rise of the virtual ciso · information security officer (ciso) can far exceed the budgets of many...

of 17 /17
Rise of the Virtual CISO National Cyber Summit June 5, 2019 Greg Schaffer Principal, vCISO Services, LLC

Upload: others

Post on 10-May-2020

4 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: Rise of the Virtual CISO · Information Security Officer (CISO) can far exceed the budgets of many small and midsized businesses (SMBs). However, many SMBs don't require a full time

Rise of the Virtual CISONational Cyber Summit

June 5, 2019Greg Schaffer

Principal, vCISO Services, LLC

Page 2: Rise of the Virtual CISO · Information Security Officer (CISO) can far exceed the budgets of many small and midsized businesses (SMBs). However, many SMBs don't require a full time

Why We Are Here

© 2019 vCISO Services, LLC – Proprietary and Confidential

At an average annual compensation of nearly $260,000, the cost of adding a full-time Chief Information Security Officer (CISO) can far exceed the budgets of many small and midsized businesses (SMBs). However, many SMBs don't require a full time security leadership position;  part-time experienced guidance is all that is needed. That's where a Virtual CISO (vCISO) adds value.

Page 3: Rise of the Virtual CISO · Information Security Officer (CISO) can far exceed the budgets of many small and midsized businesses (SMBs). However, many SMBs don't require a full time

About Me

© 2019 vCISO Services, LLC – Proprietary and Confidential

Page 4: Rise of the Virtual CISO · Information Security Officer (CISO) can far exceed the budgets of many small and midsized businesses (SMBs). However, many SMBs don't require a full time

What is a Chief Information Security Officer (CISO)?

© 2019 vCISO Services, LLC – Proprietary and Confidential

• First CISO• Today’s definition • Technical• Business• Organization location

Page 5: Rise of the Virtual CISO · Information Security Officer (CISO) can far exceed the budgets of many small and midsized businesses (SMBs). However, many SMBs don't require a full time

Purpose

© 2019 vCISO Services, LLC – Proprietary and Confidential

• Manage risk• 3LOD• Org location again• Segregation of duties

Page 6: Rise of the Virtual CISO · Information Security Officer (CISO) can far exceed the budgets of many small and midsized businesses (SMBs). However, many SMBs don't require a full time

Regulations/Standards and Frameworks

© 2019 vCISO Services, LLC – Proprietary and Confidential

• HIPAA• GDPR• PCI• NYS DFS

• ISO 27001• NIST 800-53• NIST CSF• FFIEC CAT

Page 7: Rise of the Virtual CISO · Information Security Officer (CISO) can far exceed the budgets of many small and midsized businesses (SMBs). However, many SMBs don't require a full time

SMB Concerns

© 2019 vCISO Services, LLC – Proprietary and Confidential

• Size less than 200 less than $50M• No budget for FT CISO• $260K• Not needed full time• Projects or ongoing

Page 8: Rise of the Virtual CISO · Information Security Officer (CISO) can far exceed the budgets of many small and midsized businesses (SMBs). However, many SMBs don't require a full time

What is a Virtual CISO?

© 2019 vCISO Services, LLC – Proprietary and Confidential

• Consultant• Part time• Experience as a CISO• Not an IT Sec Dir• Works remote

Page 9: Rise of the Virtual CISO · Information Security Officer (CISO) can far exceed the budgets of many small and midsized businesses (SMBs). However, many SMBs don't require a full time

How a Virtual CISO Can Help

© 2019 vCISO Services, LLC – Proprietary and Confidential

• ISMS• Governance• Compliance

Page 10: Rise of the Virtual CISO · Information Security Officer (CISO) can far exceed the budgets of many small and midsized businesses (SMBs). However, many SMBs don't require a full time

How a Virtual CISO Can Help

© 2019 vCISO Services, LLC – Proprietary and Confidential

• Gap and maturity assessments• Risk assessments• Risk treatment

Page 11: Rise of the Virtual CISO · Information Security Officer (CISO) can far exceed the budgets of many small and midsized businesses (SMBs). However, many SMBs don't require a full time

How a Virtual CISO Can Help

© 2019 vCISO Services, LLC – Proprietary and Confidential

• Direct IT on Controls• Security Ops Center interface• BC/DR• Training

Page 12: Rise of the Virtual CISO · Information Security Officer (CISO) can far exceed the budgets of many small and midsized businesses (SMBs). However, many SMBs don't require a full time

How a Virtual CISO Can Help

© 2019 vCISO Services, LLC – Proprietary and Confidential

• SOC2 audit support• Vendor management• Client comfort

Page 13: Rise of the Virtual CISO · Information Security Officer (CISO) can far exceed the budgets of many small and midsized businesses (SMBs). However, many SMBs don't require a full time

Engaging a Virtual CISO

© 2019 vCISO Services, LLC – Proprietary and Confidential

• Vetting• Scope• Goals and immediate needs

Page 14: Rise of the Virtual CISO · Information Security Officer (CISO) can far exceed the budgets of many small and midsized businesses (SMBs). However, many SMBs don't require a full time

Engaging a Virtual CISO

© 2019 vCISO Services, LLC – Proprietary and Confidential

• Initial Request List• SME interviews• Assessment

Page 15: Rise of the Virtual CISO · Information Security Officer (CISO) can far exceed the budgets of many small and midsized businesses (SMBs). However, many SMBs don't require a full time

Engaging a Virtual CISO

© 2019 vCISO Services, LLC – Proprietary and Confidential

• Internal access• Communications• Meeting cadence

Page 16: Rise of the Virtual CISO · Information Security Officer (CISO) can far exceed the budgets of many small and midsized businesses (SMBs). However, many SMBs don't require a full time

Final Thoughts

© 2019 vCISO Services, LLC – Proprietary and Confidential

• Your team• Share• Relationship

Page 17: Rise of the Virtual CISO · Information Security Officer (CISO) can far exceed the budgets of many small and midsized businesses (SMBs). However, many SMBs don't require a full time

Questions?

© 2019 vCISO Services, LLC – Proprietary and Confidential

Greg SchafferPrincipal, vCISO Services, LLC

[email protected](615) 472-9274