LDR514: Security Strategic Planning, Policy, and Leadership™

Overview

Creating security strategic plans requires a fundamental understanding of the business and a deep understanding of the threat landscape. Deciphering the history of the business ensures that the work of the security team is placed in the appropriate context. Stakeholders must be identified and appropriately engaged within this framework. This includes understanding their motivations and goals, which is often informed by the values and culture your organization espouses. Successful security leaders also need a deep understanding of business goals and strategy. This business understanding needs to be coupled with knowledge of the threat landscape - including threat actors, business threats, and attacker tactics, techniques, and procedures - that informs the strategic plan.

Exercises

• Lab 1.1: CISO First Impression
• Lab 1.2: Strategy Map
• Cyber42 Round 1 Challenge #1: Cloud Migration Buy-In
• Cyber42 Round 1 Challenge #2: Stakeholder Session A
• Cyber42 Round 1 Challenge #3: Crown Jewels
• Cyber42 Round 1 Challenge #4: Prioritizing Threat Defense

Topics

Strategic Planning Overview

• 30-60-90 Day Plan
  • Building a plan for your leadership, your team, and for yourself

Decipher the Business

• Historical Analysis
  • Analyze the past in order to understand the probable future
• Values and Culture
  • Understand the values and culture of your organization in order to align security with the corporate culture and define acceptable working norms
• Stakeholder Management
  • Learn to identify, understand, and manage stakeholders in order to make the security team more successful
• Asset Analysis
  • Understand assets that are most valuable to the business and are of interest to attackers
• Business Strategy
  • Use a strategy map to understand how to align with business objectives

Decipher the Threats

• Threat Actors
  • Understand attacker motivations and techniques
  • Review real-word attack scenarios

Political, Economic, Social and Technological (PEST) Analysis

• Identify business threats

Threat Analysis

• Learn how the Intrusion Kill Chain and MITRE ATT&CK inform strategic planning

Overview

With a firm understanding of the drivers of business and the threats facing the organization, you will develop a plan to analyze the current situation, identify the target state, perform gap analysis, and develop a prioritized roadmap. In other words, you will be able to determine (1) what you do today (2) what you should be doing in the future (3) what you don't want to do, and (4) what you should do first. Once this plan is in place, you will learn how to build and execute it by developing a business case, defining metrics for success, and effectively marketing your security program.

Exercises

• Lab 2.1: Mission Statement
• Lab 2.2: Roadmap Development
• Cyber42 Round 1 Challenge #5: Stakeholder Session B
• Cyber42 Round 1 Challenge #6: Dropbox or Bust
• Cyber42 Round 1 Challenge #7: Making Your Case
• Cyber42 Round 1 Challenge #8: Make Metrics Matter

Topics

Define the Current State

• Vision and Mission
  • What they tell you about the organization
  • Develop a Security Team Mission Statement that Aligns with Organizational Goals
• SWOT Analysis
  • Analysis of strengths, weaknesses, opportunities, and threats (SWOT)
  • Understanding of current SWOT

Develop the Plan

• Vision and Innovation
  • Sustaining versus disruptive innovation
  • Jobs to be done theory
  • Learning to innovate with the business
  • How to provide value to stakeholders
• Security Framework
  • NIST Cybersecurity Framework
  • NIST 800-53
  • CIS Critical Security Controls
  • Measuring maturity

• Roadmap Development
  • Gap analysis
  • Security roadmap
• Business Case Development
  • Approaches to obtaining funding

Deliver the Program

• Security Metrics Program
  • Developing effective metrics
• Marketing Best Practices
  • Promoting the work of the security team
• Board and Executive Communications
  • Board of Directors Concerns
  • What Top CISOs Include in Updates to the Board
  • Board Presentation Goals

Overview

Policy is one of the key tools that security leaders have to influence and guide the organization. Security managers must understand how to review, write, assess, and support security policy and procedures. This includes knowing the role of policy in protecting the organization along with its data, systems, and people. In developing policy, you also need to know how to choose the appropriate language and structure so that it fits with your organization's culture. As policy is developed you must manage the entire lifecycle from approval and socialization to measurement in order to make necessary modifications as time goes on. This is why assessing policy and procedure is so important. Policy must keep up to date with the changing business and threat landscape. This includes coverage of technologies like Generative Artificial Intelligence (GenAI).

Exercises

• Lab 3.1: Vulnerability Management Policy
• Lab 3.2: Cloud Computing Policy
• Cyber42 Round 2 Challenge #9: Where's the Policy?
• Cyber42 Round 2 Challenge #10: Stakeholder Session C
• Cyber42 Round 2 Challenge #11: Unexpected AI
• Cyber42 Round 2 Challenge #12: Cloud Storage Policy

Topics

Purpose of Policy

• Role of Policy
• Establishing Acceptable Bounds for Behavior
• Empowering Employees to Do the Right Thing
• How Policy Protects People, Organizations, and Information

Develop Policy

• The Policy Pyramid and Policy Governance Lifecycle
• Language of Policy
• Policy Structure
• Policy and Culture
• Define Requirements

Define Requirements

• Gather Data
• Consider All Use Cases

Define Requirements

• Understand Technology Changes
• Generative AI (GenAI) Security Scoping Matrix
• LLM Application Architecture
• OWASP Top Ten for LLMs
• EU Artificial Intelligence Act
• U.S. Executive Order on Artifical Intelligence
• Characteristics of Trustworthy AI

Managing Policy

• Approve, Socialize, and Measure Policy

Assess Policy and Procedure

• Using the SMART Approach
• Policy Review and Assessment Process

Overview

This course section will teach the critical skills you need to lead, motivate, and inspire your teams to achieve your organization's goals. By establishing a minimum standard for the knowledge, skills, and abilities required to develop leadership, you will understand how to motivate employees and develop from a manager into a leader.

Exercises

• Lab 4.1: Management and Leadership
• Lab 4.2: Performance Review
• Lab 4.3: Delegation
• Cyber42 Round 3 Challenge #13: The First Team Meeting
• Cyber42 Round 3 Challenge #14: Stakeholder Session D
• Cyber42 Round 3 Challenge #15: Strategic Communications
• Cyber42 Round 3 Challenge #16: Employee Interactions

Topics

Why Choose Leadership

• Understanding Leadership
• Leadership Building Blocks

Leadership Essentials

• Situational Leadership
• Generational Perspectives
• Building Trust
• Servant Leadership

Effective Communications

• Communication Process
• Active Listening
• Providing Feedback
• Challenging Conversations

Build Effective Teams

• Creating and Leading Teams
• Learning to Delegate
• Coaching, Mentoring, and Sponsorship

Leading Change

• Psychology of Change
• Organizational Change

Overview

Using case studies, students will work through real-world scenarios by applying the skills and knowledge learned throughout the course. The case studies are taken directly from Harvard Business School, which pioneered the case study method. The case studies focus specifically on information security management and leadership competencies. The Strategic Planning Workshop serves as a capstone exercise for the course, enabling students to synthesize and apply concepts, management tools, and methodologies learned in class.

Exercises

• Case Study Analysis #1
• Case Study Analysis #2
• Cyber42 Round 4 Challenge #17: Shutdown and Rebuild
• Cyber42 Round 4 Challenge #18: Attack Aftermath
• Cyber42 Round 4 Challenge #19: Metrics and Maturity
• Cyber42 Round 4 Challenge #20: Merger Due Diligence
• Cyber42 Round 4 Challenge #21: Executive Presentation

Topics

Case study topics include:

• Creating a Presentation for the CEO
• Briefing the Board of Directors
• Creating a Strategic Plan
• Understanding Business Priorities
• Enabling Business Innovation
• Effective Communication
• Stakeholder Management