1 of 15

Tammy L. Clark, CISSP, CISM, CISA, CRISC, PMP

Chief Information Officer

The University of Tampa

April 19. 2016

You’ve Got This!

Briefing the Board on Information Security

2 of 15

Speaker Bio

CISO for the past 16 years at two universities
Recently Promoted to CIO
Involved with EDUCAUSE HEISC since 2002
Veteran board presenter

3 of 15

The University of Tampa

Independent University in Tampa, Florida
8000+ students enrolled, Liberal Arts tradition
Students from 50 states and 140 countries
65% of full-time students live in campus housing
1200 staff; hundreds of contractors and student part time workers; 900 faculty; 4 colleges
Ultimate responsibility for the University resides with the Board of Trustees, as governance of the University is legally invested in the Board.

4 of 15

Information Security at The Univ of Tampa

Information Security Program formalized 3.5 yrs ago
CIO/CISO - reports to UT President
Chief among infosec initiatives building a culture of risk management, security awareness, and data protection
ISO/IEC 27001:2013 Certified since July 2015

5 of 15

Session Agenda

Why talk to the board?
Key board briefing goals
Understand the audience
Tips and techniques
Discussion

6 of 15

Why Talk to the Board Anyway?

“C-Suite” Issue = Board Issue
Due Diligence
Correct misperceptions
Professional development

“C-Suite Issue = Board issue” An information security incident is a career-defining moment for the IT “C-suite” and for boards
Due Diligence: Even though it is scary, boards must understand institutional information security risk to make good business decisions for the institution. Its an issue of due diligence for both the board and the CISO
Correct misperceptions about attack landscape, data held by the institution that makes it an attractive target, data breach loss potential, legal and regulatory landscape, data breach insurance, and the list goes on.
Higher education's unique culture makes us attractive targets for cybercriminals, which institutional and board executives must consider in their deliberations and decision making regarding overall campus health.
Educating your board about information security gives them a clearer picture of organizational cybersecurity challenges and the potential costs to your institution of failing to manage cyber threats and risks — including financial and reputational costs.
Obtaining the board's support puts you in a better position to effectively manage information security risks on your campus.

7 of 15

Goals for Briefing the Board

Relationship building
Risk assessment
Highlight next steps

8 of 15

Know Your Audience

Boards are typically business people
Be honest and direct
Be brief (because there will be questions)
Educate

9 of 15

Putting Things into Context

How much does your Board know about your current information security posture?

10 of 15

Define Your Approach

Align with strategic objectives and goals
Share concrete examples
Stress risk management culture
Discuss challenges

Align your points with strategic objectives and goals. This is perhaps the most important point we can make, as doing so adds impact to your briefing and appeals to the board's standard approach to deliberations. Explain areas of weakness and strength in your campus's cybersecurity status. Threats involving people, processes, and/or technology that affect your institution are relevant to the board, but even more important are your recommendations — this is an opportunity to improve your institution's information security posture if you have the board's support.
Share a report of the attacks launched over the past week or month with board members. While the board members may not understand all the types of attacks and their degree of threat, they will better appreciate the challenges faced in keeping your network secure just by seeing the number of attempts. Such data will also provide the board with a platform for more detailed questions in the future and thus develop richer future discussions.
Explain the concept of a risk management culture. This is a process of maintaining acceptable risk, not an end state of eliminating every risk. Richard Bejtlich, author of a variety of books including The Tao of Network Security Monitoring, suggests that the best answer to the question "Are we secure?" is "Let me check." This helps contextualize the fundamental challenges in information security.
Recognize that you may not have all the answers today — and that's OK. For example, you haven't yet identified all the information security risks if you have only considered your IT organization. It is necessary to take a comprehensive approach and examine information security risks from multiple perspectives across the institution (people, processes, and technologies). The board wants a demonstration of your commitment, effective progress, and productive results.

11 of 15

Discuss InfoSec Challenges

Security attacks invisible
Confidential data everywhere
Complicated regulatory landscape
Lack of legal enforcement (until there isn’t)
Data Losses can be staggering

Security is invisible by default. Identifying legitimate attacks — let alone breaches — is challenging.
Confidential data may be held in a variety of places. Confidential data doesn't just reside in central databases but it is widely distributed — in the cloud, on a thumb drive, on a mobile device, etc.
There is a complicated regulatory landscape in breach disclosure. Navigating complex federal and state laws may complicate your responsibilities in reporting out to the wider community when (not if) your institution suffers a breach. Your campus legal counsel will need to be involved.
There is a relative lack of legal enforcement. Legal authorities may have difficulties tracing cybercriminal activity to its original source, as well as distinguishing whether the originator is a criminal, a hacktivist, or a state actor posing a threat to national security. This makes punishment of cybercriminal activity difficult and all too rare.
Potential losses involved due to cybercriminal incidents and data breaches can be staggering. In the aftermath of a major security incident the fall-out can range from financial (often measured per record) to reputational damages, and it can take a lot of money and a long time to recover from a major incident.

12 of 15

Then What Happens?

Get invited back
Develop strong relationships
Continued education
Increased investment?

13 of 15

Tips and Techniques Discussion

Have you talked to your board?
What worked well?
What didn’t work so well?
What is your one piece of advice for your colleagues?

14 of 15

Summary

EDUCAUSE Review, Leading an Effective Briefing with Board Executives about Information Security, http://er.educause.edu/articles/2016/1/leading-an-effective-briefing-with-board-executives-about-information-security

15 of 15

Thank You!

Please remember to fill out session evaluations.

Feel free to contact me at tclark@ut.edu