Governance of Enterprise Security: CyLab 2012 Report How ... - RSA

Carnegie Carnegie Carnegie Mellon Mellon Mellon CyLab CyLab
!
! Zero Zero percent (0%) of of the the IT/telecom industry sector sector said they have CPOs, even even though though they have
some some of of the the most stringent stringent privacy compliance requirements. requirements. Likewise, Likewise, none (0%) of the
respondents from the the energy/utilities and and industrials industrials sectors sectors indicated they have CROs. CROs.
III. Recommendations
Recommendations
!
The survey revealed that governance of of enterprise security is still lacking in most most corporations, corporations, with with gaps gaps gaps in
critical critical areas. areas. If If If boards boards and and senior senior management management take take the the following following 12 12 actions, actions, actions, they they could could significantly significantly
improve improve their their organizations’ organizations’ security security security posture posture and and reduce reduce risk: risk:
1. Establish Establish a board Risk Committee Committee separate from the Audit Committee and assign it responsibility responsibility for
enterprise risks, including IT risks. Recruit directors with security and IT governance and cyber risk
expertise. expertise.
2. 2. 2. Ensure that privacy and security security roles roles within within the organization organization organization are separated and that responsibilities
are appropriately appropriately assigned. assigned. assigned. The The The CIO, CIO, CISO/CSO, CISO/CSO, and and CPO CPO CPO should should report report independently independently to senior senior
management.
management.
3. 3. Evaluate the existing organizational structure and establish establish establish a a cross-organizational cross-organizational team that that is is is
required to meet meet meet at at least least monthly monthly to to coordinate coordinate coordinate and and communicate communicate on on privacy privacy and security security issues.
This team should include include include senior senior senior management management from from human human resources, resources, public relations, legal, and
procurement, as well as the CFO, CFO, the CIO, CIO, CISO/CSO, CISO/CSO, CRO, CRO, the CPO, and business line line
executives. executives.
4. 4. Review Review existing existing top-level top-level policies policies to to create create a a culture culture of of of security security and and respect respect for for privacy. privacy.
Organizations can enhance their their their reputation by valuing valuing cybersecurity cyber security and and the protection of privacy
and viewing it as a corporate corporate social social social responsibility.
responsibility.
5. 5. Review Review assessments assessments of of the the organization’s organization’s security security program program and and ensure ensure that that that the it comports program with comports best
practices with best and practices standards and standards and includes and incident includes response, incident response, breach notification, breach breach notification, notification, disaster recovery, disaster and
crisis recovery, communications and crisis communications plans. plans.
6. 6. Ensure Ensure that that privacy privacy and and security security requirements requirements for for vendors vendors (including (including cloud cloud and and software-as-a-service
software-as-a-service
providers) are based upon key aspects aspects of the the organization’s organization’s security security program, including annual audits
and and control requirements. Carefully review notification procedures procedures in the event event of of of a a breach breach or or or
security security incident.
7. 7. Conduct an annual audit of the the the organization’s organization’s organization’s enterprise enterprise security program, to be reviewed reviewed by the the
Audit Audit Committee.
8. 8. Conduct an annual annual review review of of the the enterprise enterprise security security program program program and effectiveness effectiveness of of controls, controls, to to be
reviewed by the board board Risk Risk Committee, and ensure that identified gaps gaps or weaknesses weaknesses weaknesses are are addressed. addressed.
9. 9. 9. Require regular reports reports from senior senior management management on on privacy privacy and and security security risks.
10. 10. Require Require annual annual board board review review of of budgets budgets for for privacy privacy and and security security risk management.
management.
11. 11. Conduct Conduct annual privacy compliance compliance audits and review test incident response, breach breach notification, notification, disaster
recovery, and crisis communication communication plans. plans.
12. 12. Assess Assess cyber cyber risks risks and and potential potential loss loss valuations valuations and and and review review adequacy adequacy of of cyber cyber insurance insurance coverage.
coverage.