SlideShare una empresa de Scribd logo
1 de 25
WHAT IS AN ADEQUATE LEVEL
OF SECURITY?
Wivenhoe Management Group
What is an Adequate Level of
Security?
There is clearly a substantial difference in
protecting a facility from persons intent on
destroying the infrastructure to those
intent on defacing it.
Defining that difference is critical
Wivenhoe Management Group
Factors That Determine An
Adequate Level of Security
1. Type of Facility
2. Cost
3. Risk Acceptance
4. Insurance Requirements
5. SVA Recommendations
6. Liability
Wivenhoe Management Group
Factors That Determine An
Adequate Level of Security
1. Basis of Security Understanding
2. Threat Level
3. Accepted Security Industry Standards & Practice
4. Legal Compliance
5. Environment
6. Incident History
7. Other
Wivenhoe Management Group
Basis of Security Understanding
Sandia - Detect, Delay, Respond
DHS - Deter, Detect, Delay, Respond
Security Industry Experience
Keep the Problem Out
Deter the Problem Elsewhere
Wivenhoe Management Group
Threat Level
Crime Rate Statistics
• Homicide
• Rape
• Robbery
• Aggravated Assault
• Crimes Against Persons
• Burglary
• Larceny
• Motor Vehicle Theft
• Crimes Against Property
Wivenhoe Management Group
Accepted Security Industry
Standards & Practices
Design Criteria
Properly Maintained Equipment
Training
Manufacturer Authorized Installers
Proper Lighting
Accepted System Design
Current Software & Firmware
Wivenhoe Management Group
Accepted Security Industry
Standards & Practices
As Built Drawings
Response Time to System Failure
Back-Up Power Systems
Meeting Federal & Local Codes
Minimum Video Recording Time
Schedules Identifying Types &
Quantities of Security Panels
Wivenhoe Management Group
Accepted Security Industry
Standards & Practices
Due Diligence Related to Contractors
Clear Definition of Performance
Requirements
Required Installation Permits
Electric Surge Protection
Wivenhoe Management Group
Legal Compliance
• Specific Industry Security
Requirements
• Data Security Requirements
• Physical Security Requirements
Wivenhoe Management Group
Incident History
• Five (5) Year History
• Type of Incident
• Actions Taken
• Incident/Serious Breach
Wivenhoe Management Group
Liability
• Standard Law Suit
• Negligence
• Gross Negligence
• Repercussions
Wivenhoe Management Group
Environment
• Crime Rates
• Type of Crime Category
• Transportation Hub
• Nearby Targets
• Sensitive Border
• Target Vantage Point
Wivenhoe Management Group
Type of Facility
• Hazardous
• Strategic Value
• Age & Condition
• Key Infrastructure
• Research Facility
• Communication Hub
Wivenhoe Management Group
Cost
• Cost, the Leading Factor
• Cost, a Double-Edged Sword
• Cost, Lowest Bidder
• Cost, Technology Changes
Wivenhoe Management Group
Risk Acceptance
Higher Risk = Less Cost
Lower Risk Safe Choice
Difference is Liability
Wivenhoe Management Group
Insurance Concerns
Escalating Medical Costs
Increasing Value of Assets
Ever Present Terrorism
Wivenhoe Management Group
Insurance Requirements
UL Certified Alarm System
Data Security Compliance
Safety Compliance
Cyber Crime Prevention
Active Shooter Containment
Wivenhoe Management Group
SVA Requirements
What is an SVA?
Security Vulnerability Assessment
Wivenhoe Management Group
Why Perform An SVA?
• Threat Level
• Critical Assets
• Findings & Recommendations
• Federal Grant Funding
• Customer Confidence
Wivenhoe Management Group
Why Perform An SVA?
• Counter Liability
• Phased Solution
• Emergency Planning & Response
– Active Shooter
– Bomb Threat
• Measured Response
Wivenhoe Management Group
SUMMARY
Basis of Security
• Deter Detect Delay Respond
• Detect Delay Respond
Wivenhoe Management Group
SUMMARY
Many Factors
Threat Level Legal Compliance
Accepted Standards Environment
Incident History Liability
Facility Type Risk Acceptance
Insurance Cost
Security Vulnerability Assessment
Wivenhoe Management Group
SUMMARY
More Important Factors
Threat Level
Liability
Facility Type
Legal Compliance
Wivenhoe Management Group
QUESTIONS
Questions can be sent to:
David McCann
Principal Consultant
Wivenhoe Management Group
dmccann@wivenhoegroup.com
www.wivenhoegroup.com
Wivenhoe Management Group

Más contenido relacionado

La actualidad más candente

La actualidad más candente (20)

Risk Management Methodology - Copy
Risk Management Methodology - CopyRisk Management Methodology - Copy
Risk Management Methodology - Copy
 
Wastewater Workshop Presentation 2007[2 R]
Wastewater  Workshop  Presentation 2007[2 R]Wastewater  Workshop  Presentation 2007[2 R]
Wastewater Workshop Presentation 2007[2 R]
 
Cyber Resilience: Managing Cyber Shocks
Cyber Resilience: Managing Cyber ShocksCyber Resilience: Managing Cyber Shocks
Cyber Resilience: Managing Cyber Shocks
 
An Intro to Resolver's InfoSec Application (RiskVision)
An Intro to Resolver's InfoSec Application (RiskVision)An Intro to Resolver's InfoSec Application (RiskVision)
An Intro to Resolver's InfoSec Application (RiskVision)
 
ComResource - NW Agent Cybersecurity
ComResource - NW Agent CybersecurityComResource - NW Agent Cybersecurity
ComResource - NW Agent Cybersecurity
 
Risk Assessment And Management
Risk Assessment And ManagementRisk Assessment And Management
Risk Assessment And Management
 
Cybersecurity Disrupters and Cybersecurity Insurance in the COVID-19 Era – Is...
Cybersecurity Disrupters and Cybersecurity Insurance in the COVID-19 Era – Is...Cybersecurity Disrupters and Cybersecurity Insurance in the COVID-19 Era – Is...
Cybersecurity Disrupters and Cybersecurity Insurance in the COVID-19 Era – Is...
 
Integrating Cybersecurity into Supply Chain Risk Management
Integrating Cybersecurity into Supply Chain Risk ManagementIntegrating Cybersecurity into Supply Chain Risk Management
Integrating Cybersecurity into Supply Chain Risk Management
 
Risk Assessments
Risk AssessmentsRisk Assessments
Risk Assessments
 
Pitfalls of Cyber Data
Pitfalls of Cyber DataPitfalls of Cyber Data
Pitfalls of Cyber Data
 
Resilience is the new cyber security
Resilience is the new cyber securityResilience is the new cyber security
Resilience is the new cyber security
 
Bay Dynamics
Bay DynamicsBay Dynamics
Bay Dynamics
 
Vendor Cybersecurity Governance: Scaling the risk
Vendor Cybersecurity Governance: Scaling the riskVendor Cybersecurity Governance: Scaling the risk
Vendor Cybersecurity Governance: Scaling the risk
 
The Measure of Success: Security Metrics to Tell Your Story
The Measure of Success: Security Metrics to Tell Your StoryThe Measure of Success: Security Metrics to Tell Your Story
The Measure of Success: Security Metrics to Tell Your Story
 
Proactive incident response
Proactive incident responseProactive incident response
Proactive incident response
 
Managing Insider Risk
Managing Insider RiskManaging Insider Risk
Managing Insider Risk
 
IT Security management and risk assessment
IT Security management and risk assessmentIT Security management and risk assessment
IT Security management and risk assessment
 
OWASP based Threat Modeling Framework
OWASP based Threat Modeling FrameworkOWASP based Threat Modeling Framework
OWASP based Threat Modeling Framework
 
Cyber Resilience
Cyber ResilienceCyber Resilience
Cyber Resilience
 
Countering Cyber Threats
Countering Cyber ThreatsCountering Cyber Threats
Countering Cyber Threats
 

Similar a Adequate securitynew1404.019

Wasn't expecting that! Now what?
Wasn't expecting that! Now what?Wasn't expecting that! Now what?
Wasn't expecting that! Now what?
Jisc
 
ION-E Defense In Depth Presentation for The Institiute of Internal Auditors
ION-E Defense In Depth Presentation for The Institiute of Internal AuditorsION-E Defense In Depth Presentation for The Institiute of Internal Auditors
ION-E Defense In Depth Presentation for The Institiute of Internal Auditors
mdagrossa
 
Undertake the Risk Analysis Policy
Undertake the Risk Analysis PolicyUndertake the Risk Analysis Policy
Undertake the Risk Analysis Policy
Komal Zahra
 
Cyber Security 2016 Cade Zvavanjanja1
Cyber Security 2016 Cade Zvavanjanja1Cyber Security 2016 Cade Zvavanjanja1
Cyber Security 2016 Cade Zvavanjanja1
Cade Zvavanjanja
 
Assuring Reliable and Secure IT Services
Assuring Reliable and Secure IT ServicesAssuring Reliable and Secure IT Services
Assuring Reliable and Secure IT Services
tsaiblake
 

Similar a Adequate securitynew1404.019 (20)

Aceds 2015 Cyberseucity and the Legal Profession - NYC - April 7, 2015
Aceds 2015 Cyberseucity and the Legal Profession - NYC - April 7, 2015Aceds 2015 Cyberseucity and the Legal Profession - NYC - April 7, 2015
Aceds 2015 Cyberseucity and the Legal Profession - NYC - April 7, 2015
 
Wasn't expecting that! Now what?
Wasn't expecting that! Now what?Wasn't expecting that! Now what?
Wasn't expecting that! Now what?
 
Security architecture frameworks
Security architecture frameworksSecurity architecture frameworks
Security architecture frameworks
 
Stay Ahead of Threats with Advanced Security Protection - Fortinet
Stay Ahead of Threats with Advanced Security Protection - FortinetStay Ahead of Threats with Advanced Security Protection - Fortinet
Stay Ahead of Threats with Advanced Security Protection - Fortinet
 
Luncheon 2015-06-18 Security Industry 2.0: Survival in the Boardroom by David...
Luncheon 2015-06-18 Security Industry 2.0: Survival in the Boardroom by David...Luncheon 2015-06-18 Security Industry 2.0: Survival in the Boardroom by David...
Luncheon 2015-06-18 Security Industry 2.0: Survival in the Boardroom by David...
 
Enterprise under attack dealing with security threats and compliance
Enterprise under attack dealing with security threats and complianceEnterprise under attack dealing with security threats and compliance
Enterprise under attack dealing with security threats and compliance
 
ION-E Defense In Depth Presentation for The Institiute of Internal Auditors
ION-E Defense In Depth Presentation for The Institiute of Internal AuditorsION-E Defense In Depth Presentation for The Institiute of Internal Auditors
ION-E Defense In Depth Presentation for The Institiute of Internal Auditors
 
Undertake the Risk Analysis Policy
Undertake the Risk Analysis PolicyUndertake the Risk Analysis Policy
Undertake the Risk Analysis Policy
 
Cyber Attacks aren't going away - including Cyber Security in your risk strategy
Cyber Attacks aren't going away - including Cyber Security in your risk strategyCyber Attacks aren't going away - including Cyber Security in your risk strategy
Cyber Attacks aren't going away - including Cyber Security in your risk strategy
 
The Journey to Cyber Resilience in a World of Fear, Uncertainty and Doubt
The Journey to Cyber Resilience in a World of Fear, Uncertainty and DoubtThe Journey to Cyber Resilience in a World of Fear, Uncertainty and Doubt
The Journey to Cyber Resilience in a World of Fear, Uncertainty and Doubt
 
Threat Based Risk Assessment
Threat Based Risk AssessmentThreat Based Risk Assessment
Threat Based Risk Assessment
 
Cyber Security 2016 Cade Zvavanjanja1
Cyber Security 2016 Cade Zvavanjanja1Cyber Security 2016 Cade Zvavanjanja1
Cyber Security 2016 Cade Zvavanjanja1
 
Risk Management (1) (1).ppt
Risk Management (1) (1).pptRisk Management (1) (1).ppt
Risk Management (1) (1).ppt
 
Focusing on the Threats to the Detriment of the Vulnerabilities
Focusing on the Threats to the Detriment of the VulnerabilitiesFocusing on the Threats to the Detriment of the Vulnerabilities
Focusing on the Threats to the Detriment of the Vulnerabilities
 
Rapid Risk Assessment: A New Approach to Risk Management
Rapid Risk Assessment: A New Approach to Risk ManagementRapid Risk Assessment: A New Approach to Risk Management
Rapid Risk Assessment: A New Approach to Risk Management
 
How to Simplify Audit Compliance with Unified Security Management
How to Simplify Audit Compliance with Unified Security ManagementHow to Simplify Audit Compliance with Unified Security Management
How to Simplify Audit Compliance with Unified Security Management
 
Security Site Surveys and Risk Assessments
Security Site Surveys and Risk AssessmentsSecurity Site Surveys and Risk Assessments
Security Site Surveys and Risk Assessments
 
2015 Global Threat Intelligence Report - an analysis of global security trends
2015 Global Threat Intelligence Report - an analysis of global security trends2015 Global Threat Intelligence Report - an analysis of global security trends
2015 Global Threat Intelligence Report - an analysis of global security trends
 
Assuring Reliable and Secure IT Services
Assuring Reliable and Secure IT ServicesAssuring Reliable and Secure IT Services
Assuring Reliable and Secure IT Services
 
My_notes_part1.pdf
My_notes_part1.pdfMy_notes_part1.pdf
My_notes_part1.pdf
 

Último

Hyatt driving innovation and exceptional customer experiences with FIDO passw...
Hyatt driving innovation and exceptional customer experiences with FIDO passw...Hyatt driving innovation and exceptional customer experiences with FIDO passw...
Hyatt driving innovation and exceptional customer experiences with FIDO passw...
FIDO Alliance
 
Tales from a Passkey Provider Progress from Awareness to Implementation.pptx
Tales from a Passkey Provider  Progress from Awareness to Implementation.pptxTales from a Passkey Provider  Progress from Awareness to Implementation.pptx
Tales from a Passkey Provider Progress from Awareness to Implementation.pptx
FIDO Alliance
 

Último (20)

TEST BANK For, Information Technology Project Management 9th Edition Kathy Sc...
TEST BANK For, Information Technology Project Management 9th Edition Kathy Sc...TEST BANK For, Information Technology Project Management 9th Edition Kathy Sc...
TEST BANK For, Information Technology Project Management 9th Edition Kathy Sc...
 
ERP Contender Series: Acumatica vs. Sage Intacct
ERP Contender Series: Acumatica vs. Sage IntacctERP Contender Series: Acumatica vs. Sage Intacct
ERP Contender Series: Acumatica vs. Sage Intacct
 
Design Guidelines for Passkeys 2024.pptx
Design Guidelines for Passkeys 2024.pptxDesign Guidelines for Passkeys 2024.pptx
Design Guidelines for Passkeys 2024.pptx
 
WebRTC and SIP not just audio and video @ OpenSIPS 2024
WebRTC and SIP not just audio and video @ OpenSIPS 2024WebRTC and SIP not just audio and video @ OpenSIPS 2024
WebRTC and SIP not just audio and video @ OpenSIPS 2024
 
Event-Driven Architecture Masterclass: Engineering a Robust, High-performance...
Event-Driven Architecture Masterclass: Engineering a Robust, High-performance...Event-Driven Architecture Masterclass: Engineering a Robust, High-performance...
Event-Driven Architecture Masterclass: Engineering a Robust, High-performance...
 
ADP Passwordless Journey Case Study.pptx
ADP Passwordless Journey Case Study.pptxADP Passwordless Journey Case Study.pptx
ADP Passwordless Journey Case Study.pptx
 
Collecting & Temporal Analysis of Behavioral Web Data - Tales From The Inside
Collecting & Temporal Analysis of Behavioral Web Data - Tales From The InsideCollecting & Temporal Analysis of Behavioral Web Data - Tales From The Inside
Collecting & Temporal Analysis of Behavioral Web Data - Tales From The Inside
 
Your enemies use GenAI too - staying ahead of fraud with Neo4j
Your enemies use GenAI too - staying ahead of fraud with Neo4jYour enemies use GenAI too - staying ahead of fraud with Neo4j
Your enemies use GenAI too - staying ahead of fraud with Neo4j
 
Working together SRE & Platform Engineering
Working together SRE & Platform EngineeringWorking together SRE & Platform Engineering
Working together SRE & Platform Engineering
 
ASRock Industrial FDO Solutions in Action for Industrial Edge AI _ Kenny at A...
ASRock Industrial FDO Solutions in Action for Industrial Edge AI _ Kenny at A...ASRock Industrial FDO Solutions in Action for Industrial Edge AI _ Kenny at A...
ASRock Industrial FDO Solutions in Action for Industrial Edge AI _ Kenny at A...
 
Intro in Product Management - Коротко про професію продакт менеджера
Intro in Product Management - Коротко про професію продакт менеджераIntro in Product Management - Коротко про професію продакт менеджера
Intro in Product Management - Коротко про професію продакт менеджера
 
Portal Kombat : extension du réseau de propagande russe
Portal Kombat : extension du réseau de propagande russePortal Kombat : extension du réseau de propagande russe
Portal Kombat : extension du réseau de propagande russe
 
Hyatt driving innovation and exceptional customer experiences with FIDO passw...
Hyatt driving innovation and exceptional customer experiences with FIDO passw...Hyatt driving innovation and exceptional customer experiences with FIDO passw...
Hyatt driving innovation and exceptional customer experiences with FIDO passw...
 
The Value of Certifying Products for FDO _ Paul at FIDO Alliance.pdf
The Value of Certifying Products for FDO _ Paul at FIDO Alliance.pdfThe Value of Certifying Products for FDO _ Paul at FIDO Alliance.pdf
The Value of Certifying Products for FDO _ Paul at FIDO Alliance.pdf
 
Tales from a Passkey Provider Progress from Awareness to Implementation.pptx
Tales from a Passkey Provider  Progress from Awareness to Implementation.pptxTales from a Passkey Provider  Progress from Awareness to Implementation.pptx
Tales from a Passkey Provider Progress from Awareness to Implementation.pptx
 
Using IESVE for Room Loads Analysis - UK & Ireland
Using IESVE for Room Loads Analysis - UK & IrelandUsing IESVE for Room Loads Analysis - UK & Ireland
Using IESVE for Room Loads Analysis - UK & Ireland
 
Where to Learn More About FDO _ Richard at FIDO Alliance.pdf
Where to Learn More About FDO _ Richard at FIDO Alliance.pdfWhere to Learn More About FDO _ Richard at FIDO Alliance.pdf
Where to Learn More About FDO _ Richard at FIDO Alliance.pdf
 
Oauth 2.0 Introduction and Flows with MuleSoft
Oauth 2.0 Introduction and Flows with MuleSoftOauth 2.0 Introduction and Flows with MuleSoft
Oauth 2.0 Introduction and Flows with MuleSoft
 
State of the Smart Building Startup Landscape 2024!
State of the Smart Building Startup Landscape 2024!State of the Smart Building Startup Landscape 2024!
State of the Smart Building Startup Landscape 2024!
 
Secure Zero Touch enabled Edge compute with Dell NativeEdge via FDO _ Brad at...
Secure Zero Touch enabled Edge compute with Dell NativeEdge via FDO _ Brad at...Secure Zero Touch enabled Edge compute with Dell NativeEdge via FDO _ Brad at...
Secure Zero Touch enabled Edge compute with Dell NativeEdge via FDO _ Brad at...
 

Adequate securitynew1404.019

  • 1. WHAT IS AN ADEQUATE LEVEL OF SECURITY? Wivenhoe Management Group
  • 2. What is an Adequate Level of Security? There is clearly a substantial difference in protecting a facility from persons intent on destroying the infrastructure to those intent on defacing it. Defining that difference is critical Wivenhoe Management Group
  • 3. Factors That Determine An Adequate Level of Security 1. Type of Facility 2. Cost 3. Risk Acceptance 4. Insurance Requirements 5. SVA Recommendations 6. Liability Wivenhoe Management Group
  • 4. Factors That Determine An Adequate Level of Security 1. Basis of Security Understanding 2. Threat Level 3. Accepted Security Industry Standards & Practice 4. Legal Compliance 5. Environment 6. Incident History 7. Other Wivenhoe Management Group
  • 5. Basis of Security Understanding Sandia - Detect, Delay, Respond DHS - Deter, Detect, Delay, Respond Security Industry Experience Keep the Problem Out Deter the Problem Elsewhere Wivenhoe Management Group
  • 6. Threat Level Crime Rate Statistics • Homicide • Rape • Robbery • Aggravated Assault • Crimes Against Persons • Burglary • Larceny • Motor Vehicle Theft • Crimes Against Property Wivenhoe Management Group
  • 7. Accepted Security Industry Standards & Practices Design Criteria Properly Maintained Equipment Training Manufacturer Authorized Installers Proper Lighting Accepted System Design Current Software & Firmware Wivenhoe Management Group
  • 8. Accepted Security Industry Standards & Practices As Built Drawings Response Time to System Failure Back-Up Power Systems Meeting Federal & Local Codes Minimum Video Recording Time Schedules Identifying Types & Quantities of Security Panels Wivenhoe Management Group
  • 9. Accepted Security Industry Standards & Practices Due Diligence Related to Contractors Clear Definition of Performance Requirements Required Installation Permits Electric Surge Protection Wivenhoe Management Group
  • 10. Legal Compliance • Specific Industry Security Requirements • Data Security Requirements • Physical Security Requirements Wivenhoe Management Group
  • 11. Incident History • Five (5) Year History • Type of Incident • Actions Taken • Incident/Serious Breach Wivenhoe Management Group
  • 12. Liability • Standard Law Suit • Negligence • Gross Negligence • Repercussions Wivenhoe Management Group
  • 13. Environment • Crime Rates • Type of Crime Category • Transportation Hub • Nearby Targets • Sensitive Border • Target Vantage Point Wivenhoe Management Group
  • 14. Type of Facility • Hazardous • Strategic Value • Age & Condition • Key Infrastructure • Research Facility • Communication Hub Wivenhoe Management Group
  • 15. Cost • Cost, the Leading Factor • Cost, a Double-Edged Sword • Cost, Lowest Bidder • Cost, Technology Changes Wivenhoe Management Group
  • 16. Risk Acceptance Higher Risk = Less Cost Lower Risk Safe Choice Difference is Liability Wivenhoe Management Group
  • 17. Insurance Concerns Escalating Medical Costs Increasing Value of Assets Ever Present Terrorism Wivenhoe Management Group
  • 18. Insurance Requirements UL Certified Alarm System Data Security Compliance Safety Compliance Cyber Crime Prevention Active Shooter Containment Wivenhoe Management Group
  • 19. SVA Requirements What is an SVA? Security Vulnerability Assessment Wivenhoe Management Group
  • 20. Why Perform An SVA? • Threat Level • Critical Assets • Findings & Recommendations • Federal Grant Funding • Customer Confidence Wivenhoe Management Group
  • 21. Why Perform An SVA? • Counter Liability • Phased Solution • Emergency Planning & Response – Active Shooter – Bomb Threat • Measured Response Wivenhoe Management Group
  • 22. SUMMARY Basis of Security • Deter Detect Delay Respond • Detect Delay Respond Wivenhoe Management Group
  • 23. SUMMARY Many Factors Threat Level Legal Compliance Accepted Standards Environment Incident History Liability Facility Type Risk Acceptance Insurance Cost Security Vulnerability Assessment Wivenhoe Management Group
  • 24. SUMMARY More Important Factors Threat Level Liability Facility Type Legal Compliance Wivenhoe Management Group
  • 25. QUESTIONS Questions can be sent to: David McCann Principal Consultant Wivenhoe Management Group dmccann@wivenhoegroup.com www.wivenhoegroup.com Wivenhoe Management Group