Читать книгу Critical Infrastructure Risk Assessment - Ernie Hayden MIPM CISSP CEH GICSP(Gold) PSP - Страница 6

Foreword
by Kirk Bailey

Ernie Hayden knows what he’s talking about. I’m not alone in this opinion. There is a long list of his colleagues and appreciative clients in both the public and private sectors who will also salute his expertise and wisdom. If you’re a professional facing the challenge of assessing operational and institutional risks for a client or employer, you should keep this book handy — it’s a heck of a reference and guide. You should use it and you can trust it.

Ernie and I started working closely together not long after the horrible events of 9/11. We had crossed paths professionally a few years earlier, but in 2002 we found ourselves in mutually challenging jobs. I had just been hired as the first ever chief information security officer (CISO) for the City of Seattle and Ernie was hired as the first ever CISO for the Port of Seattle. We both found ourselves immediately overwhelmed with significant risk management challenges exacerbated by limited budgets, lack of useful tools, growing regulation and compliance issues and the typical political realities found in local government operations. Seeking each other out for help was a necessity.

Seattle and the Port of Seattle own and operate significant essential services, facilities, and infrastructure critical to the Pacific Northwest region and the country in general. They represent the foundation of an economic engine for Washington State and the larger regional economy. The scope and size of the critical infrastructure integral to the City’s and Port’s operations is vast.

When I came on board as Seattle’s CISO, local governments across the country were in hyper-reaction mode. Everyone was concerned about what they needed to do to prevent, prepare, and respond to potential terrorist attacks. There was high anxiety about protecting human life, iconic sites, and critical infrastructure. The Federal government was in overdrive trying to build threat information sharing systems and risk mitigation programs. I was working frantically to assess the cybersecurity-related threats and associated risks — especially as it related to critical infrastructure, essential services, and first responder operations. At the Port of Seattle, Ernie was up to his neck with the same scramble.

During the next few years we dug in and learned plenty about how to best assess and manage potent and complex risks. Early on, we knew that simply following government-issued security and operational checklists was not the answer considering the budget and resource issues in play. We forged a new risk management approach that took into consideration some tough realities.

The good news is that we both achieved some successes. Recalling those days, it’s easy for me to say that a primary reason for those successes was Ernie’s passion and energy for his work. He used creative approaches to educate his employer about risk issues and kept the focus on the highest priorities as well as what was achievable. His disciplined approach to problem solving and pragmatic thinking, his constant thirst for learning everything on every related subject, his professional connections, his common sense and sense of humor were a huge lift for our professional workloads and worries.

In 2005, I became the University of Washington’s first ever CISO. I spent the last 15 years of my career working to build the University’s cybersecurity program in a challenging and complex environment. Throughout those years I continued to rely on Ernie’s experience and wisdom. Having Ernie as colleague has been like having a private professional consultant on staff all the time.

Now Ernie has written this book. That’s a very good thing for anyone who will be tasked to perform professional risk assessments. Identifying and understanding risks is not an easy exercise; it is more of a craft than a practice. It requires more common sense, clear thinking, and a touch of imagination to do well. Blindly following checklists in manuals or requirement documents won’t cut it. It requires a methodology and mindset that can bring clarity and wisdom into the final report. That’s what Ernie is sharing in the following pages.

Kirk Bailey

CISO (retired)

University of Washington

Seattle, Washington