Exploring the Landscape of Philippine Cybersecurity

Size: px

Start display at page:

Download "Exploring the Landscape of Philippine Cybersecurity"

Gwen York
8 years ago
Views:

Mitigate Cybersecurity Threats Freddy Tan, CISSP

1 Exploring the Landscape of Philippine Cybersecurity Understanding the Risk and Taking Appropriate Steps to Mitigate Cybersecurity Threats Freddy Tan, CISSP Chairperson, (ISC)² Board of Directors Copyright (ISC) 2 All Rights Reserved

(ISC) 2 Overview & Background Global leaders in certifying and educating information security professionals with the CISSP and related concentrations, CSSLP, CAP, and SSCP.

2 (ISC) 2 Overview & Background Global leaders in certifying and educating information security professionals with the CISSP and related concentrations, CSSLP, CAP, and SSCP. Formed in 1989, not-for-profit consortium of industry leaders. Over 86,600 certified professionals in over 135 countries. Click to edit Master title style Board of Directors - top information security professionals worldwide. All of the information security credentials are accredited ANSI/ISO/IEC Standard with the CISSP being the first technology-related credential to receive this accreditation. Copyright , (ISC) 2 All Rights Reserved

3 (ISC) 2 Overview & Background Palm Harbor Headquarters London (Europe) Hong Kong (Asia) Virginia (America) Click to edit Master title style Tokyo (Japan) 4 Regional Offices Copyright , (ISC) 2 All Rights Reserved

4 Membership Honor Roll Australia Canada (2) Germany Hong Kong India Japan(1) Korea, South Netherlands Singapore (1) United Kingdom United States (5) 500+ China France Switzerland 200+ Brazil Belgium (1) Denmark (1) Finland Ireland (1) Israel Italy Malaysia Mexico Poland Saudi Arabia South Africa (1) Spain Sweden Taiwan United Arab Emirates Click to edit Master title style 100+ Austria New Zealand Nigeria Norway Argentina Columbia Russia Thailand Turkey Copyright , (ISC) 2 All Rights Reserved

Number of (ISC)² Members in Various Asian Economies As of July 2011 Total worldwide member: 75,000+

(ISC)² Credential Positioning / Career Path Click to edit

7 What is Cyber Security? Why do I care about cyber security? How can I make a difference?

8 PROPERTIES Allow user to leave interaction: Show Next Slide Button: Completion Button Label: After viewing all the steps Show upon completion Next Slide

9 Business Requirements Information systems Support business processes Store and process sensitive and critical data Are available to almost everyone Information stored on all types of media

10 Best Business Practices (1-5) 1. Incident Reporting Who and When to Call 2. Access Controls Never Share with Others 3. Malicious Code Think Before You Click 4. Internet Avoid Communications Hazards 5. Asset Management Secure Your Valuables

11 Best Business Practices (6-10) 6. Human Factor It s All About the People 7. Physical Security Protect Your Workplace 8. Social Engineering Don t be Fooled 9. Business Continuity Survival of the Business 10. Policies/Compliance Your Responsibilities

12 1. Incident Reporting Who and When to Call Prompt identification and response is key Know Who to call When to call What to do Don t alter or turn off your system

13 2. Access Controls Never Share with Others First line of defense Passwords Most common Weakest form Other access controls Tokens Smart cards Biometrics

14 Password Selection Criteria MUST be kept private! Easy to remember Don t write it down Something personal Meets company standards Hard to guess PATRIOTS (Weak) Use both uppercase and lowercase letters Substitute characters for letters for a ) Substitute numbers for letters (e.g., 1 for i ) P@tr10ts (Strong)

15 Log Off and Protect Your Screen Lock computers when away Terminate sessions when finished Beware of shoulder surfing

16 3. Malicious Code Think Before You Click What happens if you click on that link? Virus Worm Trojan horse Logic bomb Keystroke logger Think before you click!

17 4. The Internet Avoid Communications Hazards Who are you really chatting with? ID Theft Should you click that ad? Phishing Secure connections

18 Safely Surfing the World Wide Web Be very careful! Sites may contain hidden programs Never change your security settings Don t download unknown files Spyware/Adware Cookies

20 and Instant Messages Confidential information Permanent record Business purposes Networking and chat

21 SPAM Sometimes dangerous Activate SPAM folders Do not open from unknown senders Do not open attachments or links in those s

22 Portable Storage Can be a risk to sensitive corporate data Use only when permitted

23 Mobile Devices Notebooks, tablets, etc. Tele-commuting, traveling, personal systems, and acceptable use

24 Smartphones Contain personal or corporate data Pictures of confidential data Threat of theft/loss

25 Wireless Equipment Must be used carefully Follow local policy Enable security measures Use encrypted VPN (virtual private network)

27 5. Asset Management Protect Your Valuables Asset an item of value Asset management Identify Track Classify Assign ownership Information assets Human assets

28 Information Classification Identifies sensitive or critical information Have procedures for sensitive information Protect Process Store Transmit

29 Data Backup How much data are you willing to lose? Backup data, operating systems, applications, and configurations Automated saves

30 6. Human Factor It s All About the People Do Your Part Be aware Recognize suspicious activities Follow procedures Ask if you re not sure If in doubt, call the appropriate security office

31 Monitoring and Supervision Insider threats Watch for suspicious activity Report abnormal behavior Pay attention to vendors and consultants

33 7. Physical Security Protect Your Workplace Physical access can overcome almost all other controls Know the identity of visitors Lock it up

34 Entry Controls Beware of tailgating Issue badges to visitors Display badges Report lost credentials

35 Physical Protection Need to protect from loss, damage, and theft Power surges and spikes Manmade and natural threats

36 8. Social Engineering Don t Be Fooled Easiest form of hacking Don t be manipulated or persuaded When in doubt, follow policy and report an incident

37 Identity Theft Stealing your identity Personal information Banking details Credit cards Takes hundreds of hours to fix

38 Phishing Attacks

39 Dumpster Diving Retrieving sensitive information from garbage dumpsters In most jurisdictions, it s not against the law

40 9. Business Continuity Staying in Business Be prepared for problems Know your role Know who to call

Education FERPA Energy FERC/NERC Financial Services FFIEC

41 10. Policies/Compliance Your Responsibilities Be aware of and follow your Organization s policies Compliance requirements Education FERPA Energy FERC/NERC Financial Services FFIEC Healthcare HIPAA Retail PCI-DSS U.S. Government FISMA Workforce Safety and Security

42 Privacy Personally Identifiable Information (PII) Policies, awareness, and controls

43 Best Business Practices (1-5) 1. Incident Reporting Who and When to Call 2. Access Controls Never Share with Others 3. Malicious Code Think Before You Click 4. Internet Avoid Communications Hazards 5. Asset Management Secure Your Valuables

44 Best Business Practices (6-10) 6. Human Factor It s All About the People 7. Physical Security Protect Your Workplace 8. Social Engineering Don t be Fooled 9. Business Continuity Survival of the Business 10. Policies/Compliance Your Responsibilities

45 End-User Security Awareness Course Summary Cyber security is important We ALL have a role Be security aware! Do the right things right!

Foreign Taxes Paid and Foreign Source Income INTECH Global Income Managed Volatility Fund

Foreign Taxes Paid and Foreign Source Income INTECH Global Income Managed Volatility Fund Income INTECH Global Income Managed Volatility Fund Australia 0.0066 0.0375 Austria 0.0045 0.0014 Belgium 0.0461 0.0138 Bermuda 0.0000 0.0059 Canada 0.0919 0.0275 Cayman Islands 0.0000 0.0044 China 0.0000