News
McAfee experts launch book to help security obligated executives
February 2012 by McAfee
McAfee announced the launch of Security Battleground: An Executive Field Manual a book based on the authors security experience with large global corporations. Michael Fey, Brian Kenyon, Kevin Reardon, Bradon Rogers, and Charles Ross have identified a group of individuals who increasingly find themselves responsible for ensuring that their enterprises are secure. The book was written for the Chief Information Officers (CIOs), Chief Information Security Officers (CISOs) and other C-level executives because they are all responsible for material threats to their enterprises, and today information security qualifies as one of the top material threats. Security Battleground provides the security obligated executive with guidance about the hard questions to ask when validating a security team’s strategic plan, its budget, and its operations.
“Any top company or institution can suffer irreparable harm at the hands of cyber-attackers. Today it’s estimated that over 1 trillion dollars in damages can be attributed to this battle – and this number is expected to skyrocket to over 5 trillion within the next 5 years alone,” said Michael Fey, senior vice president at McAfee. “This is a battle that has turned into a war and is being fought unlike any other and this was the question that started our journey to write this book.”
Part I – Field Manual for the Battleground - Surveying the Battleground explains the origin of the book as a field manual written for a security-obligated executive who has accepted responsibility for overseeing the security organization. The first section focuses on:
· Assessing Mission Readiness shows how to assess the security team’s maturity and encourage improvements in the team’s approach to security threats and countermeasures.
· Developing the Strategy provides an overview of the strategic planning process with a special emphasis on building a plan based on a foundation of clearly documented business risks and compliance obligations. This is the chapter that sets the expectation that security organizations should plan strategy just like any other line of business.
Part II – Preparing for Battle – This section gives advice on methodology for gathering information, analysis, regulations and developing a strategic security plan.
· Recognizing and Capturing Risk reveals the authors’ methodology for gathering key business information. An exercise called Riches, Ruins & Regulations is the centerpiece.
· Performing Threat Analysis explains how the security team methodically marries business risk to vulnerabilities and threats.
· Adhering to Regulations addresses the issues of regulatory compliance, which is another form of business risk. Failure to pass a compliance audit can lead to fines and sanctions that can be as harmful as a hacker’s attack.
· Preparing the Strategic Plan shows how the building blocks fit together. Threats and compliance obligations are pitted against programs that provide controls (i.e., protection).
Part III - Winning the War – This section gives practical information about budgets, measurement, crises, cooperation with other businesses and looking towards the future.
· Funding the War is about the budget and the books approach is not traditional. While building a business case remains a fundamental building block, security budgeting inevitably depends on a forthright discussion with security-obligated executives as to what risks the company is willing to tolerate.
· Measuring Success provides guidance about the use of security metrics to manage and optimize security operations.
· Managing Crises is a proactive guide in preparing for the likely event that there will be a security breach. We identify four key steps beginning with containment and ending with remediation.
· Aligning the Allies speaks to the need for security organizations to cultivate shared understandings within and outside the company. The traditional company boundaries have evolved and we focus on how to align resources to work in concert with trading partners toward the shared goal of strong security.
· Future Proofing is a look to the security horizon with an emphasis on anticipating the next generation of threats. In this chapter we focus discussion on current trends such as cloud computing, virtualized processing and storage systems, and the consumerization of IT.
Security Battleground: An Executive Field Manual was designed to provide a primer to help executives better understand their roles and obligations with respect to information security. The principles outlined in this book will continue to evolve over time, much like the security battleground itself.
