Governance of Enterprise Security: CyLab 2012 Report How ... - RSA
Governance of Enterprise Security: CyLab 2012 Report How ... - RSA
Governance of Enterprise Security: CyLab 2012 Report How ... - RSA
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
Carnegie Carnegie Carnegie Mellon Mellon Mellon <strong>CyLab</strong> <strong>CyLab</strong><br />
!<br />
! Zero Zero percent (0%) <strong>of</strong> <strong>of</strong> the the IT/telecom industry sector sector said they have CPOs, even even though though they have<br />
some some <strong>of</strong> <strong>of</strong> the the most stringent stringent privacy compliance requirements. requirements. Likewise, Likewise, none (0%) <strong>of</strong> the<br />
respondents from the the energy/utilities and and industrials industrials sectors sectors indicated they have CROs. CROs.<br />
III. Recommendations<br />
Recommendations<br />
!<br />
The survey revealed that governance <strong>of</strong> <strong>of</strong> enterprise security is still lacking in most most corporations, corporations, with with gaps gaps gaps in<br />
critical critical areas. areas. If If If boards boards and and senior senior management management take take the the following following 12 12 actions, actions, actions, they they could could significantly significantly<br />
improve improve their their organizations’ organizations’ security security security posture posture and and reduce reduce risk: risk:<br />
1. Establish Establish a board Risk Committee Committee separate from the Audit Committee and assign it responsibility responsibility for<br />
enterprise risks, including IT risks. Recruit directors with security and IT governance and cyber risk<br />
expertise. expertise.<br />
2. 2. 2. Ensure that privacy and security security roles roles within within the organization organization organization are separated and that responsibilities<br />
are appropriately appropriately assigned. assigned. assigned. The The The CIO, CIO, CISO/CSO, CISO/CSO, and and CPO CPO CPO should should report report independently independently to senior senior<br />
management.<br />
management.<br />
3. 3. Evaluate the existing organizational structure and establish establish establish a a cross-organizational cross-organizational team that that is is is<br />
required to meet meet meet at at least least monthly monthly to to coordinate coordinate coordinate and and communicate communicate on on privacy privacy and security security issues.<br />
This team should include include include senior senior senior management management from from human human resources, resources, public relations, legal, and<br />
procurement, as well as the CFO, CFO, the CIO, CIO, CISO/CSO, CISO/CSO, CRO, CRO, the CPO, and business line line<br />
executives. executives.<br />
4. 4. Review Review existing existing top-level top-level policies policies to to create create a a culture culture <strong>of</strong> <strong>of</strong> <strong>of</strong> security security and and respect respect for for privacy. privacy.<br />
Organizations can enhance their their their reputation by valuing valuing cybersecurity cyber security and and the protection <strong>of</strong> privacy<br />
and viewing it as a corporate corporate social social social responsibility.<br />
responsibility.<br />
5. 5. Review Review assessments assessments <strong>of</strong> <strong>of</strong> the the organization’s organization’s security security program program and and ensure ensure that that that the it comports program with comports best<br />
practices with best and practices standards and standards and includes and incident includes response, incident response, breach notification, breach breach notification, notification, disaster recovery, disaster and<br />
crisis recovery, communications and crisis communications plans. plans.<br />
6. 6. Ensure Ensure that that privacy privacy and and security security requirements requirements for for vendors vendors (including (including cloud cloud and and s<strong>of</strong>tware-as-a-service<br />
s<strong>of</strong>tware-as-a-service<br />
providers) are based upon key aspects aspects <strong>of</strong> the the organization’s organization’s security security program, including annual audits<br />
and and control requirements. Carefully review notification procedures procedures in the event event <strong>of</strong> <strong>of</strong> <strong>of</strong> a a breach breach or or or<br />
security security incident.<br />
7. 7. Conduct an annual audit <strong>of</strong> the the the organization’s organization’s organization’s enterprise enterprise security program, to be reviewed reviewed by the the<br />
Audit Audit Committee.<br />
8. 8. Conduct an annual annual review review <strong>of</strong> <strong>of</strong> the the enterprise enterprise security security program program program and effectiveness effectiveness <strong>of</strong> <strong>of</strong> controls, controls, to to be<br />
reviewed by the board board Risk Risk Committee, and ensure that identified gaps gaps or weaknesses weaknesses weaknesses are are addressed. addressed.<br />
9. 9. 9. Require regular reports reports from senior senior management management on on privacy privacy and and security security risks.<br />
10. 10. Require Require annual annual board board review review <strong>of</strong> <strong>of</strong> budgets budgets for for privacy privacy and and security security risk management.<br />
management.<br />
11. 11. Conduct Conduct annual privacy compliance compliance audits and review test incident response, breach breach notification, notification, disaster<br />
recovery, and crisis communication communication plans. plans.<br />
12. 12. Assess Assess cyber cyber risks risks and and potential potential loss loss valuations valuations and and and review review adequacy adequacy <strong>of</strong> <strong>of</strong> cyber cyber insurance insurance coverage.<br />
coverage.<br />