How to Build Your Own Cyber Security Framework
using a Balanced Scorecard"
Russell Cameron Thomas!EnergySec 9th Annual Security Summit!
September 18, 2013!
Twitter: @MrMeritology!
Blog: Exploring Possibility Space!
Who here loves frameworks?!
Who here loves frameworks?!
NIST Cyber Security Framework?!Other?!
Frameworks can matter (a lot)
Frameworks can matter (a lot) if they are instrumental in
driving new levels of Cyber Security Performance
What the hell is “Cyber Security Performance”?!
Yes, “Cyber”!
Yes, “Cyber”!Confluence of…!• Information Security!• Privacy!• IP Protection!• Critical Infrastructure Protection & Resilience!• Digital Rights!• Homeland & National Security!• Digital Civil Liberties!
What the hell is “Cyber Security Performance”?!
“Cyber security performance” is… "
… systematic improvements in an organization's dynamic posture
and capabilities relative to its rapidly-changing and uncertain adversarial environment.”!
“Cyber security performance” is… "
…Management By Objectives!
(Drucker)!
“Cyber security performance” is… "
…Management By Objectives!
…Performance Mgt, incentives!
“Cyber security performance” is… "
…Management By Objectives!
…Performance Mgt, incentives!
…Staffing, training, organizing!
“Cyber security performance” is… "
…Management By Objectives!
…Performance Mgt, incentives!
…Staffing, training, organizing!
…Organization learning, agility!
“Cyber security performance” is… "
…Management By Objectives!
…Performance Mgt, incentives!
…Staffing, training, organizing!
…Organization learning, agility!
… and good practices!
“Performance” vs “Practices”!
Using the Universal Language of Executives….���
Using the Universal Language of Executives….���
"Keep your head still"
"Keep your head still"
“Keep your arm straight”
"Keep your head still"
“Keep your arm straight” “Swing on
one plane”
"Keep your head still"
“Keep your arm straight” “Swing on
one plane”
“Swing easy”
"Keep your head still"
“Grip it and rip it!"
“Keep your arm straight” “Swing on
one plane”
“Swing easy”
"Best practices" are like golf tips… ������
"Best practices" are like golf tips… ������
Golf tips alone don't make good golfers���
Why Agility?
Why Rapid Innovation?!
State ofthe Art!
Lagging"InfoSec"Program!
Time for some drama!
Time for some drama!
Set in the Summer of 2017!
“I in central Texas.”
t was another long heat wave
Spare generating capacity was dangerously low!
You run information security!at a large industrial company!that includes several and cogeneration.!
Thanks to deregulation and incentives, microgrids have taken off, especially in Texas
= 10+ microgrids
Microgrid Adoption, 2017"
In recent days, instead of selling its excess power, your firm was buying at peak spot prices."""This was strange.!
18 months earlier
You"Energy Ops "Manager"
Business"Continuity"Manager"
Effective Response, Recovery & Resilience"
Your Microgrid Automation""
hosted"auto-configuring"software"reporting/trending!system config!diagnostics!
Internet
Microgrid"Supervisory"Controller"
12 months earlier
Spot trading was largely automated���via microgrid automation software.���
12 months earlier
Optimize Exposure"
Insiders?
Threat Intelligence
Business Partners? Contractors?
Criminals?
APT?
Error?
Hactivist?
Terrorist?
24 months earlier
Our New Capability: Attack-driven Defense"
1. Raise cost to attackers
2. Increase odds of detection
3. Iterate defense based on real attack patterns
24 months earlier
source: Etsy h7p://www.slideshare.net/zanelackey/a7ackdriven-‐defense
Insiders?
Business Partners? Contractors?
Criminals?
APT?
Error?
Hactivist?
Terrorist?
Threat Intelligence Yesterday
Effective Threat Intelligence"
Sensors & Pattern Detection for Anomalous User Behavior"
24 months earlier
Any Non- Tech. Tech.
source: Etsy h7p://www.slideshare.net/zanelackey/a7ackdriven-‐defense
User Class
Insiders?
Business Partners? Contractors?
Criminals?
APT?
Error?
Hactivist?
Terrorist?
X Threat Intelligence
X
Yesterday
Quality ofProtections & Controls"
Insiders?
Business Partners? Contractors?
Criminals?
APT?
Error?
Hactivist?
Terrorist?
X X
Threat Intelligence Yesterday
Efficient/Effective Execution & Operations"
12 months earlier
Effective External Relationships"
The Crime:"
ArDficially Congested
Subsided Generators
Manipulation of Wholesale Market Subsidies
Conges'on pa+erns, July 14, 2017
Losers: You and hundreds of other microgrids forced to generate spot market bids during price spikes. (Botnet-style. Each loses a little $$)
Scam: Generate losing trades in one market to make money in another market
Attack: Compromised Hosted Auto-Configuration Software
"hosted"auto-configuring"software"reporting/trending!system config!diagnostics!
Internet
Microgrid"Supervisory"Controller"
The Attackers"
Insider: Contractor at web application software company
Outsider: Hedge fund manager bribed contractor with profit sharing
Gold Man Hacks Bid Probe "2017"
2017"
Gold Man Hacks Faces Record Fine Over Energy
Over the last 24 months
Adap've Threat
Intelligence
A+ack-‐ driven Defense
Expanded External
Engagement
Expanded Detec'on & Response
Metrics
Effective Agility & Learning"
Over the last 24 months
Effective Design & Development"
Over the last 24 months
Optimize Cost of Risk"
Over the last 24 months
Accountability & Responsibility"
The End
Summary:
The Ten Dimensions of
Cyber Security Performance!
Actors
Systems
The Organiza7on
Events
Context"
Actors
Systems
1. Exposure
Events
Dimension 1:Optimize Exposure"
Actors
Systems
1. Exposure 2. Threats
Events
Dimension 2:Effective Threat
Intelligence"
Actors
Systems
1. Exposure
3. Design & Dev.
2. Threats
Events
Dimension 3:Effective Design &
Development"
Actors
Systems
1. Exposure 2. Threats
3. Design & Dev. 4. Protec'on
s & Con
trols
Events
Dimension 4:Quality of Protection
& Controls"
Actors
Systems
1. Exposure 2. Threats
3. Design & Dev. 4. ProtecDon
s & Con
trols
5. Execu'o
n & Ope
ra'o
ns
Events
Dimension 5:Effective/Efficient
Execution & Operations"
Events
Actors
Systems
1. Exposure 2. Threats
3. Design & Dev. 4. ProtecDon
s & Con
trols
5. ExecuDo
n & Ope
raDo
ns
6. Response, Recovery
& Resilience
Dimension 6:Effective Response,
Recovery & Resilience"
Opera7onal Cyber Security
Dimensions 1 – 6 Measure Core Performance"
Events
Actors
Systems
1. Exposure 2. Threats
3. Design & Dev. 4. ProtecDon
s & Con
trols
5. ExecuDo
n & Ope
raDo
ns
6. Response, Recovery
& Resilience
First Loop Learning
“First Loop Learning”is Continuous Improvement
in Daily Operations"
Events
Systems
1. Exposure 2. Threats
3. Design & Dev. 4. ProtecDon
s & Con
trols
5. ExecuDo
n & Ope
raDo
ns
Actors
7. Externa
l Engagem
ent
The Organiza7on
Other Organiza7ons
Government & Law Enforcement
Dimension 7:Effective External
Engagement"
6. Response, Recovery
& Resilience
Events
Systems
1. Exposure 2. Threats
3. Design & Dev. 4. ProtecDon
s & Con
trols
5. ExecuDo
n & Ope
raDo
ns
Actors
7. External Engagem
ent
Other Organiza7ons
Government & Law Enforcement
8. Agility & Learning
Dimension 8:Effective Agility
& Learning"
6. Response, Recovery
& Resilience
Events
Systems
1. Exposure 2. Threats
3. Design & Dev. 4. ProtecDon
s & Con
trols
5. ExecuDo
n & Ope
raDo
ns
Actors
7. External Engagem
ent
8. Agility & Learning 9. Total Cost of Risk
Other Organiza7ons
Government & Law Enforcement
Dimension 9:Optimize
Total Cost of Risk"
6. Response, Recovery
& Resilience
Events
Systems
1. Exposure 2. Threats
3. Design & Dev. 4. ProtecDon
s & Con
trols
5. ExecuDo
n & Ope
raDo
ns
Actors
7. External Engagem
ent
Total Cost of Risk
10. Accountability & Responsibility
Stakeholders
9. Total Cost of Risk 8. Agility & Learning
Other Organiza7ons
Government & Law Enforcement
Dimension 10:Accountability
& Responsibility"
6. Response, Recovery
& Resilience
Dynamic Capabili7es
Dimensions 7 – 10 Measure Systemic
Agility"
Events
Systems
1. Exposure 2. Threats
3. Design & Dev. 4. ProtecDon
s & Con
trols
5. ExecuDo
n & Ope
raDo
ns
Actors
Total Cost of Risk
10. Accountability & Responsibility
Stakeholders
9. Total Cost of Risk 8. Agility & Learning
Other Organiza7ons
Government & Law Enforcement
7. External Engagem
ent
6. Response, Recovery
& Resilience
Second Loop Learning
“Second Loop Learning”is Innovation
and Reinvention*"
* Individual and CollecDve
Events
Systems
1. Exposure 2. Threats
3. Design & Dev. 4. Protec'on
s & Con
trols
5. Execu'o
n & Ope
ra'o
ns
Actors
7. Externa
l Engagem
ent
Stakeholders
10. Accountability & Responsibility
9. Total Cost of Risk 8. Agility & Learning
Other Organiza7ons
Government & Law Enforcement
Ten Dimensions ofCyber Security
Performance"
6. Response, Recovery
& Resilience
Last thought…!
“Can’t you make it simpler?”!
“Can’t you make it simpler?”!
“We need a crayon version for executives and other
business and policy types”!
Sure!
Sure!• “Transcendental numbers hurt my head”!
Sure!• “Transcendental numbers hurt my head”!• Declare π = 3.0!
Sure!• “Transcendental numbers hurt my head”!• Declare π = 3.0!• But we lose something essential!
“Circle”
