it security concerns during a consolidation (merger)€¦ · 04/06/2013 · what you learn from my...
TRANSCRIPT
![Page 1: IT SECURITY CONCERNS DURING A CONSOLIDATION (MERGER)€¦ · 04/06/2013 · What you learn from my experience may help you in a future consolidation of your own Federal Computer](https://reader033.vdocuments.mx/reader033/viewer/2022051914/60062dca01777842d97b67d8/html5/thumbnails/1.jpg)
IT SECURITY CONCERNS DURING A CONSOLIDATION (MERGER)
NIST - Federal Computer Security Program Managers’ Forum June 4, 2013 1
Jim McLaughlin, CISSP Manager, Security Policy & Risk Management US Treasury, Bureau of the Fiscal Service
![Page 2: IT SECURITY CONCERNS DURING A CONSOLIDATION (MERGER)€¦ · 04/06/2013 · What you learn from my experience may help you in a future consolidation of your own Federal Computer](https://reader033.vdocuments.mx/reader033/viewer/2022051914/60062dca01777842d97b67d8/html5/thumbnails/2.jpg)
Overview
This presentation is based upon experience from an actual consolidation at the US Treasury
Your consolidation experience details may vary Some basic areas of concern should be common to
all consolidations It’s possible to leverage a consolidation to improve
risk management What you learn from my experience may help you
in a future consolidation of your own
Federal Computer Security Program Managers’ Forum June 4, 2013
2
![Page 3: IT SECURITY CONCERNS DURING A CONSOLIDATION (MERGER)€¦ · 04/06/2013 · What you learn from my experience may help you in a future consolidation of your own Federal Computer](https://reader033.vdocuments.mx/reader033/viewer/2022051914/60062dca01777842d97b67d8/html5/thumbnails/3.jpg)
4 Points to know for a consolidation
There’s no such thing as natural beauty
It IS about the money
Look BEFORE you leap
People first
Federal Computer Security Program Managers’ Forum June 4, 2013
3
![Page 4: IT SECURITY CONCERNS DURING A CONSOLIDATION (MERGER)€¦ · 04/06/2013 · What you learn from my experience may help you in a future consolidation of your own Federal Computer](https://reader033.vdocuments.mx/reader033/viewer/2022051914/60062dca01777842d97b67d8/html5/thumbnails/4.jpg)
Remember the RMF
Federal Computer Security Program Managers’ Forum June 4, 2013
4
![Page 5: IT SECURITY CONCERNS DURING A CONSOLIDATION (MERGER)€¦ · 04/06/2013 · What you learn from my experience may help you in a future consolidation of your own Federal Computer](https://reader033.vdocuments.mx/reader033/viewer/2022051914/60062dca01777842d97b67d8/html5/thumbnails/5.jpg)
At Treasury, it is about the money
$
Federal Computer Security Program Managers’ Forum June 4, 2013
5
![Page 6: IT SECURITY CONCERNS DURING A CONSOLIDATION (MERGER)€¦ · 04/06/2013 · What you learn from my experience may help you in a future consolidation of your own Federal Computer](https://reader033.vdocuments.mx/reader033/viewer/2022051914/60062dca01777842d97b67d8/html5/thumbnails/6.jpg)
Bad Risk Management
Federal Computer Security Program Managers’ Forum June 4, 2013
6
![Page 7: IT SECURITY CONCERNS DURING A CONSOLIDATION (MERGER)€¦ · 04/06/2013 · What you learn from my experience may help you in a future consolidation of your own Federal Computer](https://reader033.vdocuments.mx/reader033/viewer/2022051914/60062dca01777842d97b67d8/html5/thumbnails/7.jpg)
Good Risk Management
Federal Computer Security Program Managers’ Forum June 4, 2013
7
![Page 8: IT SECURITY CONCERNS DURING A CONSOLIDATION (MERGER)€¦ · 04/06/2013 · What you learn from my experience may help you in a future consolidation of your own Federal Computer](https://reader033.vdocuments.mx/reader033/viewer/2022051914/60062dca01777842d97b67d8/html5/thumbnails/8.jpg)
A Consolidation Story
From
CONCEPT
to
HAPPILY EVER AFTER
Federal Computer Security Program Managers’ Forum June 4, 2013
8
![Page 9: IT SECURITY CONCERNS DURING A CONSOLIDATION (MERGER)€¦ · 04/06/2013 · What you learn from my experience may help you in a future consolidation of your own Federal Computer](https://reader033.vdocuments.mx/reader033/viewer/2022051914/60062dca01777842d97b67d8/html5/thumbnails/9.jpg)
$aving$
Federal Computer Security Program Managers’ Forum June 4, 2013
9
![Page 10: IT SECURITY CONCERNS DURING A CONSOLIDATION (MERGER)€¦ · 04/06/2013 · What you learn from my experience may help you in a future consolidation of your own Federal Computer](https://reader033.vdocuments.mx/reader033/viewer/2022051914/60062dca01777842d97b67d8/html5/thumbnails/10.jpg)
Announcements made
Federal Computer Security Program Managers’ Forum June 4, 2013
10
![Page 11: IT SECURITY CONCERNS DURING A CONSOLIDATION (MERGER)€¦ · 04/06/2013 · What you learn from my experience may help you in a future consolidation of your own Federal Computer](https://reader033.vdocuments.mx/reader033/viewer/2022051914/60062dca01777842d97b67d8/html5/thumbnails/11.jpg)
Concern Frustrations
Federal Computer Security Program Managers’ Forum June 4, 2013
11
![Page 12: IT SECURITY CONCERNS DURING A CONSOLIDATION (MERGER)€¦ · 04/06/2013 · What you learn from my experience may help you in a future consolidation of your own Federal Computer](https://reader033.vdocuments.mx/reader033/viewer/2022051914/60062dca01777842d97b67d8/html5/thumbnails/12.jpg)
Look at people issues
Federal Computer Security Program Managers’ Forum June 4, 2013
12
![Page 13: IT SECURITY CONCERNS DURING A CONSOLIDATION (MERGER)€¦ · 04/06/2013 · What you learn from my experience may help you in a future consolidation of your own Federal Computer](https://reader033.vdocuments.mx/reader033/viewer/2022051914/60062dca01777842d97b67d8/html5/thumbnails/13.jpg)
Red flags
Federal Computer Security Program Managers’ Forum June 4, 2013
13
![Page 14: IT SECURITY CONCERNS DURING A CONSOLIDATION (MERGER)€¦ · 04/06/2013 · What you learn from my experience may help you in a future consolidation of your own Federal Computer](https://reader033.vdocuments.mx/reader033/viewer/2022051914/60062dca01777842d97b67d8/html5/thumbnails/14.jpg)
FUD happens
Federal Computer Security Program Managers’ Forum June 4, 2013
14
![Page 15: IT SECURITY CONCERNS DURING A CONSOLIDATION (MERGER)€¦ · 04/06/2013 · What you learn from my experience may help you in a future consolidation of your own Federal Computer](https://reader033.vdocuments.mx/reader033/viewer/2022051914/60062dca01777842d97b67d8/html5/thumbnails/15.jpg)
Clarify
Federal Computer Security Program Managers’ Forum June 4, 2013
15
![Page 16: IT SECURITY CONCERNS DURING A CONSOLIDATION (MERGER)€¦ · 04/06/2013 · What you learn from my experience may help you in a future consolidation of your own Federal Computer](https://reader033.vdocuments.mx/reader033/viewer/2022051914/60062dca01777842d97b67d8/html5/thumbnails/16.jpg)
Acknowledgement
Federal Computer Security Program Managers’ Forum June 4, 2013
16
![Page 17: IT SECURITY CONCERNS DURING A CONSOLIDATION (MERGER)€¦ · 04/06/2013 · What you learn from my experience may help you in a future consolidation of your own Federal Computer](https://reader033.vdocuments.mx/reader033/viewer/2022051914/60062dca01777842d97b67d8/html5/thumbnails/17.jpg)
Coping
Federal Computer Security Program Managers’ Forum June 4, 2013
17
![Page 18: IT SECURITY CONCERNS DURING A CONSOLIDATION (MERGER)€¦ · 04/06/2013 · What you learn from my experience may help you in a future consolidation of your own Federal Computer](https://reader033.vdocuments.mx/reader033/viewer/2022051914/60062dca01777842d97b67d8/html5/thumbnails/18.jpg)
Planning
Federal Computer Security Program Managers’ Forum June 4, 2013
18
![Page 19: IT SECURITY CONCERNS DURING A CONSOLIDATION (MERGER)€¦ · 04/06/2013 · What you learn from my experience may help you in a future consolidation of your own Federal Computer](https://reader033.vdocuments.mx/reader033/viewer/2022051914/60062dca01777842d97b67d8/html5/thumbnails/19.jpg)
Moving on
Federal Computer Security Program Managers’ Forum June 4, 2013
19
![Page 20: IT SECURITY CONCERNS DURING A CONSOLIDATION (MERGER)€¦ · 04/06/2013 · What you learn from my experience may help you in a future consolidation of your own Federal Computer](https://reader033.vdocuments.mx/reader033/viewer/2022051914/60062dca01777842d97b67d8/html5/thumbnails/20.jpg)
Bright new day
Federal Computer Security Program Managers’ Forum June 4, 2013
20
![Page 21: IT SECURITY CONCERNS DURING A CONSOLIDATION (MERGER)€¦ · 04/06/2013 · What you learn from my experience may help you in a future consolidation of your own Federal Computer](https://reader033.vdocuments.mx/reader033/viewer/2022051914/60062dca01777842d97b67d8/html5/thumbnails/21.jpg)
The Consolidation
Federal Computer Security Program Managers’ Forum June 4, 2013
21
FMS + BPD Fiscal Service
![Page 22: IT SECURITY CONCERNS DURING A CONSOLIDATION (MERGER)€¦ · 04/06/2013 · What you learn from my experience may help you in a future consolidation of your own Federal Computer](https://reader033.vdocuments.mx/reader033/viewer/2022051914/60062dca01777842d97b67d8/html5/thumbnails/22.jpg)
The Fiscal Service Experience
Federal Computer Security Program Managers’ Forum June 4, 2013
22
Consolidated IT Data Center Closures Realignments (Transfers) Reorganizations Consolidated Bureaus (round 2 for IT) More Reorganizations Relocations (deferred until 2019)
![Page 23: IT SECURITY CONCERNS DURING A CONSOLIDATION (MERGER)€¦ · 04/06/2013 · What you learn from my experience may help you in a future consolidation of your own Federal Computer](https://reader033.vdocuments.mx/reader033/viewer/2022051914/60062dca01777842d97b67d8/html5/thumbnails/23.jpg)
3 Primary Concern Areas
Federal Computer Security Program Managers’ Forum June 4, 2013
23
People
Process
Stuff
![Page 24: IT SECURITY CONCERNS DURING A CONSOLIDATION (MERGER)€¦ · 04/06/2013 · What you learn from my experience may help you in a future consolidation of your own Federal Computer](https://reader033.vdocuments.mx/reader033/viewer/2022051914/60062dca01777842d97b67d8/html5/thumbnails/24.jpg)
People – watch out
Insider threats Declining morale Brain drain
Federal Computer Security Program Managers’ Forum June 4, 2013
24
![Page 25: IT SECURITY CONCERNS DURING A CONSOLIDATION (MERGER)€¦ · 04/06/2013 · What you learn from my experience may help you in a future consolidation of your own Federal Computer](https://reader033.vdocuments.mx/reader033/viewer/2022051914/60062dca01777842d97b67d8/html5/thumbnails/25.jpg)
Process – clarify quickly
Different rules (policies & procedures) FUD becomes daily reality who ? what ?
when ?
where ?
why ?
how ?
Federal Computer Security Program Managers’ Forum June 4, 2013
25
Fear Uncertainty Doubt could be a good thing…
![Page 26: IT SECURITY CONCERNS DURING A CONSOLIDATION (MERGER)€¦ · 04/06/2013 · What you learn from my experience may help you in a future consolidation of your own Federal Computer](https://reader033.vdocuments.mx/reader033/viewer/2022051914/60062dca01777842d97b67d8/html5/thumbnails/26.jpg)
Questions are good ?
Questions indicate engagement People still care if asking questions
Be very concerned if no questions People may no longer care May have greater chance of things going
wrong
Federal Computer Security Program Managers’ Forum June 4, 2013
26
![Page 27: IT SECURITY CONCERNS DURING A CONSOLIDATION (MERGER)€¦ · 04/06/2013 · What you learn from my experience may help you in a future consolidation of your own Federal Computer](https://reader033.vdocuments.mx/reader033/viewer/2022051914/60062dca01777842d97b67d8/html5/thumbnails/27.jpg)
Stuff - secure all the stuff
Federal Computer Security Program Managers’ Forum June 4, 2013
27
Closing data centers Moving equipment New equipment Excess equipment
Property inventory (who owns the stuff now) Architecture (what stuff is ok to get and use) Services (making all the stuff work together) AND MORE …
![Page 28: IT SECURITY CONCERNS DURING A CONSOLIDATION (MERGER)€¦ · 04/06/2013 · What you learn from my experience may help you in a future consolidation of your own Federal Computer](https://reader033.vdocuments.mx/reader033/viewer/2022051914/60062dca01777842d97b67d8/html5/thumbnails/28.jpg)
Focus on People
People are more important than process or stuff Need good people who want to do good
work so that they can use the right processes to handle all the stuff
Define and clearly communicate processes before handling the stuff
Federal Computer Security Program Managers’ Forum June 4, 2013
28
![Page 29: IT SECURITY CONCERNS DURING A CONSOLIDATION (MERGER)€¦ · 04/06/2013 · What you learn from my experience may help you in a future consolidation of your own Federal Computer](https://reader033.vdocuments.mx/reader033/viewer/2022051914/60062dca01777842d97b67d8/html5/thumbnails/29.jpg)
Focus on People
Federal Computer Security Program Managers’ Forum June 4, 2013
29
![Page 30: IT SECURITY CONCERNS DURING A CONSOLIDATION (MERGER)€¦ · 04/06/2013 · What you learn from my experience may help you in a future consolidation of your own Federal Computer](https://reader033.vdocuments.mx/reader033/viewer/2022051914/60062dca01777842d97b67d8/html5/thumbnails/30.jpg)
Get Over, Get Through, Move On
Federal Computer Security Program Managers’ Forum June 4, 2013
30
Positive Mental Attitude Abandon Sunken Ships
Build New Transport Vehicle
Airplane might be better than a ship ? Opportunity for program redesign
![Page 31: IT SECURITY CONCERNS DURING A CONSOLIDATION (MERGER)€¦ · 04/06/2013 · What you learn from my experience may help you in a future consolidation of your own Federal Computer](https://reader033.vdocuments.mx/reader033/viewer/2022051914/60062dca01777842d97b67d8/html5/thumbnails/31.jpg)
Get Over It
Federal Computer Security Program Managers’ Forum June 4, 2013
31
The past is history Let it go Help those clinging too tightly let go Use dealing with change literature Grief stages
denial, anger, bargaining, depression, and acceptance
![Page 32: IT SECURITY CONCERNS DURING A CONSOLIDATION (MERGER)€¦ · 04/06/2013 · What you learn from my experience may help you in a future consolidation of your own Federal Computer](https://reader033.vdocuments.mx/reader033/viewer/2022051914/60062dca01777842d97b67d8/html5/thumbnails/32.jpg)
Get Through It
Federal Computer Security Program Managers’ Forum June 4, 2013
32
Address the people issues Leverage change literature Acknowledge emotional impact Refocus toward planning future Look out for cultural differences
Adapt Build new culture Confirm vocabulary (same words different meanings)
![Page 33: IT SECURITY CONCERNS DURING A CONSOLIDATION (MERGER)€¦ · 04/06/2013 · What you learn from my experience may help you in a future consolidation of your own Federal Computer](https://reader033.vdocuments.mx/reader033/viewer/2022051914/60062dca01777842d97b67d8/html5/thumbnails/33.jpg)
Move On (Focus on Process)
Federal Computer Security Program Managers’ Forum June 4, 2013
33
Look at "the old ways" Look externally for better ways Create future vision Build new processes Start doing "the new ways" Define who does what LEAN / KAIZEN – process improvements
![Page 34: IT SECURITY CONCERNS DURING A CONSOLIDATION (MERGER)€¦ · 04/06/2013 · What you learn from my experience may help you in a future consolidation of your own Federal Computer](https://reader033.vdocuments.mx/reader033/viewer/2022051914/60062dca01777842d97b67d8/html5/thumbnails/34.jpg)
Where Fiscal Service Is Moving
Federal Computer Security Program Managers’ Forum June 4, 2013
34
Simplified policy spreadsheet Risk Management focus
Security Impact Analysis Risk Acceptances Issue Resolution Risk Register Analytics
LEAN / KAIZEN – Better, Faster, Cheaper
![Page 35: IT SECURITY CONCERNS DURING A CONSOLIDATION (MERGER)€¦ · 04/06/2013 · What you learn from my experience may help you in a future consolidation of your own Federal Computer](https://reader033.vdocuments.mx/reader033/viewer/2022051914/60062dca01777842d97b67d8/html5/thumbnails/35.jpg)
Henry Ford quotes to ponder
“Whether you think you can, or you think you can’t,
you’re right.”
“Coming together is a beginning. Keeping together is progress. Working together is success.”
Federal Computer Security Program Managers’ Forum June 4, 2013
35
![Page 36: IT SECURITY CONCERNS DURING A CONSOLIDATION (MERGER)€¦ · 04/06/2013 · What you learn from my experience may help you in a future consolidation of your own Federal Computer](https://reader033.vdocuments.mx/reader033/viewer/2022051914/60062dca01777842d97b67d8/html5/thumbnails/36.jpg)
4 Points to know for a consolidation
There’s no such thing as natural beauty
It IS about the money
Look BEFORE you leap
People first
Federal Computer Security Program Managers’ Forum June 4, 2013
36
![Page 37: IT SECURITY CONCERNS DURING A CONSOLIDATION (MERGER)€¦ · 04/06/2013 · What you learn from my experience may help you in a future consolidation of your own Federal Computer](https://reader033.vdocuments.mx/reader033/viewer/2022051914/60062dca01777842d97b67d8/html5/thumbnails/37.jpg)
Contact Information *
Federal Computer Security Program Managers’ Forum June 4, 2013
37
Jim McLaughlin, CISSP Manager, Security Policy & Risk Management
US Treasury, Bureau of the Fiscal Service 304-480-6149
[email protected] or [email protected]
* Subject to change as consolidation continues.
?