Why InnoSec?

Cyber started as an IT function offering point solutions to enhance the security posture of an organization. However cyber is a business issue.  Cyber impacts businesses from reputational, operational, legal and financial aspects.  When a CISO provides a report of 300 vulnerabilities to the board, the board is mystified.  What’s the impact, how do we prioritize remediation and budget?  It’s impossible unless you use objective risk information.  The next level of assurance in cyber is the quantification of cyber risk at the business asset level and programs based on this information.  5% of IT budget is not a strategy.  Guessing at cyber insurance requirements is not a strategy.  We have layered security tools, but we need to know how effective they are.  It’s time to meet the challenge with confidence.

In today’s digital world as home, office and auto become more and more integrated it is critical to be in front of understanding cyber security risks. Total protection is elusive, however a risk based approach that quantifies cyber risk at the business asset is critical to know where and how to focus your efforts.

CEOs, Executives and Boards

CEOs, Executives and Boards own the business assets that companies build their businesses on.  They have been in the dark for years about how cyber security impacts the business.

With the daunting task of fiduciary responsibility, profitability, and overall corporate governance, in your role as Chief Executive Officer (CEO), Executive at the C-Level or as a Board member, you need to know which business assets are most valuable and their level of cyber security risk.  Your challenges include:

· What is our crown jewel asset cyber risk in dollars and cents?

· How effective are our cyber security tools?

· How much cyber security insurance do we need?

· As my business changes through M&A, new cyber risks are added, how can I get visibility into these risks?

The only way to answer all this is to measure risk at the business asset level.

InnoSec’s STORM quantifies inherent and residual cyber risk and aligns it to our cyber strategy, compliance initiatives and vulnerability management.  STORM uses a drag and drop risk engine (DREG).  Unlike other solutions that provide a uni-risk model, STORM can provide multi-risk models at the same time. Nor must you retrofit your risk requirements – we model risk as you require. Unlike other solutions that provide a uni-risk model, STORM can provide multi-risk models at the same time. As evidenced by leading management consulting firms, “Rather than starting with technological vulnerabilities (say, the insufficient patching of servers or routers), they should first protect the most critical business assets or processes (such as customer credit card information)—what we call a “business-back” approach.” McKinsey

No other product can provide multi-risk models that allows executives to balance risk tolerances, inherent cyber risk, controls and cyber insurance.

Chief Information Security Officers (CISOs)

Can you quantify how much cyber risk you have in dollars and cents? Can you show how well your cyber security program is working? Can you go into a meeting with your CEO and board to ask for more budget money, demonstrate why you need it, and walk out with it? Now you can!

How?

With InnoSec you can get asked the tough questions and come out empowered. Our STORM product provides you with business asset risk, vulnerability assessments, remediation planning and execution, budgeting, and a host of other modules and features you have been dreaming about.

As a Chief Information Security Officer (CISO), you are constantly being asked “What risks do we face in terms of liability and direct loss to our business? Your CEO, CFO, Chief Risk Officer, and other executives want to know, “What are the best options to reduce that risk?”

STORM allows you to answer all these questions on the spot. Our modules for business asset risk, vulnerability assessments, cyber budgeting, and remediation prioritization provide immediate information that allows you to focus on priorities that are clear and actionable.

Enterprise Cyber Risk Management

InnoSec’s enterprise offering “STORM” is the most robust cyber risk product on the market. We address all aspects of cyber risk management by quantifying cyber risk and automating all cyber security activities. Our STORM product is available on premise or as SaaS.

InnoSec is the only fully-automated cyber risk management application. Take the CISO challenge below and add up the manual hours spent on all these tasks and then call us quickly! Our technology integrates with

· SIEM

· VMS

· DLP

· CMBD

and provides

· Cyber risk and control mature models

· Template based best practice frameworks and workflows

· Advanced quantitate risk analytics

· Industry specific loss data

Into a unified suite built for business oriented CEOs, Executives, Boards, CROs and CISOs.

How do we set up STORM?

  1. Load your business processes, systems, and data assets
  2. Use our threat and control catalogs
  3. Model your risk scenarios using our drag and drop risk engine (no hard coding!)
  4. Integrate in real time security data from the SIEM, vulnerability scans or audits
  5. Generate risk reports (discover concentrations of risk, track loss exposure over time, and proactively manage your organization’s risk)

How Does a CISO use STORM?

  1. Prioritize vulnerability work
  2. Budget based on risk
  3. Assign remediators to tasks and projects
  4. Communicate with compliance, audit and regulatory
  5. Report to the board on strategy, effectiveness and budget.
  6. Reduce the amount of time spent with auditors by 90%.

Are You Ready for GDPR?

The European Union (EU) General Data Protection Regulation (GDPR) – currently being introduced across Europe and beyond ahead of the May 2018 final implementation deadline – mandates numerous privacy controls designed to protect personal data with fines of up to 4% of annual global turnover or €20 Million whichever is higher. Companies must demonstrate that considerable security measures are in place to protect users’ private data on their systems and the associated risk.

INNOSEC GDPR PRIVACY IMPACT ASSESSMENT (PIA) GDPR Compliance – Privacy Impact Assessment (PIA) Article 5 states that personal data must be processed securely to ensure its integrity & confidentiality. Article 35 states that privacy risks including potential impacts must be assessed, particularly where new technologies/systems/arrangements are being considered, or otherwise where risks may be significant. The toughest component of GDPR is the demonstrating this information at the system level. In order to accomplish this InnoSec’s STORM provides:

· Identification of systems with privacy data and system location – Scope of the assessment

· Demonstration that organizations have implemented, utilize and maintain appropriate technical and organizational security measures for personal info, addressing  the information risks

· Ability to demonstrate that personal data is processed securely to ensure its integrity  and confidentiality of the systems that process privacy data

· Project and task management capabilities to assign remediation activities to individuals  or teams to align security control requirements to GDPR requirements

Our GDPR PIA provides a set of evidence based dashboards that demonstrates the effectiveness of privacy security controls and the risk associated to these systems.

CUSTOMER BENEFITS By implementing the GDPR Solution your organization, you will receive the following benefits:

· “Which systems are in scope for the privacy and risk assessments?”

· “How compliant with GDPR are the security controls of systems with privacy data?”

· “Privacy Risk Assessment (PIA) What level of risk is associated with each system that touches GDPR data?”