The ESRM Evolution: From "No" to Strategic Risk Management

With a career spanning over thirty years and two disciplines, Tim McCreight has adapted from his roots in physical security, to information security, and now his interest in enterprise security risk management (ESRM). Learn how Tim changed his approach from saying “no” to projects, to focusing on risks facing organizations – and some of his stumbles and successes along the way.

Presentation by: Tim McCreight, International Chair for the Information Technology Security Council with ASIS International

2. int:rsect

The ESRM Evolution:
From "No" to Strategic
Risk Management

Tim McCreight
MSc, CISSP CPP CISA
Director, Strategic Alliances
Above Security -
AHitachi Group Company

3. RESTRICTED

UNDER 17 DEA ACCOMPANYING
DEA OR ADULT GUARDIAN

The following seminar contains coarse
language, violent situations, personal
opinions, and partial speaker nudity.

Viewer discretion is advised.

4. I hone to God
that's Batman

5. Agenda

Quick Intro
Journey to ESRM:
- Before

- During

- Today

Benefits

Next Phase

6. BEFORE

7. The Clipboard Era

Security by survey...

8. What we knew...

- More rigid approach

« Binary response

+ Metrics were
"measurements"

- Able to say "no"
based on the
checklist...

9. Story time...

10. Reactive vs Proactive

Focused more on
identification
not prevention

Could "cancel" a
project if it was going
to "harm" our company

The story of the
turnstile and the
executive...

11. Hard Lessons

Look beyond the "rule"

Not everyone thinks like us

Get rid of "no"

12. DURING

13. New Ideas

14. SECURITY
CONVERGENCE &
Oiianaging LS «

Enterprise Security Risk

15. From this... To this...

16. Gaps Remained...

Looked at blending
security organizations,
but only touched on risk

Still "security" centric

17. TODAY

18. Changes at ASIS

1625 Prin
pr@sssonino og
INTERNATIONAL "00
Advancing Security Worldwide? tor J ONC CAE

NEWS RELEASE

ASIS International Makes Enterprise Security Risk
Management a Global Strategic Priority

Commission established to incorporate ESRM into all ASIS programs and
services

Alexandria, VA 201

(asis
unity Risk

ly manag

ds concepts into all progran

Both a philosophy and management system, ESRI cu
professionals manage the vario ganizations
ooking to shit the profession from a sibed ap curity managemen

19. a A ROTHSTEIN PUBLISHING COLLECTION eBOOK

The Manager's Guide to
Enterprise
Security Risk
Management

Essentials of Risk-Based Security
Brian J. Allen, Esq.

CISSP, CISM, CPP, CFE

Rachelle Loyear

Kristen Noakes-Fry, asc, ito

ET

20. Identify
& Prioritize

Incident
Response

Advance

Mitigate
Prioritized
Risks

Ongoing
Risk
Assessment,

Identify
& Prioritize
Risks

Figure 1-1. The ESRM Cycle

21. BENEFITS

22. Business focused

23. Builds relationships

24. New concepts:
- key stakeholders
- asset owners

- prototyping

25. Consistency in:
- risk management philosophy
- security roles/responsibilities

26. Objective vs. Reactive

Y
=
EE qa Y A

27. Asset centric

28. ie

29. Personal
Thoughts

30. Thank You!

Tim McCreight
MSc, CISSP CPP CISA
Director, Strategic Alliances

Above Security
A Hitachi Group Company

www.abovesecurity.com