Operational Risk Management Project
Executive Sponsor: Richard Seiersen, ORM Architect
Project Team: Richard Seiersen, Jason Ellis, Carl Koster, Brian Kavanagh, Kevin DePeugh, David Cho, Michael Ruiz
The Operational Risk Management project applies security intelligence within a GRC framework to allow Kaiser Permanente to identify and prioritize actionable security risk. Business intelligence practices are used to automate the collection of enterprise asset data, vulnerability data, and mitigation data into a “single pane of glass.” “Risk tolerance rules,” then operate on the aforementioned data, creating workflow for the purpose of protecting Kaiser's critical assets. The net result is a highly scalable and automated full-stack framework for addressing both vulnerability remediation and associated mitigation up and in the systems stack.
Best-in-Class CSIRT Capability
Executive Sponsor: Mike Kyle, Head of Computer Security Incident Response, Los Alamos National Laboratory
Project Team: Mike Kyle, Mark Lorenc, Russ Nolan,, Kelcey Tietjen, Paul Ferrell
The Los Alamos National Laboratory (LANL) Computer Security Incident Response Team (CSIRT) embarked on a transformation project to build a best-in-class CSIRT capability. The results have been so significant that in addition to reducing remediation time frames by over 90% within an 18 month time frame, the program is actively called on to aid other Department of Energy sites with regard to remediation and recovery following advanced targeted attacks.
ISO Certification
Executive Sponsor: Maria Shaw, Vice President of IT Risk Management & Compliance, McKesson Corporation
Project Team: Michelle Nix, Jennifer Burton and Priya Vunnam
Create and implement strategy to enhance customer attractiveness of utilizing McKesson services by achieving ISO 27001/2 certification.
Identity & Access Management (SAMIAM)
Executive Sponsor: Susan Brennan, Executive, IT & Telecommunications
Project Team: Andrew Feigenson, Robin Heck
SAMIAM was designed as a phased project and is utilized to manage the lifecycle of internal users. Phase 1 involved implementation of a web- and phone-based password syncing system across 10 AIX, Oracle and Active Directory environments. Phase 2 involved an annual corporate policy acceptance system, an automated new user provisioning system and an automated termination system. Phase 3 involved extending existing functionality with 52 additional directories and databases. Phase 4 will involve compliance reviews of existing access by supervisors and business owners.
Video Lifecycle Management
Executive Sponsor: Clint Hilbert, VP of Environmental Health, Safety and Security, Paramount Pictures Corporation
Team Members: Stephan Tiffany, Jeffrey Reider
Location: Scotts Valley, CA
The Paramount Pictures project entailed a technology refresh based upon TimeSight Systems’ Video Lifecycle Management. The project enabled intelligent network video recorders (NVR) to increase the span of surveillance video coverage for the Paramount property, enhance the quality of retained video, greatly extend retention times of that video and lower total cost and size of its surveillance system. For Paramount, the camera count is in the hundreds - a number similar to many medium-sized cities across the United States. In addition, Paramount now has access to video for up to a year from the date of recording, which enables Paramount to perform forensics and reviews instantly.
Enterprise Security Technology Strategy
Executive Sponsor: Craig A. Rosen, Enterprise Security Architect, Senior Principal, Pacific Gas and Electric Company
Project Team: Stephen Zalewski, Scott Decker, Billy Glenn, Tatiana Antontchouk
The Enterprise Security Technology Strategy is a comprehensive technology-focused "living" strategy consisting of three areas of focus for PG&E. These are identity & access management, data & information protection, and network & infrastructure protection. The strategy is designed to provide high-level technology investment direction across all aspects of the company from all enterprise back-office systems to securing the Smart Grid. The strategy is realized over time either through business initiatives or leveraged to launch large-scale information security projects. The strategy significantly helps reduce technology fragmentation across the enterprise by applying an architectural perspective, reduces costs and complexity, promotes cross-organizational collaboration, and clearly aligns security technology investments to the business. This ultimately helps to more rapidly advance the security protection posture for the company.