05 Dec Framework Enhancement Proposal

Order Instructions

Transcript :

Enterprise Cybersecurity Program

“Excellent work!” says the CEO as he starts the meeting, holding up the Virtual Currency Applicability Report from your last project.

The senior leaders at the meeting, including the CIO, give you a well-deserved round of applause.

“Thanks. I enjoy my work,” is your polite response.

“I am really glad to hear that,” adds the CEO, “because we aren’t finished just yet. As proposed several weeks ago, you have one last project. I would like you to provide a roadmap, a comprehensive, corporate-wide strategic cybersecurity program.”

“Work closely with the CIO to design this program. The program should incorporate simulation, policy, and technology components. It will also need to be strategically aligned to our corporate mission, not overlooking the unique challenges we have as a global, financial institution.”

“You will need to present and defend your program to the board of directors. We look forward to your results.”

You leave the meeting and return to your office, pleased with the feedback that you have received. As you are thinking about the size and complexity of your new Enterprise Cybersecurity project, the CIO politely taps on the door.

“Got a minute?” he asks.

After congratulating you on the fine work so far, he provides a few details for the new assignment. First, the presentation for the board of directors will be in three weeks. Second, he would like you to record a five- to 10-minute oral presentation of your report to review before the full presentation to the board of directors.

That’s a quick turnaround, but you realize that your other assignments have prepared you for this latest challenge. Time to get to work.

Step 1: Select a Framework

The first order of business in designing an enterprise cybersecurity program is to make a list of what you need to know, an inventory of the key elements to a cybersecurity framework. You will have to assess the cybersecurity posture currently taken at your financial institution. Select the framework you feel your organization is currently using.

Make notes, a paragraph or two, on the specifics of the framework to use in the next step of identifying any vulnerabilities.

Step 2: Identify Current Vulnerabilities

The cybersecurity framework selected in the previous step is only a structure or blueprint of possible solutions. Specific solutions, application, and implementation within a given framework are industry-driven. For example, in response to the credit card fraud in the retail industry, the bank card industry adopted the chip-and-PIN standard for credit cards.

Based on your knowledge of the current state of cyber attack vectors and the notes made in the previous step, create a list of vulnerabilities and how to address them within the chosen framework. Identify both technical and policy options to improve the defense posture of the institution. Add this list to your notes from the previous step. You will use this work in the next step of the project.

Step 3: Prioritize the Vulnerabilities

Now that you have selected a defense framework and identified the type of cyber attack vectors to which your organization may be vulnerable, rank the cybersecurity vulnerability from both a probability of occurrence and financial impact on operations perspective. As you are ranking the vulnerabilities, make notes on your decision process. These notes will come in handy in the next step, where you will design a specific defense for your enterprise.

Step 4: Evaluate the Framework

Review the notes taken regarding which framework should be used and the prioritized vulnerabilities. Thoroughly state the existing framework being applied by your organization. Break down both technology and policy components of the framework and how they complement each other to produce the optimum framework. Consider what works well, what could be improved, and vulnerabilities that are not currently being addressed.

You will build upon this evaluation in the next step.

Step 5: Propose a Framework

Using the framework evaluation from the previous step, identify potential improvements or solutions to missing elements for your financial services organization. The improvements or solutions you identify in this step will be used to design your organization’s framework in a future step.

Submit your Framework Enhancement Proposal for evaluation.