Risk and Security LLC

Risk Assessments, Training and More

This content shows Simple View

Caroline Ramsey-Hamilton

Data-Driven Security – Using Metrics to Focus & Target Security Programs

Posted on February 9, 2012 6:34 pm by Caroline Ramsey-Hamilton Comment

Security programs can be dramatically improved by using a metrics-based assessment to focus them on the areas of greatest threat, and to use metrics as a management tool to keep the security program targeted on the areas that need the most attention.

Using a data-driven approach – that is, using real numbers to measure
and quantify security, always results in tangible improvements.

Management of a security program is no different than management of any other department, whether it’s human resources, cash flow, employee productiveness, profitability, or any other set of metrics that organizations use to measure how well something is being done, and how it could be improved.

Security officers may complain that management is not listening to their complaints, including not making enough money available to implement new technology, or to fix a loophole that has the potential to create havoc in the organization.

Most security conferences feature sessions with titles like “How to Sell Security to Management” and try to address this disconnect between senior management and their security programs. Peter Drucker, the world famous management consultant, said “If you can’t measure it, you can’t manage it.”

Fortunately, recent improvements in security technology and in development of wider reporting of threats and vulnerabilities, allow management metrics to be applied to the management of the security program to target the program to be maximally effective, to focus the available dollars in the areas which would provide the most protection for the least amount of money, and to prioritize the controls that need to be implemented,  based on their return on investment.

Risk assessments are the foundation of a data-driven security program. Through the process of risk assessment, managers can measure the effectiveness of the organization’s total security program, including analyzing the value of the organizational assets, the threat level (based on the mission of the organization), the existing vulnerabilities, and the effectiveness of existing controls.

Basing the risk assessment on the concept of data-driven security means that real numbers are used in the following areas:

1.  Determining the value of the assets of the organization, including the facilities, the personnel, the security systems and the current controls.

2.  Analyzing the Threat Level, based on either internal incident reports, or industry data, including the Uniform Crime reports. 

3. Identifying vulnerabilities in the organization, including surveying individuals at every level of the organization, from the local facility manager to the CEO to find out how they are implementing security in their workplace.

4. Identifying potential categories of loss, which help focus the security program on the problem areas.

5. Analyzing current Controls that are currently in place, or that could be added to protect an organization.

By gathering data in these 5 categories, it becomes possible to run scenarios that pair the threat and vulnerability, match it to organizational assets, analyze the loss potential, and evaluate the cost effectiveness of a variety of different controls and prioritize security controls by “bang for the buck”.

Using data-based security builds a bridge between executive management and the security professionals in the organization who now have an avenue for open communication and consideration of the role of security throughout the organization.

 

 

 



Another Look at OSHA & Workplace Violence

Posted on February 1, 2012 7:45 pm by Caroline Ramsey-Hamilton Comment

I just finished reading a new book called HALT THE VIOLENCE, written and edited by Patricia Biles and her Alliance Against Workplace Violence group.  Here are some of my thoughts on it, if your organization has been evaluating workplace violence issues:

Here’s my review and why I think you should get it (Amazon) and take a look – it’s a short read — less than 150 pages.

I like the insider perspective on how to prevent violence in the workplace. Patricia Biles was a former OSHA (U.S Occupational Safety and Health Administration) employee and their guru on violence issues.  Her work with industry groups and individuals has given her rare insight on the subject of stopping the epidemic of violence, and she gives practical solutions that employers and individuals can use to halt the violence.

The book covers the escalation of violence in the workplace and how OSHA reacted to the problem, which came to the forefront in 1989.  She identifies the groups most affected by violent events at work, including nurses, healthcare workers, taxi drivers, convenience stores, and late night retail establishments in particular.

As well as covering a complete history of the issue, she also weaves together input from other experts who specialize in aspects of the overall workplace violence problem, including the problem of violence in hospitals,  the increased incidents of bullying in the workplace, the importance of early intervention and practical strategies for diffusing angy, aggressive individuals.

The important of risk management procedures, such as performing regular threat assessments is identified as one of the few ways to identify individuals who may pose a threat, although the authors point out that both the Virginia Tech shooter and Jared Loughner, the diagnosed schizophrenic who shot Gabby Giffords, her staff, and innocent bystanders in Tucson, were both examined, and had psychological profiles which stated they were ‘unlikely’ to be a threat to others.

Specific violence-prone workplaces are also identified and specific recommendations given for hospitals, home health and social workers, and educational institutions such as schools, colleges and universities.

In some ways, this is an insider’s book because it gives you the behind-the-headlines details, not only of major workplace violence incidents, but also a look at what it takes to create new laws and encourage congress and federal agencies to recognize the problem and take concrete steps to ‘halt the violence’!

All in all, this is a very insightful and practical look at a problem that affects every workplace and every person who goes to work and counts on returning home in the same condition.  Employers will want to implement the suggestions in the book on how to reduce violence in individual organizations, and it also offers a valuable perspective on how to comply with new OSHA standards and they continue to evolve their approach to this critical issue.

 



Threat Modeling is the Exciting, Sexy Part of Risk Assessment

Posted on January 26, 2012 6:09 pm by Caroline Ramsey-Hamilton Comment

As a risk assessment professional, when I get into a risk discussion, most security people want to talk about THREAT!  Threat is the most sexy and exciting part of doing a risk assessment.

Threats are exciting all by themselves.  Think about all the threats you can name:

All the natural disasters like Earthquakes, Tornadoes, Storms, Hurricanes, Tsunamis, Lightning, Floods

Crimes like Homicide, Assault, Rape, Burglary, Theft, Kidnapping, Blackmail, Extortion

Terrorism like Sabotage, Explosions, Mail Bombs, Suicide Bombs

All the IT Threats like Malicous Code, Disclosure, Data Breaches, Theft of Data

And about 50 more including Chem/Bio incidents, Magnetic waves, High Energy Bursts, Microbursts, Contamination and Reputation Damage.

Each of these threats could theoretically occur at any time, but we try to establish a pattern of how often they have occurred in the past, in this location, in this county, in this country, in the company, etc.   So NASA, for example, gets thousands of hacker attacks, but another company, like the local Salvation Army, gets 1 every 10 years.

Same model for natural disasters, although you might have to factor in climate change, it’s easy to get the threat incidents for hurricanes in Florida, snow storms in Cleveland, earthquakes in northern California, etc.

We also like to examine industry specific data to see if some threats are higher in a certain industry, like the high incidence of workplace violence incidents in hospitals and high risk retail establishments (like Wawa or 7-11).

Another factor we use in calculating threat likelihood is how the threat could actually affect different types of assets…. for example, would an earthquake damage a car?  Probably not. Would it cause damage to an old historical building – probably (unless it had been retrofitted).  Could it cause loss of life, or injuries (think Haiti).

So I use a multidimensional model that takes the threats list (I have a standard list of 75 threats that I use), and map it to each potential loss, based on the ‘asset’ that might be affected.

The more data you get, the better your model will be, and the more value it will have as a decision support tool!

 



Why Violence in Hospitals is Increasing

Posted on January 9, 2012 5:13 pm by Caroline Ramsey-Hamilton Comment

Why Violence in Hospitals is Increasing

Violence is not a concept that people usually associate with hospitals.  For years, hospitals have been seen as almost a sanctuary of care for the sick and wounded in our society.   However, the perception of hospitals has been changing over the last fifteen years due to a variety of factors. 

  1. Doctors are no longer thought of as “Gods”.  This means they are
          are more easily blamed when a patient’s condition deteriorates.
     
  2. Hospitals are now regarded as businesses.  This perception has been
           been aggravated by television in shows like a recent “60 Minutes”, as well as
           by the effects of the recession on jobs and the loss of health insurance.
  3. Lack of respect and resources (funding) for hospital security departments
              Rather than being seen as a crucial protection for the hospital staff and
          patients, many security departments are chronically underfunded and used
          for a variety of non- security functions, such as making bank deposits for
          the hospital gift shop. 
  4. ASIS Security Association issued it’s industry guidelines for Workplace
         Violence     Prevention in September 2011, in conjunction with the SHRM – the
         Society for Human Resources Management to address this issue.

    The federal government   issued a guidance document for dealing with violence issues in healthcare,   OSHA 3148.01R, 2004, Guidelines for Preventing Workplace Violence for Health Care & Social Service Workers.

To Learn more:  join my webinar on Thursday, January 12th at 12 noon Eastern time by
       Clicking on this link:  https://www2.gotomeeting.com/register/835835290.



No Way to Win an Election – A Risk Assessment

Posted on January 2, 2012 3:57 pm by Caroline Ramsey-Hamilton Comment

Watching the pandemonium that is the build up to the Iowa Caucus, you can follow the thread that pandering and trying to appeal to the lowest common denominator brings to the Iowa Caucus candidates.

They have taken what could have been an asset, and transformed it into the threat that each of the candidates seems to be fixated on –  that they will not be considered ‘enough of a social conservative’ and so will not win the caucus. 

So, by having a field of five (Paul, Newt, Santorum, Perry and Bachman) competing to be the most dogmatic, the most restrictive, the most anti-abortion, the most anti-immigrant, the most family-oriented, etc., they have actually pared down their own chances of winning.

Romney is running in the slightly more moderate vertical, which no one wants to compete in because it’s not such a knee-jerk distinction, which is why I left him out of this analysis.

In risk assessment terns, this means they have focused on addressing the wrong potential threat (not being conversative enough), and failed to address the real threat (losing the election or coming in dead last).

For the field of five, it turns out that by directly competing against each other, they energize their narrow social conservative vertical and that keeps all five of them alive, and the eventual  outcome is the splintering of that narrow field, which effectively prevents any one of them from anything close to a clear win.

It may be a great way to promote yourself for a later VP slot, or, who knows, maybe a future ambassadorship, but it’s NO WAY TO WIN AN ELECTION!

 



Outlook on Risk & Security Compliance in 2012 – What to Expect.

Posted on January 1, 2012 6:59 pm by Caroline Ramsey-Hamilton Comment

This New Year’s Eve, I thought at times my neighbors were using a rocket launcher and several assault rifles to shoot up the New Year.  Lucky for me,  I spent the awake time to contemplate the outlook for risk, threat and security issues for 2012 and here’s what I see for 2012.

1.  Government-Mandated Compliance Is Here to Stay for the Healthcare Industry.

I remember when the IT departments are many hospitals thought George W. was going to revoke the HIPAA Security Rule.  It never happened, and this year, for the first time, there is a regulatory body in place that is intent on REAL ENFORCEMENT.

The Dept. of Health & Human Services, Office of Civil Rights,  has expanded HIPAA Security and Privacy Rules to include “Business Associates” including lawyers working in healthcare, and the infamous “3rd Party Providers” who do everything from warehouse data to taking over the IT function of a hospital, and this trend will continue as pressure builds from consumers who’s medical and financial data continues to be compromised.

2.  Workplace Violence Prevention will become an OSHA mandate, if not in 2012, at least by 2015.  Based on the slug-like pace of OSHA, who only recently provided directives for high risk industries, and the pressure from the more than 30 states who have passed their own regulations,  the pressure to stop the number of incidents and to lower their intensities will increase and management will be forced to address it as a major corporate issue.

3.  Pressure on the financial industry to protect consumer information will increase.  Like many other areas, pressure is increasing to prevent the enormous data breaches we saw in 2011, like Tricare, the recent Stratfor hack by Anonymous, Wikileaks and HealthNet breaches.  Consumers are the squeaky wheel and they want the convenience of plastic and internet use, and they will not tolerate breaches, and they are all registered voters!

The FFIEC has already tightened up on both risk assessment standards, as well as
authentication guidelines for all financial institutions.

 

There will be a increase in requirements for risk assessment as an accountability feature to force managers to maintain better security in all areas of their organizations. 

Accountability means that individual managers will be held responsible for the decisions they make regarding other people’s:

1.  Financial Data

2.  Medical Records

3.  Safety from both Violence & Bullying in their workplaces.

Budgets can be cut, and staff can be reduced but consumers are demanding protection of their information, and themselves, and the regulators will make sure they get it in 2012!



What’s the Risk of Backing Newt Gingrich?

Posted on December 15, 2011 3:31 pm by Caroline Ramsey-Hamilton Comment

Hundreds of the shakers and movers in the Republican party AND the Democratic party are doing their risk assessments this week on who to openly support, and doing the risk calculation on whether it is better to wait and see what emerges, or make their comments/endorsements now and worry about the fall out later!

Here is the kind of risk model for politics that people use, often unconsciously- to make those decisions. Political risk is especially tricky because there are 2 stakeholders to consider:

1. what’s good for ME personally
2. what’s good for THE PARTY, DISTRICT, or COUNTRY.

Here’s a list of threats that politicians worry about in a situation like this:

1. Lose my current position
2. Lose my Power in the Party/Coalition/Media
3. Lose campaign contributions
4. Lose voters
5. Lose tea party support
6. Lose respect from peers
7. Lose future election
8. Lose income
9. Look wrong in the media
10. Create bad sound byte
11. Face Reprisals Later from Establishment
12. Lose Media Support (however it exists).

More tomorrow on how to value the assets of an ongoing campaign.



Crime and Punishment II – Sentencing of Rod Blagojevich

Posted on December 7, 2011 6:01 pm by Caroline Ramsey-Hamilton Comment

Today marks a historic day in the State of Illinois.  While the previous governor is still in prison on corruption charges, out-going, loud-mouth Rod Blagojevich is in court to receive his sentence on federal corruption charges.

This is a great moment for the judge and the judicial system to hand out a sentance that will help PERMANENTLY end the endemic corruption in the Illinois executive branch.

Americans always point out corruption issues in other countries — but this is the MidWest — the Heartland of America.  In fact, I know people who ONLY hire people from the midwest because they think they are more honest and more hardworking.

So I hope that this verdict will uphold justice because I firmly believe that a country is only as good as it’s justice system.  It defines everything else that happens (read my previous post on the SEC failures to enforce).

Every judicial decision, even a non-decision, sends out a strong message to the next potential corrupt politican that the State of Illinois, and the US as a whole, cannot allow corruption in our elected officials!

 



HAS 60 MINUTES EXPOSED THE SEC SECRET – No Penalties for Big Banks?

Posted on December 5, 2011 5:06 pm by Caroline Ramsey-Hamilton Comment

On Sunday evening, December 5th,  60 MINUTES aired what I think is a ground-breaking bit of investigative reporting on how the SEC allowed big banks and mortgage companies to violate Sarbanes Oxley (SOX) requirements with total impunity.

Since the American public is still suffering from the mortgage meltdown – they are looking for answers and looking for punishment.  Crime and punishment usually go together in the Justice Department and law enforcement communities.

“You do the Crime – You do the Time”.

So one person is arrested for a victimless crime, like shoplifting a candy bar, but a big company, like Countrywide, or Bank of America, can crash a worldwide economy, lie on federal forms, commit perjury and saw intense financial destruction to millions of people, and they are allowed to keep the fortunes they made through this risky behavior, and, even better, there’s no jail time, no fines commensurate with crime, and no penalty for openly flaunting federal laws!!

WOW – what kind of message does this send?

For me, concerned day after day with helping organizations comply with federal mandates and laws, like SOX, and HIPAA, and OSHA, this makes a parody of compliance enforcement.

Companies spend millions of dollars to comply with these regulations, which are passed to protect the American public from exactly what just happened.  To find that the regulators are the ones who ignored the falsified attestations, forgave the lack of compliance and let these 21st century robber barons keep their ill-gotten gains makes me, and about 200 million other people, sick!

 



Why Influence/Visibility is Now the Name of the Game

Posted on November 8, 2011 8:55 pm by Caroline Ramsey-Hamilton Comment

Why would a woman go public with accusations after a grope that happened fourteen years ago? I watched a woman this morning reporting her alleged incident with Gloria Allred glued to her side.

I can’t help but think — what is she getting out of this? Maybe she’s jobless and needs a new gig. Maybe she just wants her 15 minutes of fame. (By my calculations, she has used up only 8 minutes of her 15 min. fame allowance).

I started thinking whether you call it ‘FAME’, VISIBILITY”, or anything else — such as overexposure, hogging the spotlight, etc., it is the new currency and it is as potent as money.

If you don’t believe me, think about Joe the Plumber, plucked by McCain from total obscurity and now running for Senate! Just visibility is to blame for that — not intelligence, not good looks (sorry, Joe), not personal moral vision, nothing but the media minutes you can accumulate.

Lots of people get their chance, and 99 % fade back into obscurity, or become a little bigger fish in their tiny pond, but there exists with fame/visibility, an opportunity for becoming someone better.

Thining of good examples, I would have to include Jaycee Dugard, Elizabeth Smart, Eliot Spitzer, Michael Steele, the famous Russian spy girl in that group. They took their moment and ran with it.

I hope if I ever get my 5 minutes, I can do as well.




top