Welcome!

Open Source Cloud Authors: Pat Romanski, Mehdi Daoudi, Elizabeth White, Derek Weeks, Prince Kumar

Related Topics: @CloudExpo, Microservices Expo, Containers Expo Blog, Log Management, Cloud Security, SDN Journal

@CloudExpo: Article

Adopting a Comprehensive Risk Management Program

In the Boardroom with...Mr. Rob Wigley, Director, Cybersecurity Consulting Services, HP Enterprise Services, U.S. Public Sector

Rob Wigley is Director, Cybersecurity Consulting Services at HP Enterprise Services, U.S. Public Sector. He has more than 30 years of information technology experience supporting manufacturing, high tech, healthcare, and public sector market segments. For the last 10 years, he has focused on developing and delivering cybersecurity consulting solutions for public sector clients.

SecuritySolutionsWatch.com: Thank you for joining us today, Rob. Can you please tell us a little about your background and your role within HP.

Rob Wigley: I have more than 30 years of information technology experience supporting manufacturing, high tech, healthcare, and public sector market segments. For the last 10 years, as regulatory requirements for information security have increased in association with mounting threats facing government and businesses today, I have focused on developing and delivering cybersecurity consulting solutions for public sector clients. This market has unique IT security requirements and is facing a significant increase of cyber threats. HP Cybersecurity Consulting Services are soundly structured to help our clients manage risks to their environment.

SecuritySolutionsWatch.com: Cybersecurity is front-page news on a daily basis. Attacks and threats may emanate from anywhere, at any time - from well-organized state-sponsored and foreign-operated governments, to lone wolf hackers, and even from natural disasters such as Hurricanes Katrina and Sandy. We seem to be in an environment where it is not "IF" your organization will be exposed to a breach or experience downtime due to a security threat, but "WHEN." What are the minimum "best-practices" that your Cybersecurity Consulting Team recommend for implementation in this very challenging environment?

Rob Wigley: Without question, adversaries have become smarter, better organized, and more persistent as they seek to cause disruptions and access intellectual property and other sensitive information. The number of cyber threats is proliferating faster than many organizations can defend. Many companies and global governments have been subjected to some very sophisticated and targeted attacks, which have had a significant impact on their mission. This includes some recent extremely high-profile breaches conducted by insiders.

In order to address these threats, first and foremost an organization needs to have an effective risk management program supported by senior management, with a strong governance structure, and integrated across all business processes. As businesses look for new growth opportunities and consequently adopt new technologies, the tradeoff becomes uncertainty and risk that could affect their mission and goals. A continuous process of risk management activities should be applied to identify new risks, reassess previously identified risks, and monitor and track the effectiveness of risk mitigation plans.

An often overlooked component of risk management is the benefit of integrating the processes early within the business and technology lifecycle. Doing so helps to identify potential threats and vulnerabilities so they can be addressed from the start in order to prevent security breaches. It's much less costly in terms of financial impact to fix vulnerabilities detected up front in the design and development phases, rather than fix them in production environments or after a security incident. This lifecycle-based risk management approach can also reduce costs, as full risk assessments would not be required as frequently.

Another important aspect of a comprehensive risk management program is that it allows business leaders to make informed decisions when balancing the cost of managing risk. As IT budgets continue to come under scrutiny, a thorough documented risk analysis is necessary to justify the expenditures of implementing risk-based controls. That's why it's critical to describe risk in terms of "risk to the business." The bottom line is that an effective risk management program is one that permeates throughout an organization's culture, including people, processes, technology, and governance.

SecuritySolutionsWatch.com: If possible, may we have a brief overview of the comprehensive risk management services you are able to provide to both public and private sector entities?

Rob Wigley: HP has a set of core services under our Governance Risk and Compliance Consulting Services specifically designed to improve a client's overall risk posture in a cost-effective manner. These include compliance and risk assessment services that evaluate the infrastructure and applications with your agency, or corporate security policies and industry best practice. We perform vulnerability scanning, penetration testing, code review, and comprehensive application threat assessments.

We also perform assessments on the strategic aspects of an information security program. We evaluate the effectiveness of security governance, security strategy, incident management, and an organization's risk management process. This consists of a current state and maturity assessment, a gap analysis, and the development of a strategic roadmap with the end goal of aligning your security program with business requirements and measurably reducing business risk. We also offer Security Discovery Workshops, which are one-day interactive workshops facilitated by senior HP consultants involving both business and IT stakeholders. The objective is to examine your cybersecurity strategy and identify your biggest challenges, looking at how you're currently addressing those challenges, and showing how you can use our maturity model to implement a prioritized roadmap to improve your overall cybersecurity posture.

SecuritySolutionsWatch.com: In your opinion, does a misperception exist within the IT world between the terms "risk management" and "risk assessments"?

Rob Wigley: This is a very good question and one that I find myself explaining quite frequently. A risk assessment is just one step in a risk management framework - the overall process of risk identification and analysis by determining potential threats and vulnerabilities associated with an IT system. Conversely, risk management includes selecting and implementing security controls to reduce risk to an acceptable level, categorizing systems to determine their criticality, and reviewing regulations, and policies and standards affecting the security of the information.

Another very important process with risk management is monitoring security controls. Because of the increased threat landscape and sophistication of attackers, periodic risk assessments are no longer sufficient for many organizations. Continuously monitoring for threats and vulnerabilities has become critical to support risk management decisions.

There are some well-established risk management frameworks and standards that explain in detail the processes with all aspects of risk management and risk assessments. This includes publications from the International Organization for Standardization (ISO) and the National Institutes of Standards and Technology (NIST).

SecuritySolutionsWatch.com: With everything moving into the Cloud, can we take a moment and drill down specifically into Cloud Security? What resources does HP offer its clients to help design and deploy a secure cloud strategy?

Rob Wigley: Many surveys indicate that one of the top concerns organizations have in moving to the cloud is the security of their information. While security concerns are not unique to cloud computing, cloud is just one of many disruptive technology trends that organizations are facing. HP offers a secure comprehensive portfolio for cloud computing from private and virtual private cloud, to public cloud and hybrid environments serving customers in both the private and public sector market segments.

To help clients address their concerns on cloud security, we establish a risk-based approach. First, we assess our client's risk tolerance profile, compliance requirements, operational requirements, organizational capabilities, and resources. We typically do this within HP Cloud and HP Security Discovery Workshops with the client. We then look to transform the client's environment.

To assist in that transformation process, HP Security Architects will help clients in developing a secure reference architecture. This provides a common set of the essential architectural design artifacts that can be tailored to fit the needs of a particular cloud delivery model. It also provides a checklist against which architects and engineers will be able to ensure that they have covered all the necessary security requirements in their design solution. Next, HP consultants implement secure application design and deployment practices and secure data management in the cloud. As I mentioned previously, security needs to be built into the infrastructure and applications early in the design cycle to reduce attack surfaces.

SecuritySolutionsWatch.com: Can you highlight any Cybersecurity process/methodologies HP follows?

Rob Wigley: For our U.S. Public Sector clients, HP routinely uses the NIST Special Publications (800 Series). There's an extensive list of documents developed collaboratively by the government, academic organizations, and the private sector that's available to the public. This ranges from very specific technical requirements and guidance on IT systems to strategic guidance at the organizational and business process level.

HP has developed an Enterprise Security Framework that encompasses end-to-end security. Our end-to-end approach incorporates the capabilities of HP ArcSight, Fortify and TippingPoint, along with our suite of Risk Management Consulting Services and Managed Security Services.

To support our clients with this framework, HP has developed a risk-based methodology: "Assess, Transform, Optimize, Manage" (or ATOM) that helps enable organizations reduce risk in a cost-effective manner. We Assess our client's risk tolerance profile, compliance requirements, operational requirements, organizational capabilities and resources. We then work to Transform our client's environment, structuring and prioritizing their security issues, and then undertaking remediation projects with them. Next, we Optimize and broaden our client's level of security awareness. We help them continually monitor their environment and proactively recommend operational and process improvements that can deliver an optimized security and risk posture. We also Manage the associated transformation programs required to deliver security in the most effective way for the enterprise. In this phase, we can also reduce cost by leveraging our worldwide security operations centers.

SecuritySolutionsWatch.com: Any final thoughts you'd like to share?

Rob Wigley: Cyber threats are real and growing, and most organizations are overwhelmed with the increasing risk to their business. When organizations adopt a comprehensive risk management program, they experience significant benefits in compliance achievement, reduced risk and better decision-making. Risk management is most effective when it's engrained within an organization's culture. The role of senior leaders must be to establish and emphasize the need for a strong risk management program. The failure to do so will pose a significant risk to organizational objectives.

This interview originally appeared in SecuritySolutionsWatch.com. Republished with permission.

More Stories By Liz McMillan

News Desk compiles and publishes breaking news stories, press releases and latest news articles as they happen.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


@ThingsExpo Stories
In his session at @ThingsExpo, Dr. Robert Cohen, an economist and senior fellow at the Economic Strategy Institute, presented the findings of a series of six detailed case studies of how large corporations are implementing IoT. The session explored how IoT has improved their economic performance, had major impacts on business models and resulted in impressive ROIs. The companies covered span manufacturing and services firms. He also explored servicification, how manufacturing firms shift from se...
WebRTC is the future of browser-to-browser communications, and continues to make inroads into the traditional, difficult, plug-in web communications world. The 6th WebRTC Summit continues our tradition of delivering the latest and greatest presentations within the world of WebRTC. Topics include voice calling, video chat, P2P file sharing, and use cases that have already leveraged the power and convenience of WebRTC.
SYS-CON Events announced today that CA Technologies has been named “Platinum Sponsor” of SYS-CON's 21st International Cloud Expo®, which will take place October 31-November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. CA Technologies helps customers succeed in a future where every business – from apparel to energy – is being rewritten by software. From planning to development to management to security, CA creates software that fuels transformation for companies in the applic...
SYS-CON Events announced today that Secure Channels, a cybersecurity firm, will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Secure Channels, Inc. offers several products and solutions to its many clients, helping them protect critical data from being compromised and access to computer networks from the unauthorized. The company develops comprehensive data encryption security strategie...
An increasing number of companies are creating products that combine data with analytical capabilities. Running interactive queries on Big Data requires complex architectures to store and query data effectively, typically involving data streams, an choosing efficient file format/database and multiple independent systems that are tied together through custom-engineered pipelines. In his session at @BigDataExpo at @ThingsExpo, Tomer Levi, a senior software engineer at Intel’s Advanced Analytics ...
Internet-of-Things discussions can end up either going down the consumer gadget rabbit hole or focused on the sort of data logging that industrial manufacturers have been doing forever. However, in fact, companies today are already using IoT data both to optimize their operational technology and to improve the experience of customer interactions in novel ways. In his session at @ThingsExpo, Gordon Haff, Red Hat Technology Evangelist, shared examples from a wide range of industries – including en...
Detecting internal user threats in the Big Data eco-system is challenging and cumbersome. Many organizations monitor internal usage of the Big Data eco-system using a set of alerts. This is not a scalable process given the increase in the number of alerts with the accelerating growth in data volume and user base. Organizations are increasingly leveraging machine learning to monitor only those data elements that are sensitive and critical, autonomously establish monitoring policies, and to detect...
"We're a cybersecurity firm that specializes in engineering security solutions both at the software and hardware level. Security cannot be an after-the-fact afterthought, which is what it's become," stated Richard Blech, Chief Executive Officer at Secure Channels, in this SYS-CON.tv interview at @ThingsExpo, held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA.
To get the most out of their data, successful companies are not focusing on queries and data lakes, they are actively integrating analytics into their operations with a data-first application development approach. Real-time adjustments to improve revenues, reduce costs, or mitigate risk rely on applications that minimize latency on a variety of data sources. Jack Norris reviews best practices to show how companies develop, deploy, and dynamically update these applications and how this data-first...
Intelligent Automation is now one of the key business imperatives for CIOs and CISOs impacting all areas of business today. In his session at 21st Cloud Expo, Brian Boeggeman, VP Alliances & Partnerships at Ayehu, will talk about how business value is created and delivered through intelligent automation to today’s enterprises. The open ecosystem platform approach toward Intelligent Automation that Ayehu delivers to the market is core to enabling the creation of the self-driving enterprise.
The question before companies today is not whether to become intelligent, it’s a question of how and how fast. The key is to adopt and deploy an intelligent application strategy while simultaneously preparing to scale that intelligence. In her session at 21st Cloud Expo, Sangeeta Chakraborty, Chief Customer Officer at Ayasdi, will provide a tactical framework to become a truly intelligent enterprise, including how to identify the right applications for AI, how to build a Center of Excellence to ...
SYS-CON Events announced today that Massive Networks will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Massive Networks mission is simple. To help your business operate seamlessly with fast, reliable, and secure internet and network solutions. Improve your customer's experience with outstanding connections to your cloud.
SYS-CON Events announced today that Datera, that offers a radically new data management architecture, has been named "Exhibitor" of SYS-CON's 21st International Cloud Expo ®, which will take place on Oct 31 - Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Datera is transforming the traditional datacenter model through modern cloud simplicity. The technology industry is at another major inflection point. The rise of mobile, the Internet of Things, data storage and Big...
Because IoT devices are deployed in mission-critical environments more than ever before, it’s increasingly imperative they be truly smart. IoT sensors simply stockpiling data isn’t useful. IoT must be artificially and naturally intelligent in order to provide more value In his session at @ThingsExpo, John Crupi, Vice President and Engineering System Architect at Greenwave Systems, will discuss how IoT artificial intelligence (AI) can be carried out via edge analytics and machine learning techn...
Everything run by electricity will eventually be connected to the Internet. Get ahead of the Internet of Things revolution and join Akvelon expert and IoT industry leader, Sergey Grebnov, in his session at @ThingsExpo, for an educational dive into the world of managing your home, workplace and all the devices they contain with the power of machine-based AI and intelligent Bot services for a completely streamlined experience.
In his session at @ThingsExpo, Arvind Radhakrishnen discussed how IoT offers new business models in banking and financial services organizations with the capability to revolutionize products, payments, channels, business processes and asset management built on strong architectural foundation. The following topics were covered: How IoT stands to impact various business parameters including customer experience, cost and risk management within BFS organizations.
SYS-CON Events announced today that CA Technologies has been named "Platinum Sponsor" of SYS-CON's 21st International Cloud Expo®, which will take place October 31-November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. CA Technologies helps customers succeed in a future where every business - from apparel to energy - is being rewritten by software. From planning to development to management to security, CA creates software that fuels transformation for companies in the applic...
From 2013, NTT Communications has been providing cPaaS service, SkyWay. Its customer’s expectations for leveraging WebRTC technology are not only typical real-time communication use cases such as Web conference, remote education, but also IoT use cases such as remote camera monitoring, smart-glass, and robotic. Because of this, NTT Communications has numerous IoT business use-cases that its customers are developing on top of PaaS. WebRTC will lead IoT businesses to be more innovative and address...
Internet of @ThingsExpo, taking place October 31 - November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with 21st Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The Internet of Things (IoT) is the most profound change in personal and enterprise IT since the creation of the Worldwide Web more than 20 years ago. All major researchers estimate there will be tens of billions devic...
WebRTC is great technology to build your own communication tools. It will be even more exciting experience it with advanced devices, such as a 360 Camera, 360 microphone, and a depth sensor camera. In his session at @ThingsExpo, Masashi Ganeko, a manager at INFOCOM Corporation, will introduce two experimental projects from his team and what they learned from them. "Shotoku Tamago" uses the robot audition software HARK to track speakers in 360 video of a remote party. "Virtual Teleport" uses a...