selling elephant whistles

Selling Elephant Whistles

The security process and getting upper management buy-in

Jayson E. Street, CISSP, GSEC, IEM, IAM, CCSE, CCSA, Security+

Contents

• INTRO• The disconnect• Common Ground• 3 Steps

Situational AwarenessMetricsNews

• Discussion

Let go of my EGO • Lets start out with a little about yours truly.

• http://stratagem-one.com


• Now let’s have an explanation.


• Proving the negative.

• Success = ZERO perceptible change.

Why is it so hard?

• The business environment encourages management to think reactively.

• Information Security should be a proactive process.

• Everything is binary 1 and 2s

Know yourself know your enemy

• Sun Wu (Tzu) “Ping-fa”(The Art of War)• “Thus it is said that one who knows the enemy and

knows himself will not be endangered in a hundred engagements. One who does not know the enemy but knows himself will sometimes be victorious, sometimes meet with defeat. One who knows neither the enemy nor himself will invariably be defeated in every engagement!”

Situational Awareness

• “Hackers know what’s happening on your network shouldn’t you?”

• High Threat + Low Impact = Valuable Lesson

Situational Awareness

• Pen testing “Defense through Discovery”

• Attack yourself before someone else does.

• Checking the windows on your own home does not make you a burglar.

Examples

• Judging a book by its cover.

• Using Ghost can kill your security policy.

• Sometimes the April fool is you.

Metrics can be your friend

• Pie charts – it’s not just what’s for dinner.

• Show me the numbers!

• They can handle the truth!

Examples

• Even if they are using snow balls you should be aware their hitting the wall.

• The more you monitor your network the more efficient your network can become.

• Having a no wi-fi policy means checking for wi-fi.

News

• A smart man learns from his mistakes, a wise man learns from the mistakes of others.

• Know the risk environment of your business– Trade Journals, Web News, Hacking Sites,

Evening News

Examples

• The summer of Lost Laptops.

• ID theft the next big news story since Avian Flu.

• What ever happened to slammer?

Now let’s learn from others

• Discussion and Questions????

• Or several minutes of uncomfortable silence it’s your choice.

• Did I mention the bumper stickers?

selling elephant whistles

Technology