate costs and inefficiencies:

• Eliminate and / or reduce lower risk audits.
• Assess IA's processes to eliminate non value added work.
• Leverage non audit internal resources to complete traditional compliance work with IA reviewing.
• Simplify reporting.
• Manage travel and expenses.

Takeaways:

• As the business evolves, IA needs to evolve with it.
• Finding the balance of traditional audit and business partnership is powerful.
• Continuous re-assessment is required.

The Here and Now:

Cyber-attacks

Regulations

Around the Corner:

Talent avaialbity

Fiscal crises, sustainability demands and social instability

On the Horizon:

Climate change, water crises, large scale involuntary migrations.Emerging technologies

Strategy is about making choices.  Think about:

What creates Value in your organization?

How is value Captured?

How is Strategy set, communicated and executed?

What is the actual Attitude towards risk management?

Does the organization's Culture support a strategic risk management approach?

Good Decision making steps:

1. Frame:  issue/need defined

2. Doable alternatives

3. Meaningful, reliable informaiton

4. Developing options

5. Clear values and trade-offs

6. Logically, correct reasoning

7. Acting on the decision

Strategic Risk Management (SRM) is a business discipline that drives deliberation and action regarding uncertainties and untapped opportunities that affect an organization's strategy and strategy execution.

Technology / Cyber Threat Detection:

Solution:  Software that aids in detection that is sophisticated, bidirectional, real time and predictive.

How do we gauge the solution's efficacy?  Look at a number of solutions and triangulate among them; look at number of actual events versus false positives.  

Lessons learned:
Detection:  Data vs intelligence
Accuracy:  No or minimal false positives
Accountability
Actionable
Simple and Customizable Rules Management
Response time and SLA