Industry:GIC CISO Survey 2013 - Revision history

Marco-cincy at 03:33, 19 November 2012

2012-11-19T03:33:01Z

Marco-cincy at 03:22, 19 November 2012

2012-11-19T03:22:28Z

Marco-cincy at 03:17, 19 November 2012

2012-11-19T03:17:11Z

Marco-cincy at 03:12, 19 November 2012

2012-11-19T03:12:19Z

Show changes

Marco-cincy at 03:06, 19 November 2012

2012-11-19T03:06:47Z

Marco-cincy at 03:03, 19 November 2012

2012-11-19T03:03:19Z

Marco-cincy at 02:58, 19 November 2012

2012-11-19T02:58:21Z

Marco-cincy at 02:56, 19 November 2012

2012-11-19T02:56:55Z

Marco-cincy at 02:55, 19 November 2012

2012-11-19T02:55:08Z

Marco-cincy at 02:51, 19 November 2012

2012-11-19T02:51:47Z

@@ Line 223: / Line 223: @@
 *C...is aligned with, or integrated into, the organization's IT strategy
 *D...outlines our key security activities for the next 12 months
 == Page 13. Governance and Control (continued) ==
 . Which of the following statements best describes your organization's application security strategy in regards to the risks associated with the increased use of social networking, personal devices, or cloud computing? (choose one)
@@ Line 334: / Line 331: @@
 == Page 19. Optional: Participant Information ==
-* Name of person completing survey: (optional, will be treated strictly confidential)
+(*)We reccomend do not type your first name, last name and email in the survey herein but send it over to the survey's point of contact by email since this information is considered personal identifiable information and we would like to be treated as strictly confidential.
 * Email address: (optional, will be treated strictly confidential and only be used to send you a link to the final survey report after it's completion)
 * Title of delegate completing survey:
 ** Chief Operating Officer
@@ Line 353: / Line 352: @@
 To further refine our survey data by a qualitative component, we would also like to ask whether you would potentially be open for a 30 minute confidential phone interview to further refine certain areas and learn more about your views for future surveys and application security projects that matter to you. All data will be treated as confidential and only be used in anonymous and aggregated form.
-* If you are ok with us contacting you for a 30-minute phone interview, please leave your email address here (again):
+* If you are ok with us contacting you for a 30-minute phone interview, please provide your email address (*) (again):
 Are you aware of the OWASP CISO guide  (link to CISO guide, https://www.owasp.org/index.php/Application_Security_Guide_For_CISOs) ?
-* No
+* A No
-* Yes
+* B Yes
 Are there specific additional areas you would like us to cover in future versions of the CISO guide?
-* No
+*A No
-* Yes
+*B Yes
 (text)
@@ Line 412: / Line 411: @@
 Transportation
 Other: (please specify)
 == Page 21. Thank You ==
 Thank you again for your time and considering in completing this survey. Please contact Tobias Gondrom at tobias.gondrom@owasp.org with any questions or comments regarding the contents of this survey.

@@ Line 327: / Line 327: @@
 == Page 18. This Completes the Survey ==
-This completes the survey. We would appreciate just a few personal and professional details. This will provide us valuable information about your industry and position helping us to analyse the survey data by industry and type of organisation. It will also provide you an opportunity to leave your contact information if you would like us to follow up with you regarding the survey results. Once again, all responses are optional and especially your contact data will be treated as confidential and only for the evaluation of this survey.
+This completes the survey. We would appreciate if could also provide a few personal and professional details. This will provide us valuable information about your industry and position helping us to analyze the survey data by industry and type of organization. It will also provide you an opportunity to leave your contact information if you would like us to follow up with you regarding the survey results. Once again, all responses are optional and especially your contact data will be treated as confidential and used only for the evaluation of this survey
-* Yes, I am willing to take a couple more minutes to assist with survey benchmarking.
-* No, I prefer to exit the survey at this point.
+A.Yes, I am willing to take a couple more minutes to assist with survey benchmarking.
 == Page 19. Optional: Participant Information ==
@@ Line 350: / Line 351: @@
 ** Internal Audit Director/Manager
 ** Other: (please specify)
 To further refine our survey data by a qualitative component, we would also like to ask whether you would potentially be open for a 30 minute confidential phone interview to further refine certain areas and learn more about your views for future surveys and application security projects that matter to you. All data will be treated as confidential and only be used in anonymous and aggregated form.

@@ Line 210: / Line 210: @@
 . For how long does this application security strategy plan ahead?
+*A 3 months
-months, 6 months, 1 year, 2 years, 3 years, 5 years+ (circle one)
+*B 6 months
 . Your application security strategy: (choose all that apply)
@@ Line 234: / Line 238: @@
 . Has your organization implemented an Application Security Management System (ASMS) or Maturity Model (e.g., OWASP SAMM) that covers overall management of application security? (choose one)
-A.Yes, implemented and formally certified/verified by a third party
+*A.Yes, implemented and formally certified/verified by a third party
-B.Yes, without verification
+*B.Yes, without verification
-C.Yes, currently in the process of implementing
+*C.Yes, currently in the process of implementing
-D.No, but considering it
+*D.No, but considering it
-E.No, and not considering it
+*E.No, and not considering it
 == Page 14. Governance and Control (continued) ==
@@ Line 244: / Line 248: @@
 . From the following list of application security standards or frameworks, which are used by your organization? (choose all that apply)
-A.BSIMM
+*A.BSIMM
-B.Capability Maturity Model Integration (CMMI)
+*B.Capability Maturity Model Integration (CMMI)
-C.CLASP
+*C.CLASP
-D.CobIT
+*D.CobIT
-E.COSO
+*E.COSO
-F.Information Security Forum's (ISF) Standard of Good Practice
+*F.Information Security Forum's (ISF) Standard of Good Practice
-G.Information Technology Infrastructure Library (ITIL)
+*G.Information Technology Infrastructure Library (ITIL)
-H.ISO/IEC 27001:2005 27002:2005
+*H.ISO/IEC 27001:2005 27002:2005
-I.MS SDL
+*I.MS SDL
-L.NIST Handbooks (e.g., the "800 Series")
+*L.NIST Handbooks (e.g., the "800 Series")
-M.Octave
+*M.Octave
-N.Open SAMM
+*N.Open SAMM
-O.PCI DSS
+*O.PCI DSS
-P.Other (please specify)
+*P.Other (please specify)
@@ Line 264: / Line 268: @@
 . How does your organization assess the quality and effectiveness of application security? (choose all that apply)
-A.Internal self assessments by IT or application security function
+*A.Internal self assessments by IT or application security function
-B.Assessments performed by other internal function
+*B.Assessments performed by other internal function
-C.Assessment by external party/third party
+*C.Assessment by external party/third party
-D.Formal certification to external security standards
+*D.Formal certification to external security standards
-E.Formal certification to industry security standards (e.g., Payment Card Industry Data F.Security Standard)
+*E.Formal certification to industry security standards (e.g., Payment Card Industry Data F.Security Standard)
-G.Code review and metrics
+*G.Code review and metrics
-H.No assessments performed
+*H.No assessments performed
 . How do you verify that your external partners, service providers or contractors are protecting your organization's information from an application security standpoint? (choose all that apply):
-A.Assessments performed by your organization's application security, procurement or internal audit function (e.g., site visits, security testing)
+*A.Assessments performed by your organization's application security, procurement or internal audit function (e.g., site visits, security testing)
-B.Independent external assessments of partners, vendors or contractors
+*B.Independent external assessments of partners, vendors or contractors
-C.Self assessments or other certifications performed by partners, vendors, or contractors
+*C.Self assessments or other certifications performed by partners, vendors, or contractors
-D.No reviews or assessments performed
+*D.No reviews or assessments performed
 . How you describe your job role/function?
-A.Chief Operating Officer
+*A.Chief Operating Officer
-B.Chief Information Officer
+*B.Chief Information Officer
-C.Chief Application Security Officer
+*C.Chief Application Security Officer
-D.Chief Security Officer
+*D.Chief Security Officer
-E.Chief Privacy Officer
+*E.Chief Privacy Officer
-F.Chief Compliance Officer
+*F.Chief Compliance Officer
-G.Chief Technology Officer
+*G.Chief Technology Officer
-H.Chief Risk Officer
+*H.Chief Risk Officer
-I.Business Unit Executive/Vice President
+*I.Business Unit Executive/Vice President
-L.Information Technology Executive
+*L.Information Technology Executive
-M.Application Security Executive
+*M.Application Security Executive
-N.Network/System Administrator
+*N.Network/System Administrator
-O.Internal Audit Director/Manager
+*O.Internal Audit Director/Manager
-P.Other: (please specify)
+*P.Other: (please specify)
 == Page 16. Governance and Control (Scope of the CISO role) ==
@@ Line 301: / Line 305: @@
 you area of responsibility? (select all the ones that apply to you)
-A.Develop, articulate and implement risk management strategy for applications
+*A.Develop, articulate and implement risk management strategy for applications
-B.Develop and implement policies, standards and guidelines for application security
+*B.Develop and implement policies, standards and guidelines for application security
-C.Develop implement, manage and report on application security governance processes
+*C.Develop implement, manage and report on application security governance processes
-D.Develop and implement software security activities (e.g. S-SDLC) and security testing processes
+*D.Develop and implement software security activities (e.g. S-SDLC) and security testing processes
-E.Work with executive management, business managers and internal audit and legal counsel to define application security requirements that can be verified and audited
+*E.Work with executive management, business managers and internal audit and legal counsel to define application security requirements that can be verified and audited
-F.Measure and monitor security and risks of web application assets within the organization
+*F.Measure and monitor security and risks of web application assets within the organization
-G.Application Vulnerability Management
+*G.Application Vulnerability Management
-H.Network Security and perimeter defense
+*H.Network Security and perimeter defense
-I.Define, identify and assess the inherent security of critical web application assets, assess threats, vulnerabilities, business impacts and recommend countermeasures/corrective actions
+*I.Define, identify and assess the inherent security of critical web application assets, assess threats, vulnerabilities, business impacts and recommend countermeasures/corrective actions
-L.Procure new web application processes, services, technologies and testing tools for the organization
+*L.Procure new web application processes, services, technologies and testing tools for the organization
-M.Application security training and awareness for information security and software development teams
+*M.Application security training and awareness for information security and software development teams
-N.Develop, articulate and implement continuity planning/disaster recovery for web applications
+*N.Develop, articulate and implement continuity planning/disaster recovery for web applications
-O.Investigate and analyze suspected security incidents and data breaches and recommend corrective actions
+*O.Investigate and analyze suspected security incidents and data breaches and recommend corrective actions
 == Page 17: Wishes and suggestions ==

@@ Line 18: / Line 18: @@
 . Given the current threat landscape and the economic environment, do you perceive a change in the threats facing your organization? (choose all that apply) [1-3, increase, same, decrease, don't know:
-A. External attacks or fraud(e.g., phishing, website attacks)
+*A. External attacks or fraud(e.g., phishing, website attacks)
-B. Internal attacks or fraud (e.g., abuse of privileges, theft of information)
+*B. Internal attacks or fraud (e.g., abuse of privileges, theft of information)
-C. No changes noted
+*C. No changes noted
 . Targeting (Infrastructure vs. Applications): In the your current threat landscape, what are the main areas of risk for your organization in % out of 100% in total:

@@ Line 262: / Line 262: @@
 == Page 15. Governance and Control (continued) ==
 . How does your organization assess the quality and effectiveness of application security? (choose all that apply)
-. How do you verify that your external partners, service providers or contractors are protecting your organization's information from an application security standpoint? (choose all that apply)
+. How do you verify that your external partners, service providers or contractors are protecting your organization's information from an application security standpoint? (choose all that apply):
 == Page 16. Governance and Control (Scope of the CISO role) ==
-. CISO Functions & Responsibilities: Which of these functions are within your area of responsibility?
+. CISO Functions & Responsibilities: Which of these functions are within
-* Develop, articulate and implement risk management strategy for applications
+you area of responsibility? (select all the ones that apply to you)
-* Develop and implement policies, standards and guidelines for application security
-* Develop implement, manage and report on application security governance processes
+A.Develop, articulate and implement risk management strategy for applications
-* Develop and implement software security activities (e.g. S-SDLC) and security testing processes
+B.Develop and implement policies, standards and guidelines for application security
-* Work with executive management, business managers and internal audit and legal counsel to define application security requirements that can be verified and audited
+C.Develop implement, manage and report on application security governance processes
-* Measure and monitor security and risks of web application assets within the organization
+D.Develop and implement software security activities (e.g. S-SDLC) and security testing processes
-* Application Vulnerability Management
+E.Work with executive management, business managers and internal audit and legal counsel to define application security requirements that can be verified and audited
-* Network Security and perimeter defense
+F.Measure and monitor security and risks of web application assets within the organization
-* Define, identify and assess the inherent security of critical web application assets, assess threats, vulnerabilities, business impacts and recommend countermeasures/corrective actions
+G.Application Vulnerability Management
-* Procure new web application processes, services, technologies and testing tools for the organization
+H.Network Security and perimeter defense
-* Application security training and awareness for information security and software development teams
+I.Define, identify and assess the inherent security of critical web application assets, assess threats, vulnerabilities, business impacts and recommend countermeasures/corrective actions
-* Develop, articulate and implement continuity planning/disaster recovery for web applications
+L.Procure new web application processes, services, technologies and testing tools for the organization
-* Investigate and analyze suspected security incidents and data breaches and recommend corrective actions
+M.Application security training and awareness for information security and software development teams
 == Page 17: Wishes and suggestions ==

@@ Line 223: / Line 223: @@
 == Page 13. Governance and Control (continued) ==
-. Has your organization implemented an Application Security Management System (ASMS) or Maturity Model (e.g., OWASP SAMM) that covers overall management of application security? (choose one)
+A.Our current application security strategy adequately addresses the risks
-* Yes, implemented and formally certified/verified by a third party
+B.We need to modify our strategy to address the new risks
-* Yes, without verification
+C.We need to investigate further to understand the risks
-* Yes, currently in the process of implementing
+D.We do not see any new or increased risks associated with these technologies
 == Page 14. Governance and Control (continued) ==

@@ Line 184: / Line 184: @@
 == Page 11. Tools and Technology (continued) ==
 . As part of your information security management program, do you...
- 	Currently in use	Planned within 12-18 months	No plans to implement
+A.use a SDLC (Secure development lifecycle)
 == Page 12. Governance and Control ==
 . Does your organization have a documented application security strategy?
-. For how long does this application security strategy plan ahead?
+A.Yes
-months, 6 months, 1 year, 2 years, 3 years, 5 years+
+B.No
-. Your application security strategy: (choose all that apply)
+months, 6 months, 1 year, 2 years, 3 years, 5 years+ (circle one)
-* ...has been reviewed and updated within the past 12 months
-* ...is aligned with, or integrated into, the organization's business strategy
+. Your application security strategy: (choose all that apply)
-* ...is aligned with, or integrated into, the organization's IT strategy
-* ...outlines our key security activities for the next 12 months
+A....has been reviewed and updated within the past 12 months

@@ Line 115: / Line 115: @@
 == Page 8. Relevance of OWASP (continued) ==
-. Which of the following OWASP projects has your organization found useful? (choose all that apply)
+. Which of the following OWASP projects has your organization found useful? (choose all that apply) [1-3, very useful, somewhat useful, not useful for us, don't know it]
+A.AntiSamy
+B.Application Security FAQ
 == Page 9. Challenges for Application Security ==
 . What is the level of challenge related to effectively delivering your organization's application security initiatives for each of the following?
+(Scale of 1-5, where 1 is "not a challenge" and 5 is "significant challenge"), Not a Challenge,Significant Challenge
 == Page 10. Tools and Technology ==
 . Does your organization use any specific technology tools to support the application security management process?
-. Which of the following technology tools does your organization use or are planned to be implemented by your organization to provide application security capability? (choose all that apply)
+. Which of the following technology tools does your organization use or are planned to be implemented by your organization to provide application security capability? (choose all that apply) Currently in use, Planned within 12-18 months,No plans to implement
- 	Currently in use	Planned within 12-18 months	No plans to implement
+A.Web application firewalls
 == Page 11. Tools and Technology (continued) ==