Upload
priyanka-aash
View
1.221
Download
1
Embed Size (px)
Citation preview
SecurityMaturityModelsOVERVIEWOFSECURITYMATURITYMODELS
Agenda1. What’saMaturityModel?2. TypesofMaturityModels3. OverviewofSSECMM&CISOPlatformSecurityBenchmarking
What’saMaturityModel?“A maturity model is a set of characteristics, attributes, indicators, or patterns that represent capability andprogression in a particular discipline. Model content typically exemplifies best practices and may incorporatestandards or other codes of practice of the discipline. A maturity model thus provides a benchmark against whichan organization can evaluate the current level of capability of its practices, processes, and methods and set goalsand priorities for improvement.” – C2M2, DOE, US Govt.
How’sitUseful?
ü HelpsDefineaFrameworkforOrganizationstoBaselineCurrentCapabilities/Architecture
ü ConductStandardized,ConsistentEvaluation(s)- IdentifyGaps,BuildRoadmaps;MeasureProgress
ü AllowsOrganizationstoBenchmarktheirCapabilitiesagainstPeers
ü EnablesDecisionMaking- HowtoImprove,PrioritizeinvestmentsinTech,People,Servicesetc.
TypesofMaturityModels1. Progress-basedMaturityModels
1. MeasuresSimpleProgress/AdvanceThroughAscendingLevels(asdefinedbyOrg/Industry)2. E.g.:SimplePassword->StrongPassword->TFA3. Pros:Simple;Cons:MayNOTtranslatetoMaturity
2. CapabilityMaturityModels(CMM)1. PrimarilyMeasurestheDegreetoWhichProcessesareInstitutionalized;StrengthofOrgCulture2. E.g.:SSE-CMM3. Pros:RigorousMeasureofCapabilities;Cons:FalseSenseofAchievement– Maturitydoesnot
equalsecurity
3. Hybrid–1. CombinestheAboveTwo.2. E.g.:CybersecurityCapabilityMaturityModel(ES- C2M2)3. Pro:EasyProgressMeasurement&ApproximationofCapability;Cons:NotasRigorousasCMM
AdaptedfromContentProvidedbyCERTandSoftwareEngineeringInstitute(SSE),CMU.
SomeMaturityModels1. CERTCCResilienceMaturityModel
2. COBIT
3. USDept ofEnergy(DoE)ElectricitySubsectorCybersecurityCapabilityMaturityModel(ES-C2M2)
4. InformationSecurityManagementMaturityModel(ISM3)
5. NISTCSEATITSMM
6. Gartner’sSecurityModel
7. SystemsSecurityEngineeringCapabilityMaturityModel(SSE-CMM)
8. ComputerEmergencyResponseTeam/ChiefSecurityOfficerSecurityCapabilityAssessment(CERT/CSO)
9. CommunityCyberSecurityMaturityModel(CSMM)
10. FFIEC– CybersecurityMaturity
11. OpenSAMM - AppSec
12. BSIMM– AppSec
13. andManyMore…
ISO/IEC21827SystemsSecurityEngineeringCapabilityMaturityModel(SSE-CMM)
Themodelisastandardmetricforsecurityengineeringpracticescoveringthefollowing:
1. Projectlifecycles,includingdevelopment,operation,maintenance,anddecommissioningactivities
2. Entireorganizations,includingmanagement,organizational,andengineeringactivities
3. Concurrentinteractionswithotherdisciplines,suchassystemsoftwareandhardware,humanfactors,testengineering;systemmanagement,operation,andmaintenance
4. Interactionswithotherorganizations,includingacquisition,systemmanagement,certification,accreditation,andevaluation.
Source:SSE-CMM
SSE-CMMDimensionsLevel1- PerformedInformally
Level2– Planned&Tracked
Level3– WellDefined
Level4– QuantitativelyControlled
Level5– ContinuouslyImproving
Source:SSECMM
Sample
Source:SSECMM
CISOPlatformSecurityBenchmarking
◦ Aninsightaboutcompanycurrentcybersecuritypositioningamongthepeers
◦ Aninsightaboutcompanycurrentpositioningintheoverallmarket.◦ HelpstoanalysethegapinCybersecuritystructure◦ Helpsyoutofindoutthestrategicfocusareas◦ NOTaCapabilityMaturityModel
IndiavsWorld• Indiais75to80%atparwithUSAforPrevention/Detectiontechnologies.• Indiaislessthan10%atparwithUSAinResponse• Indiaislessthan10%atparwithUSAforPredictionofbreachesbeforehand.• Indiaislessthan10%atparinadoptionofemergingsecuritytechnologieslike• threatIntelligenceandBigdatasecurityanalytics,RASP,IAST,Containerization/Isolation,AttackDeceptionetc.whencomparedtoUSA.
Industrywisematurity
0 10 20 30 40 50 60 70 80
MinorBFSI
Retail/Online
Manufacturing
Healthcare&Hospitality
FinancialServices
MinorIT/ITES
MajorBFSI
MajorIT/ITES
LargeScaleTelecom
44.95
51.52
52.43
53.13
56.06
59.25
70.16
74.66
76.62
SecurityMaturityIndex
Verticals
SecurityMaturityIndex%
CISOPlatformSecurityBenchmarkingCommunity-basedinitiativewhichhelpsorganizationsbenchmarktheirexistingsecuritypostureagainstthatoftheirpeers/industry(e.g.:BFSI,IT/ITES)anddevelopanactionable,prioritizedroadmapforachievingthedesiredmaturitylevel.
Thetechnologiesarecategorizedinto:◦ Securitycontroltype(Prevent,Detect,response,Predict)◦ Technologyadoptiontype(Basic,Moderate,Advance)
Benchmarking – capabilities inplace
*TheGraphpresentedaboveisonlyindicativeandforsamplepurposesonly
SECURITYAWARENESSANDTRAININGWIRELESSSECURITY
POLICYMANAGEMENTMOBILEDEVICEMANAGEMENT
IAM/PIMAPPLICATION/DATABASESECURITY
SIEMENDPOINTSECURITY
DIGITALRIGHTSMANAGEMENTDLP/DATASECURITY
IDS/IPSPATCHMANAGEMENT
SECUREEMAIL/WEBGATEWAY,CONTENT…STRONGAUTHENTICATION
UNIFIEDTHREATMANAGEMENTANTIMALWARE/ANTISPYWARE
BCP/DRWEBAPPLICATIONFIREWALL
VULNERABILITYMANAGEMENTTHREATINTELLIGENCE
81.82%68.18%
77.27%45.45%45.45%
59.09%59.09%
90.91%31.82%
72.73%86.36%86.36%
100.00%63.64%
59.09%95.45%
61.00%61.00%62.00%
53.00%
CapabilityinPlaceStatistics
VerticalAdoption(%)
Benchmarking - Capabilities notinplace
*TheGraphpresentedaboveisonlyindicativeandforsamplepurposesonly
0.00% 10.00% 20.00% 30.00% 40.00% 50.00% 60.00% 70.00% 80.00%
VerticalAdoption(%)
CapabilityNotinPlaceStatistics
DDOS ITGRCmanagement BioMetric EncryptionforServers/Storage/Database AntiAPT
SomeResourcestoGetYouStarted1. CPSB
2. VendorSpecific,someexamples–1. nCircle2. Veracode3. KPMG - CyberKARE
3. BSIMM- https://www.bsimm.com/
4. OpenSAMM- http://www.opensamm.org/
5. https://buildsecurityin.us-cert.gov
6. C2M2- http://energy.gov/oe/services/cybersecurity/cybersecurity-capability-maturity-model-c2m2-program/cybersecurity
ThankYou!