CMU5XX-INFOSEC

Information Security for Industry

Session 7: Cyber Security Management Concepts

James Williams

jwilliams@staff.newman.ac.uk

Learning Objectives

  • Formulate Key Performance Indicators (KPIs) to measure security effectiveness.
  • Establish Key Risk Indicators (KRIs) as early warning systems.
  • Analyze the business impact of Vendor/Third-Party vulnerabilities.
  • Execute Third-Party Risk Assessments (TPRA) using industry standard questionnaires.
  • Deconstruct supply chain attacks (e.g., SolarWinds) and their mitigations.

Seminar Structure (3 Hours)

Part 1: Metrics and Measurement (1.5 hrs)
  • KPIs vs KRIs
  • Presenting Metrics to the Board
  • Task 1: Developing Security KPIs
Part 2: Third-Party Risk Management (1.5 hrs)
  • The Supply Chain Threat Landscape
  • Vendor Audits and Questionnaires
  • Task 2: Third-Party Risk Assessment

Part 1: Metrics and Measurement

Duration: 1.5 Hours

The Measurement Problem

How do you prove that the security program is working?

  • If a company suffers zero breaches in a year, is it because they have excellent security, or because they were lucky and nobody targeted them?
  • Security leaders must provide quantifiable data to the business to justify their existence and their budgets.
  • "We blocked 10,000 firewall attacks today" is a terrible metric. It provides zero business context.

KPIs vs KRIs

Key Performance Indicators (KPIs)

Looking backward. Measures how effectively a control is operating.
Example: "Percentage of laptops with up-to-date antivirus definitions" (Target: 99%).

Key Risk Indicators (KRIs)

Looking forward. Early warning signs that a risk is increasing to an unacceptable level.
Example: "Number of employees bypassing the VPN to access cloud services." If this spikes, the risk of data exfiltration is rising rapidly.

Reporting to the Board

The Board of Directors is responsible for enterprise risk management, not IT operations.

  • Metrics presented to the board must be tied to business goals (Revenue, Reputation, Compliance).
  • Good Board Metric: "Mean Time to Patch Critical Vulnerabilities" (Decreased from 14 days to 3 days, reducing compliance risk).
  • Bad Board Metric: "Number of malware signatures updated." (Irrelevant technical jargon).

Introduction to Task 1

Developing effective KPIs requires aligning technical telemetry with strategic business objectives.

We will design a KPI dashboard for a healthcare provider.

Task 1: Developing Security KPIs

Timing: 45 minutes

A hospital network's primary strategic goal for the year is to "Achieve 100% compliance with HIPAA regulations regarding patient data privacy."

  1. Develop two technical KPIs that directly measure progress toward this goal (e.g., related to encryption or access control).
  2. Develop one KRI that would serve as an early warning sign that HIPAA compliance is slipping.
  3. For each metric, explicitly define how the data will be collected automatically (without manual counting).

15 Minute Break

Please return promptly for Part 2.

Part 2: Third-Party Risk Management

Duration: 1.5 Hours

The Supply Chain Threat

You are only as secure as your weakest vendor.

  • Why spend months trying to hack a bank's impenetrable firewall, when you can just hack the small, underfunded marketing agency that handles the bank's customer emails?
  • Target Breach (2013): 40 million credit cards stolen. Attackers didn't hack Target directly; they hacked Target's HVAC (air conditioning) vendor, who had a remote connection into Target's billing network.

Case Study: SolarWinds (2020)

The most sophisticated supply chain attack in history.

  • Russian state-sponsored actors compromised the software build pipeline of SolarWinds, an IT monitoring company.
  • They inserted a malicious backdoor into the official SolarWinds software update.
  • 30,000 organizations (including the US Treasury and FireEye) downloaded the "legitimate" update, instantly giving the attackers administrative access to their internal networks.
  • Proves that implicitly trusting software vendors is a critical vulnerability.

Third-Party Risk Assessment (TPRA)

Before signing a contract with a vendor who will handle your data, you must assess their security posture.

  • Security Questionnaires: Standardized documents (e.g., SIG Core, CAIQ) asking the vendor 200+ questions about their encryption, policies, and incident response plans.
  • Right to Audit: Contracts must include a clause allowing your company to hire independent auditors to verify the vendor's claims.
  • SOC 2 Reports: An independent audit report proving a vendor adheres to strict security controls. If a cloud vendor cannot produce a SOC 2 Type II report, you should not use them.

Introduction to Task 2

TPRAs are a balancing act between security rigor and business velocity. The business wants to use the new software today; security needs to ensure it won't cause a breach.

We will evaluate a potential vendor's security posture and make a Go/No-Go recommendation.

Task 2: Third-Party Risk Assessment

Timing: 50 minutes

Your HR department wants to purchase a new cloud-based payroll system from a startup vendor ("PayFast"). You send them a security questionnaire. They return the following answers:

  • Data Encryption at Rest: "No, but our servers are in a locked cage."
  • Multi-Factor Authentication (MFA) for Admins: "In development, arriving Q4."
  • Recent Penetration Test: "Yes, conducted internally by our lead developer last month."
  1. Identify the three critical red flags in the vendor's responses.
  2. Draft a formal "Risk Acceptance" memo to the Head of HR, explaining why Security is vetoing this vendor.

Summary & Next Steps

  • Metrics are the language of management. If you can't measure your security posture, you can't improve it.
  • The perimeter no longer ends at your corporate firewall; it extends to every vendor and software supplier you interact with.
Next Week: The NIST Cyber Security Framework (Standardizing Defense)