The key Operational Risk Management news from this years RSA Conference is now coming in, yet there are inside sources who still need to be interviewed. What did they think was the most brilliant presentation or idea(s) presented?
This particular release caught some eyes as it addresses much of the thinking on the latest evolution of the Security Operations Center (SOC):
The evolution of the SOC in your enterprise may start in some unconventional places. Who is it in your organization that is responsible for the loss of corporate assets? Who in your company is the one who determines what items are counted as losses to the bottom line? Who does the enterprise look to when the crisis hits and people are looking for answers in minutes, not hours, or days? Who picks up the phone to answer the call from the FBI Field Office?
These may not be the people you think of in the CIO's office or IT department. These people however need to be part of the combined Security Operations Center solution in the company. The Advanced Persistent Threat (APT) now represents the intersection of prudent strategy from the business leadership, the accounting or finance leadership and the risk management leadership. If the CIO is looked upon as the key executive running a "Utility" inside the enterprise, think again.
This blog has discussed the "Corporate Intelligence Unit" this past April 2010 :
Beyond the utilization of threat assessment or management teams, enterprises are going to the next level in creating a "Corporate Intelligence Unit" (CIU). The CIU is providing the "Strategic Insight" framework and assisting the organization in "Achieving a Defensible Standard of Care."The framework elements that encompass policy, legal, privacy, governance, litigation, security, incidents and safety surround the CIU with effective processes and procedures that provides a push / pull of information flow. Application of the correct tools, software systems and controls adds to the overall milestone of what many corporate risk managers already understand.The best way in most cases to defend against an insider attack and prevent an insider incident is to continuously help identify the source of the incident, the person(s) responsible and to correlate information on other peers that may have been impacted by the same incident or modus operandi of the subject. "Connecting The Dots" with others in the same company or with industry sector partners increases the overall resilience factor and hardens the vulnerabilities that are all too often being exploited for months if not years.In retrospect, you can be more effective investigating and collecting evidence in your company to gain a "DecisionAdvantage". To pursue civil or criminal recovery of losses from these insider incidents, you may not go to law enforcement, but it's likely they will come to you once they get a whistle blower report, catch the attacker and/or they have the evidence that you were a victim.
How your organization pulls together the right people to staff and operate your "CIU" is going to depend on your culture, funding and current state of the threat. The shareholders and stakeholders will be asking you about those losses in the Annual Report attributed to fees being paid to thousands if not millions of customers and members for such services as credit report monitoring and ID Theft service alerts.
Here is another thought. A thorough review of the current funding, staffing and strategy of a SOC or CIU in the enterprise may even become another criteria for whether you should engage as a customer or investor.