CYBER INFORMATION SECURITY AWARENESS AND PROTECTION PRACTICES. Strengthening Your Community at the Organizational Level

Size: px
Start display at page:

Download "CYBER INFORMATION SECURITY AWARENESS AND PROTECTION PRACTICES. Strengthening Your Community at the Organizational Level"

Transcription

1 CYBER INFORMATION SECURITY AWARENESS AND PROTECTION PRACTICES Strengthening Your Community at the Organizational Level Las Vegas, Nevada 2012

2 Security Awareness and Why is it Important? In today s economic climate, information is every organization s most important asset and loss of it could be catastrophic. Beyond the loss of the asset itself, a breach of an organization s network can result in: Damage to organizational reputation Loss of revenue Assessment of fines and penalties Significant costs to restore and protect customer data Complete shutdown of business operations Beyond the organization, the potential risk to network systems that provide community services such as hospitals, financial institutions, or governments and public sector critical infrastructure; have the potential to put an entire community at risk if compromised. While no single solution will prevent every possible scenario, the protection of information as an asset is the responsibility of everyone in the home, community, and organization from the top down. Every member is part of the team and must take a leadership role for the protection of information and the systems that manage information. Building a strong Information Security Awareness Program is a key element that helps to ensure that information in your care, and the system(s) which store, process or transport information remain accessible and uncompromised. The person using the information is likely the weakest link in its protection and therefore, promoting a strong awareness program is vital to protecting the community as a whole. Information security includes cyber security and data security. Though some use these words interchangeably, when discussing information security, each has specific issues regarding the protection of different types of systems, data and information. An example of cyber security may be the systems used by a train to switch from one track to another or a missiles guidance system. An example of data security is how your computer and tablet store and discern one user s ability to access data from another user. Information security can include the paper copy of your bank statement or correspondence you had with a friend. Regardless of where on the security paradigm you sit, you are critical to the protection of your personal information, your company s service and even your community s ability to offer services. Your correct use of an information software system can affect the continued use of other systems distant from you; perhaps those of which you have no knowledge- sort of like sneezing and spreading the germs. Your mouse clicks on an link can launch an attack on a whole range of computer systems. Yes, your actions have that potential. Keeping with the sneezing analogy, protection of the community can be as simple as covering your mouth, washing your hands and getting a flu shot. Or in the information security world, NOT mouse clicking on unknown links, NOT sending unprotected information over , and USING up-to-date virus software. Information security is not easy to get your arms around. Bad guys are releasing new attacks and launching social engineering schemes daily in an attempt to convince you to click on something. They are sitting near you at your favorite Wi-Fi hotspot and, if you read the paper, the headlines will tell you how they are launching all out attacks on our country and its infrastructure. Just like the sneeze, the community needs your help to prevent the spread of the problem.

3 Information Security Myths- Hackers Are Not Interested In Me. The following, Myths, are examples of why many organizations do not move forward with a strong cyber security program. The end result could be devastating losses to the user, organization, customers and the community. 1. Myth: Most hackers are kids in their teens just trying to give you a hard time. False: Cybercrime is big business. The first generation of cybercriminals was certainly teenagers seeking notoriety. From there, the cybercriminal evolved to a profit-motive using organized gangs with increasing sophistication, and a full-fledged industry where malware is bought, sold and supported. 2. Myth: The biggest security threat for my company comes from hackers. False: Published studies have shown that 50% to 80% of incidents resulting in significant financial loss have come from insiders (mostly employees), who can do more harm because they know where the sensitive data is located, system weaknesses and how to get the data. 3. Myth: Most hackers only attack big companies because that is where the money is. False: Historically this has been true, but the trend has changed and attackers are now looking for smaller easy targets where the discipline of information security is not well practiced. 4. Myth: Security solutions are expensive and cumbersome. False: The biggest risk to your information and a company s intellectual property is social engineering. Social engineering is a method to gain information from individuals, usually by deception and when the user unknowingly releases valuable information. Providing your employees with awareness training in social engineering tactics and safe use of social media is a low cost measure with a high value of return. 5. Myth: We hire a hacker once a year to perform a penetration test so we know our network is secure and our data is safe. False: Penetration tests are a snapshot in time of the security of your network, devices and PCs. Every day, new viruses and vulnerabilities are introduced paving the way for opportunistic hackers. Ongoing processes and procedures aligned with information security, best practices and awareness training are the best ways to protect your data. 6. Myth: Anti-virus software and firewalls are all I need to protect my network. False: Current anti-virus software and properly deployed firewalls are important tools that protect your network and your information; however, they cannot guarantee that you will be protected from all attacks. Since a new form of malware is released into the internet every 13 seconds, antivirus software cannot keep up. At best, antivirus software is thought to only catch 30% of the viruses and malware that is out there. Layered security, careful behavior by all users and keeping these technologies updated is the best way to reduce your risk. 7. Myth: If a hacker penetrates my network we will detect it and can prevent any damage. False: Studies have shown that hackers infiltrate and remain in networks for as long as 3-4 months without detection before they are discovered. In some cases, it may be a third party, such as a customer, who reports the compromise.

4 SO WHO IS THE BIG BAD WOLF? A Brief Look at Cyber Data Security Threats Threats and vulnerabilities to the safety of your information are growing quickly and new malware, hacks and viruses are popping every minute. Typically, Big Bad Wolfs are usually those who seek personal gain from your information. The following are some of the more common threats to consider. Employee Actions: Employees, whether intentionally or unintentionally, can open your network to those whose intent is to do harm. Malware and Viruses: s or websites containing malware intended to disrupt computer systems can be opened inadvertently, due to a lack of awareness of the potential associated threats. Spyware: This is typically malware loaded on your system by clicking on a link, and is used to gain information as your system is used. Hackers: Those who obtain financial and other information to sell on line, and/or for other personal gain. Hackers may target specific companies, but mostly, systems are randomly searched for easy entry points. Hacktivist: This hacking has a different motive. Hacktivists target organizations that they disagree with and want to stop the target s ability to continue work, or to cause the organization embarrassment. Politically or financially motivated, they are normally in opposition of the organizations missions and goals. Web-Page Take Over: This hacking is when someone else takes over control of your website, it may be done as an act of cyber-espionage. Cyber terrorists are typically groups whose goal is to disable the American economy by interrupting business. These attacks are often targeted at large national organizations regardless of the provided services. Disgruntled Employees or Ex-Employees. The potential for those who would attempt to steal, and defraud by accessing your information is a reason to remove their system access at the time of termination or limit access to information not required. Employees, who are involved with high risk activities often visit websites catering to such activities. These sites commonly promote insecure practices and therefore those visiting these sites are more apt to cause system problems. Vendor and Outside Sales Representatives and Trainers. It is important to have information security policies in place and limit access of third parties and contractors who access or support your network. Mobile Devices, Flashdrives and Social Media. These common mechanisms present potential risks and must be considered in your information security awareness training and practices. Phishing s. Posing as legitimate s from your bank or other vendors, phishing s are in fact a false front for Identity Theft by asking for information such as passwords and/or account numbers.

5 Awareness Campaigns Awareness Campaigns: The best awareness campaigns are simple; informational posters, flyers or s heightening the awareness of information security practices of an organization. Employee Awareness, Training and Security Practices 1. New Employees: New employees should receive Information Systems Security Policies and training during orientation and should be required to sign indicating their understanding and intent to comply. 2. Exiting Employees: Interview all outgoing employees, regardless of their position, to ensure any unique passwords have been reported, and to insure that company data and property including devices are returned. IT should immediately disable network, system and remote access for all terminated employees, reset their passwords and develop a policy for the ongoing retention of that employee s files and data and the authorization required for others to access it. 3. Employees Who Leave Without Notice: In addition to the above measures for exiting employees, for those who leave without notice, additional measures should be considered. Secure their computer, check for system viruses or evidence of breaches and monitor the network for any attempts they may make to access the network for several weeks following their departure. 4. Vendors and Sub- Contractors: Establish a policy which requires their compliance to your security rules and policies. Require a Non- Disclosure Agreement to protect privacy and information prior to granting access to your information systems. 5. Employee Use Of Company Equipment: Policy should identify how and when company information systems, to include cell phones are to be used and require safety practices. 6. Social Media Policy: Consider adopting a social media policy and ensure that employees are aware of the risks presented through their use of social media. 7. Reporting: Ensure employees know what, when and how to report suspicious activities. 8. Record Keeping: Ensure your IT personnel keep a log of any suspected hacks, or other questionable matters, for future investigations. 9. Polices on Changing and Sharing Passwords on Your Computers: Establishing how often passwords should be updated; number of characters used in a password, and how those requests are made of employees, will help keep everyone accountable. It is a good idea to keep an updated list of all important or key passwords in a sealed envelope in a locked safe accessible only by senior management in the event of an emergency. 10. Establish Standard Operations Polices: Ensure that employees know the organization s standard operating procedures for items which may put your network at risk. Some items to consider are: Phishing s Opening Attachments Identifying and handling questionable s Use of Personal/Vendor Flashdrives

6 11. Personal Computer/Mobile Devices: Accessing company s or data remotely on a laptop or mobile device places a significant risk to your organization. Ensure that you have a clear policy for employees in the event of a breached. If you allow the remote access, ensure that employees are aware of potential threats such as: Smart phones have the potential to be hacked. A warm cell phone while not in use may indicate a breach. There are programs that can remotely turn on a mobile device s microphones and cameras Anti-Virus Software Updates: Personal laptops and mobile phones should have anti-virus software. Ensure employees know their responsibility to keep it up-to-date 12. Cloud Storage and Online Tools: Many employees enjoy online tools; however, it is important for them to realize, that many of those tools are in what is referred to as a cloud and the server is often housed in another state or country. Remind employees that the use of cloud related products should be approved prior to being used. 13. Reporting Procedures for Compromised Data or Possible Breaches: Ensure that every employee knows that a suspected compromised system should be identified immediately, who to report it to, and that a delay in notification can increase the damage. 14. Significant Breach s that must be reported to Law Enforcement: Depending on your company s work and the severity of the breach, local law enforcement may need to be contacted. Companies should know that in case such as child pornography, contacting law enforcement is required and the company can be in jeopardy if contact is not made. Be sure to secure the computer until law enforcement arrives, such computers should NOT be turned off as that will erase the cache memory; they should however be disconnected from the network to avoid further damage. 15. Disaster and Recovery Planning: Having a plan in place and completing emergency drills will keep you prepared in the event of an actual emergency and hopefully will minimize the downtime of your business. 16. How Often Should I Train and How Do I Get It to Everyone: The frequency of awareness training is based on your company s information security risks. Training can be as simple as reminding of a single security practice or learning about a new threat. Department staff meetings are a great way to update multiple employees at one time. Based on position, employees can also attend local training seminar or vendors meetings are valuable resources for providing low or no-cost training. In all cases, training should be an ongoing activity regardless of the form.

7 REFERENCES Cyber Security Program Resources Clark-Las Vegas Community Policy & Standards SANS Institute Security Policy Project National Security Agency (NSA) Security Configuration Guides curity_configuration_guides/ National Institute of Standards and Technology (NIST) Security Publications Defense Information Systems Agency (DISA) Security Technical Implementation Guides Federal United States Computer Emergency Readiness Team (US-CERT) DHS Critical Infrastructure / Key Resources shtm Common Criteria Forum of Incident Response & Security Teams (FIRST) Training The Center for Infrastructure Assurance and Security (CIAS) Information Sharing Multi-State Information Sharing and Analysis Center (MS-ISAC) Department of Homeland Security (DHS) Communication and Interoperability Memorandums of Understanding Various Tools Information Systems Security Association (ISSA) https://www.issa.org/ ISACA https://www.isaca.org/pages/default.aspx Great for Families National Center for Missing and Exploited Children National Cyber Security Alliance Anti-Phishing Working Group On Guard Online Federal Trade Commission Identity Theft Deter, Detect, Defend Credit Monitoring One free credit report per year from three credit reporting agencies The Texas Engineering Extension Service (TEEX) The Cyberterrorism Defense initiative (CDI)

Cyber Self Assessment

Cyber Self Assessment Cyber Self Assessment According to Protecting Personal Information A Guide for Business 1 a sound data security plan is built on five key principles: 1. Take stock. Know what personal information you have

More information

10 Smart Ideas for. Keeping Data Safe. From Hackers

10 Smart Ideas for. Keeping Data Safe. From Hackers 0100101001001010010001010010101001010101001000000100101001010101010010101010010100 0100101001001010010001010010101001010101001000000100101001010101010010101010010100000 0100101001001010010001010010101001010101001000000100101001010101010010101010010100000

More information

Introduction to Computer Security

Introduction to Computer Security Introduction to Computer Security Rev. Sept 2015 What is Computer Security? 2 Computer Security is the protection of computing systems and the data that they store or access 3 Why is Computer Security

More information

SECURING YOUR SMALL BUSINESS. Principles of information security and risk management

SECURING YOUR SMALL BUSINESS. Principles of information security and risk management SECURING YOUR SMALL BUSINESS Principles of information security and risk management The challenge Information is one of the most valuable assets of any organization public or private, large or small and

More information

Medical Information Breaches: Are Your Records Safe?

Medical Information Breaches: Are Your Records Safe? Medical Information Breaches: Are Your Records Safe? Learning Objectives At the conclusion of this presentation the learner will be able to: Recognize the growing risk of data breaches Assess the potential

More information

Don t Fall Victim to Cybercrime:

Don t Fall Victim to Cybercrime: Don t Fall Victim to Cybercrime: Best Practices to Safeguard Your Business Agenda Cybercrime Overview Corporate Account Takeover Computer Hacking, Phishing, Malware Breach Statistics Internet Security

More information

Cybersecurity Protecting Yourself, Your Business, Your Clients

Cybersecurity Protecting Yourself, Your Business, Your Clients Cybersecurity Protecting Yourself, Your Business, Your Clients Global Summit of Women June 7, 2014 Celina B. Realuyo Professor of Practice of National Security Affairs William J. Perry Center for Hemispheric

More information

Presented by Evan Sylvester, CISSP

Presented by Evan Sylvester, CISSP Presented by Evan Sylvester, CISSP Who Am I? Evan Sylvester FAST Information Security Officer MBA, Texas State University BBA in Management Information Systems at the University of Texas Certified Information

More information

1. For each of the 25 questions, multiply each question response risk value (1-5) by the number of times it was chosen by the survey takers.

1. For each of the 25 questions, multiply each question response risk value (1-5) by the number of times it was chosen by the survey takers. Employee Security Awareness Survey Trenton Bond trent.bond@gmail.com Admin - Version 1.3 Security Awareness One of the most significant security risks that organizations and corporations face today is

More information

CONSIDERATIONS BEFORE MOVING TO THE CLOUD

CONSIDERATIONS BEFORE MOVING TO THE CLOUD CONSIDERATIONS BEFORE MOVING TO THE CLOUD What Management Needs to Know Part II By Debbie C. Sasso Principal In part I, we discussed organizational compliance related to information technology and what

More information

How-To Guide: Cyber Security. Content Provided by

How-To Guide: Cyber Security. Content Provided by How-To Guide: Cyber Security Content Provided by Who needs cyber security? Businesses that have, use, or support computers, smartphones, email, websites, social media, or cloudbased services. Businesses

More information

Security & SMEs. An Introduction by Jan Gessin. Introduction to the problem

Security & SMEs. An Introduction by Jan Gessin. Introduction to the problem Security & SMEs An Introduction by Jan Gessin Introduction to the problem SMEs convinced it will never happen to them. In many ways SMEs are more of a target than big business. Harsh realities of the online

More information

10 Quick Tips to Mobile Security

10 Quick Tips to Mobile Security 10 Quick Tips to Mobile Security 10 Quick Tips to Mobile Security contents 03 Introduction 05 Mobile Threats and Consequences 06 Important Mobile Statistics 07 Top 10 Mobile Safety Tips 19 Resources 22

More information

WHAT YOU NEED TO KNOW ABOUT CYBER SECURITY

WHAT YOU NEED TO KNOW ABOUT CYBER SECURITY SMALL BUSINESSES WHAT YOU NEED TO KNOW ABOUT CYBER SECURITY ONE CLICK CAN CHANGE EVERYTHING SMALL BUSINESSES My reputation was ruined by malicious emails ONE CLICK CAN CHANGE EVERYTHING Cybercrime comes

More information

Cybercrime: risks, penalties and prevention

Cybercrime: risks, penalties and prevention Cybercrime: risks, penalties and prevention Cyber attacks have been appearing in the news with increased frequency and recent victims of cybercrime have included well-known companies such as Sony, LinkedIn,

More information

NATIONAL CYBER SECURITY AWARENESS MONTH

NATIONAL CYBER SECURITY AWARENESS MONTH NATIONAL CYBER SECURITY AWARENESS MONTH Tip 1: Security is everyone s responsibility. Develop an awareness framework that challenges, educates and empowers your customers and employees to be part of the

More information

Things To Do After You ve Been Hacked

Things To Do After You ve Been Hacked Problem: You ve been hacked! Now what? Solution: Proactive, automated incident response from inside the network Things To Do After You ve Been Hacked Tube web share It only takes one click to compromise

More information

SBA Cybersecurity for Small Businesses. 1.1 Introduction. 1.2 Course Objectives. 1.3 Course Topics

SBA Cybersecurity for Small Businesses. 1.1 Introduction. 1.2 Course Objectives. 1.3 Course Topics SBA Cybersecurity for Small Businesses 1.1 Introduction Welcome to SBA s online training course: Cybersecurity for Small Businesses. SBA s Office of Entrepreneurship Education provides this self-paced

More information

KEY STEPS FOLLOWING A DATA BREACH

KEY STEPS FOLLOWING A DATA BREACH KEY STEPS FOLLOWING A DATA BREACH Introduction This document provides key recommended steps to be taken following the discovery of a data breach. The document does not constitute an exhaustive guideline,

More information

Network Security and the Small Business

Network Security and the Small Business Network Security and the Small Business Why network security is important for a small business Many small businesses think that they are less likely targets for security attacks as compared to large enterprises,

More information

Cyber Security, Fraud and Corporate Account Takeovers LBA Bank Counsel Conference December 2014

Cyber Security, Fraud and Corporate Account Takeovers LBA Bank Counsel Conference December 2014 Cyber Security, Fraud and Corporate Account Takeovers LBA Bank Counsel Conference December 2014 Lisa D. Traina, CPA, CITP, CGMA Lisa Traina utilizes her 30+ years of experience as a CPA, CITP and CGMA

More information

CYBERSECURITY BEST PRACTICES FOR SMALL AND MEDIUM PENNSYLVANIA UTILITIES

CYBERSECURITY BEST PRACTICES FOR SMALL AND MEDIUM PENNSYLVANIA UTILITIES CYBERSECURITY BEST PRACTICES FOR SMALL AND MEDIUM PENNSYLVANIA UTILITIES The information provided in this document is presented as a courtesy to be used for informational purposes only. This information

More information

Cyber Security Beginners Guide to Firewalls A Non-Technical Guide

Cyber Security Beginners Guide to Firewalls A Non-Technical Guide Cyber Security Beginners Guide to Firewalls A Non-Technical Guide Essential for Business Managers Office Managers Operations Managers Multi-State Information Sharing and Analysis Center (MS-ISAC) U.S.

More information

Internet threats: steps to security for your small business

Internet threats: steps to security for your small business Internet threats: 7 steps to security for your small business Proactive solutions for small businesses A restaurant offers free WiFi to its patrons. The controller of an accounting firm receives a confidential

More information

Cybersecurity Best Practices in Mortgage Banking. Article by Jim Deitch October 2015

Cybersecurity Best Practices in Mortgage Banking. Article by Jim Deitch October 2015 Cybersecurity Best Practices in Mortgage Banking Article by Jim Deitch Cybersecurity Best Practices in Mortgage Banking BY JIM DEITCH Jim Deitch Recent high-profile cyberattacks have clearly demonstrated

More information

CYBER EXPOSURES OF SMALL AND MIDSIZE BUSINESSES A DIGITAL PANDEMIC. October 2014. Sponsored by:

CYBER EXPOSURES OF SMALL AND MIDSIZE BUSINESSES A DIGITAL PANDEMIC. October 2014. Sponsored by: CYBER EXPOSURES OF SMALL AND MIDSIZE BUSINESSES A DIGITAL PANDEMIC October 2014 Cyber Exposures of Small and Midsize Businesses A digital pandemic Executive Summary Gone are the days when data breaches,

More information

Belmont Savings Bank. Are there Hackers at the gate? 2013 Wolf & Company, P.C.

Belmont Savings Bank. Are there Hackers at the gate? 2013 Wolf & Company, P.C. Belmont Savings Bank Are there Hackers at the gate? 2013 Wolf & Company, P.C. MEMBER OF PKF NORTH AMERICA, AN ASSOCIATION OF LEGALLY INDEPENDENT FIRMS 2013 Wolf & Company, P.C. About Wolf & Company, P.C.

More information

Cybersecurity: Considerations for Internal Audit. IIA Atlanta Chapter Meeting January 9, 2015

Cybersecurity: Considerations for Internal Audit. IIA Atlanta Chapter Meeting January 9, 2015 Cybersecurity: Considerations for Internal Audit IIA Atlanta Chapter Meeting January 9, 2015 Agenda Key Risks Incorporating Internal Audit Resources for Internal Auditors Questions 2 Key Risks 3 4 Key

More information

Roger s Cyber Security and Compliance Mini-Guide

Roger s Cyber Security and Compliance Mini-Guide Roger s Cyber Security and Compliance Mini-Guide A Mini Guide for Small and Medium Business and not for profit organisations. By Roger Smith Managed Service Provider and Cyber Security Coach R & I ICT

More information

Top Five Ways to Protect Your Network. A MainNerve Whitepaper

Top Five Ways to Protect Your Network. A MainNerve Whitepaper A MainNerve Whitepaper Overview The data security challenges within the business world have never been as challenging as they are today. Not only must organizations providers comply with stringent State

More information

2012 NCSA / Symantec. National Small Business Study

2012 NCSA / Symantec. National Small Business Study 2012 NCSA / Symantec National Small Business Study National Cyber Security Alliance Symantec JZ Analytics October 2012 Methodology and Sample Characteristics JZ Analytics was commissioned by the National

More information

Are You A Sitting Duck?

Are You A Sitting Duck? The 7 Most Cricitcal I.T. Security Protections Every Business Must Have in Place Now to Protect Themselves from Cybercrime, Data Breaches, and Hacker Attacks Cybercrime is at an all-time high, and hackers

More information

Better secure IT equipment and systems

Better secure IT equipment and systems Chapter 5 Central Services Data Centre Security 1.0 MAIN POINTS The Ministry of Central Services, through its Information Technology Division (ITD), provides information technology (IT) services to government

More information

Cybersecurity Report on Small Business: Study Shows Gap between Needs and Actions

Cybersecurity Report on Small Business: Study Shows Gap between Needs and Actions SURVEY REPORT: cyber security Cybersecurity Report on Small Business: Study Shows Gap between Needs and Actions Confidence in a connected world. Executive summary An online survey revealed that while U.S.

More information

CYBER SECURITY AND RISK MANAGEMENT. An Executive level responsibility

CYBER SECURITY AND RISK MANAGEMENT. An Executive level responsibility CYBER SECURITY AND RISK MANAGEMENT An Executive level responsibility Cyberspace poses risks as well as opportunities Cyber security risks are a constantly evolving threat to an organisation s ability to

More information

University of Pittsburgh Security Assessment Questionnaire (v1.5)

University of Pittsburgh Security Assessment Questionnaire (v1.5) Technology Help Desk 412 624-HELP [4357] technology.pitt.edu University of Pittsburgh Security Assessment Questionnaire (v1.5) Directions and Instructions for completing this assessment The answers provided

More information

A practical guide to IT security

A practical guide to IT security Data protection A practical guide to IT security Ideal for the small business The Data Protection Act states that appropriate technical and organisational measures shall be taken against unauthorised or

More information

Proactive Credential Monitoring as a Method of Fraud Prevention and Risk Mitigation. By Marc Ostryniec, vice president, CSID

Proactive Credential Monitoring as a Method of Fraud Prevention and Risk Mitigation. By Marc Ostryniec, vice president, CSID Proactive Credential Monitoring as a Method of Fraud Prevention and Risk Mitigation By Marc Ostryniec, vice president, CSID The increase in volume, severity, publicity and fallout of recent data breaches

More information

Cybersecurity. Are you prepared?

Cybersecurity. Are you prepared? Cybersecurity Are you prepared? First Cash, then your customer, now YOU! What is Cybersecurity? The body of technologies, processes, practices designed to protect networks, computers, programs, and data

More information

Why is a strong password important?

Why is a strong password important? Internet Security Why is a strong password important? Identity theft motives: To gain access to resources For the challenge/fun Personal reasons Theft methods Brute forcing and other script hacking methods

More information

A Small Business Approach to Big Business Cyber Security. Brent Bettis, CISSP 23 September, 2014

A Small Business Approach to Big Business Cyber Security. Brent Bettis, CISSP 23 September, 2014 A Small Business Approach to Big Business Cyber Security Brent Bettis, CISSP 23 September, 2014 1 First, a Video http://www.youtube.com/watch?v=cj8wakqwlna 2 3 Agenda Threat Landscape Strategic Initiatives

More information

Information Security and Risk Management

Information Security and Risk Management Information Security and Risk Management COSO and COBIT Standards and Requirements Page 1 Topics Information Security Industry Standards and COBIT Framework Relation to COSO Internal Control Risk Management

More information

Cyber Security: Beginners Guide to Firewalls

Cyber Security: Beginners Guide to Firewalls Cyber Security: Beginners Guide to Firewalls A Non-Technical Guide Essential for Business Managers Office Managers Operations Managers This appendix is a supplement to the Cyber Security: Getting Started

More information

Small businesses: What you need to know about cyber security

Small businesses: What you need to know about cyber security Small businesses: What you need to know about cyber security March 2015 Contents page What you need to know about cyber security... 3 Why you need to know about cyber security... 4 Getting the basics right...

More information

National Cyber Security Month 2015: Daily Security Awareness Tips

National Cyber Security Month 2015: Daily Security Awareness Tips National Cyber Security Month 2015: Daily Security Awareness Tips October 1 New Threats Are Constantly Being Developed. Protect Your Home Computer and Personal Devices by Automatically Installing OS Updates.

More information

Cyber Security. An Executive Imperative for Business Owners. 77 Westport Plaza, St. Louis, MO 63416 p 314.439.4700 f 314.439.4799

Cyber Security. An Executive Imperative for Business Owners. 77 Westport Plaza, St. Louis, MO 63416 p 314.439.4700 f 314.439.4799 Cyber Security An Executive Imperative for Business Owners SSE Network Services www.ssenetwork.com 77 Westport Plaza, St. Louis, MO 63416 p 314.439.4700 f 314.439.4799 Pretecht SM by SSE predicts and remedies

More information

Ten Questions Your Board Should be asking about Cyber Security. Eric M. Wright, Shareholder

Ten Questions Your Board Should be asking about Cyber Security. Eric M. Wright, Shareholder Ten Questions Your Board Should be asking about Cyber Security Eric M. Wright, Shareholder Eric Wright, CPA, CITP Started my career with Schneider Downs in 1983. Responsible for all IT audit and system

More information

What Data? I m A Trucking Company!

What Data? I m A Trucking Company! What Data? I m A Trucking Company! Presented by: Marc C. Tucker 434 Fayetteville Street, Suite 2800 Raleigh, NC, 27601 919.755.8713 marc.tucker@smithmoorelaw.com Presented by: Rob D. Moseley, Jr. 2 West

More information

Cyber Security Incident Handling Policy. Information Technology Services Center (ITSC) of The Hong Kong University of Science and Technology

Cyber Security Incident Handling Policy. Information Technology Services Center (ITSC) of The Hong Kong University of Science and Technology Cyber Security Incident Handling Policy Information Technology Services Center (ITSC) of The Hong Kong University of Science and Technology Date: Oct 9, 2015 i Document Control Document Owner Classification

More information

Working Practices for Protecting Electronic Information

Working Practices for Protecting Electronic Information Information Security Framework Working Practices for Protecting Electronic Information 1. Purpose The following pages provide more information about the minimum working practices which seek to ensure that

More information

Cyber Security Solutions for Small Businesses Comparison Report: A Sampling of Cyber Security Solutions Designed for the Small Business Community

Cyber Security Solutions for Small Businesses Comparison Report: A Sampling of Cyber Security Solutions Designed for the Small Business Community Cyber Security Solutions for Small Businesses Comparison Report: A Sampling of Cyber Security Solutions Designed for the Small Business Community A Sampling of Cyber Security Solutions Designed for the

More information

AIRDEFENSE SOLUTIONS PROTECT YOUR WIRELESS NETWORK AND YOUR CRITICAL DATA SECURITY AND COMPLIANCE

AIRDEFENSE SOLUTIONS PROTECT YOUR WIRELESS NETWORK AND YOUR CRITICAL DATA SECURITY AND COMPLIANCE AIRDEFENSE SOLUTIONS PROTECT YOUR WIRELESS NETWORK AND YOUR CRITICAL DATA SECURITY AND COMPLIANCE THE CHALLENGE: SECURE THE OPEN AIR Wirelesss communication lets you take your business wherever your customers,

More information

7 VITAL FACTS ABOUT HEALTHCARE BREACHES. www.eset.com

7 VITAL FACTS ABOUT HEALTHCARE BREACHES. www.eset.com 7 VITAL FACTS ABOUT HEALTHCARE BREACHES www.eset.com 7 vital facts about healthcare breaches Essential information for protecting your business and your patients Large breaches of Personal Health Information

More information

Texas Municipal League Annual Conference October 10, 2013

Texas Municipal League Annual Conference October 10, 2013 Texas Municipal League Annual Conference October 10, 2013 Kristin Judge Executive Director Trusted Purchasing Alliance Center for Internet Security William F. Pelgrin CIS President & CEO Chair Center for

More information

SIZE DOESN T MATTER IN CYBERSECURITY

SIZE DOESN T MATTER IN CYBERSECURITY SIZE DOESN T MATTER IN CYBERSECURITY WE SECURE THE FUTURE SIZE DOESN T MATTER IN CYBERSECURITY WE SECURE THE FUTURE TABLE OF CONTENTS SIZE DOESN T MATTER IN CYBERSPACE 03 SUMMARY 05 TOP REASONS WHY SMBS

More information

AIRDEFENSE SOLUTIONS PROTECT YOUR WIRELESS NETWORK AND YOUR CRITICAL DATA SECURITY AND COMPLIANCE

AIRDEFENSE SOLUTIONS PROTECT YOUR WIRELESS NETWORK AND YOUR CRITICAL DATA SECURITY AND COMPLIANCE AIRDEFENSE SOLUTIONS PROTECT YOUR WIRELESS NETWORK AND YOUR CRITICAL DATA SECURITY AND COMPLIANCE THE CHALLENGE: SECURE THE OPEN AIR Wirelesss communication lets you take your business wherever your customers,

More information

How to Secure Your Environment

How to Secure Your Environment End Point Security How to Secure Your Environment Learning Objectives Define Endpoint Security Describe most common endpoints of data leakage Identify most common security gaps Preview solutions to bridge

More information

Cyber Security Solutions:

Cyber Security Solutions: ThisIsCable for Business Report Series Cyber Security Solutions: A Sampling of Cyber Security Solutions Designed for the Small Business Community Comparison Report Produced by BizTechReports.com Editorial

More information

References NYS Office of Cyber Security and Critical Infrastructure Coordination Best Practices and Assessment Tools for the Household

References NYS Office of Cyber Security and Critical Infrastructure Coordination Best Practices and Assessment Tools for the Household This appendix is a supplement to the Cyber Security: Getting Started Guide, a non-technical reference essential for business managers, office managers, and operations managers. This appendix is one of

More information

Presentation Objectives

Presentation Objectives Gerry Cochran, IT Specialist Jennifer Van Tassel, Associate Examiner Office of the State Comptroller Thomas P. DiNapoli State & Local Government Accountability Andrew A. SanFilippo Executive Deputy Comptroller

More information

Nine Steps to Smart Security for Small Businesses

Nine Steps to Smart Security for Small Businesses Nine Steps to Smart Security for Small Businesses by David Lacey Co-Founder, Jericho Forum Courtesy of TABLE OF CONTENTS INTRODUCTION... 1 WHY SHOULD I BOTHER?... 1 AREN T FIREWALLS AND ANTI-VIRUS ENOUGH?...

More information

Cyber Risk in Healthcare AOHC, 3 June 2015

Cyber Risk in Healthcare AOHC, 3 June 2015 Cyber Risk in Healthcare AOHC, 3 June 2015 Kopiha Nathan, Senior Healthcare Risk Management and Data Specialist James Penafiel, Underwriting Supervisor, Insurance Operations CFPC Conflict of Interest -

More information

TMCEC CYBER SECURITY TRAINING

TMCEC CYBER SECURITY TRAINING 1 TMCEC CYBER SECURITY TRAINING Agenda What is cyber-security? Why is cyber-security important? The essential role you play. Overview cyber security threats. Best practices in dealing with those threats.

More information

The SMB Cyber Security Survival Guide

The SMB Cyber Security Survival Guide The SMB Cyber Security Survival Guide Stephen Cobb, CISSP Security Evangelist The challenge A data security breach can put a business out of business or create serious unbudgeted costs To survive in today

More information

Cyber Essentials Scheme

Cyber Essentials Scheme Cyber Essentials Scheme Requirements for basic technical protection from cyber attacks June 2014 December 2013 Contents Contents... 2 Introduction... 3 Who should use this document?... 3 What can these

More information

Data Management Policies. Sage ERP Online

Data Management Policies. Sage ERP Online Sage ERP Online Sage ERP Online Table of Contents 1.0 Server Backup and Restore Policy... 3 1.1 Objectives... 3 1.2 Scope... 3 1.3 Responsibilities... 3 1.4 Policy... 4 1.5 Policy Violation... 5 1.6 Communication...

More information

Hot Topics in IT Security PREP#28 May 1, 2014. David Woska, Ph.D. OCIO Security

Hot Topics in IT Security PREP#28 May 1, 2014. David Woska, Ph.D. OCIO Security Hot Topics in IT Security PREP#28 May 1, 2014 David Woska, Ph.D. OCIO Security CME Disclosure Statement The North Shore LIJ Health System adheres to the ACCME s new Standards for Commercial Support. Any

More information

Incident Response. Six Best Practices for Managing Cyber Breaches. www.encase.com

Incident Response. Six Best Practices for Managing Cyber Breaches. www.encase.com Incident Response Six Best Practices for Managing Cyber Breaches www.encase.com What We ll Cover Your Challenges in Incident Response Six Best Practices for Managing a Cyber Breach In Depth: Best Practices

More information

Protecting Organizations from Cyber Attack

Protecting Organizations from Cyber Attack Protecting Organizations from Cyber Attack Cliff Glantz and Guy Landine Pacific Northwest National Laboratory (PNNL) PO Box 999 Richland, WA 99352 cliff.glantz@pnnl.gov guy.landine@pnnl.gov 1 Key Topics

More information

2012 Endpoint Security Best Practices Survey

2012 Endpoint Security Best Practices Survey WHITE PAPER: 2012 ENDPOINT SECURITY BEST PRACTICES SURVEY........................................ 2012 Endpoint Security Best Practices Survey Who should read this paper Small and medium business owners

More information

KASPERSKY SECURITY INTELLIGENCE SERVICES. EXPERT SERVICES. www.kaspersky.com

KASPERSKY SECURITY INTELLIGENCE SERVICES. EXPERT SERVICES. www.kaspersky.com KASPERSKY SECURITY INTELLIGENCE SERVICES. EXPERT SERVICES www.kaspersky.com EXPERT SERVICES Expert Services from Kaspersky Lab are exactly that the services of our in-house experts, many of them global

More information

Addressing APTs and Modern Malware with Security Intelligence Date: September 2013 Author: Jon Oltsik, Senior Principal Analyst

Addressing APTs and Modern Malware with Security Intelligence Date: September 2013 Author: Jon Oltsik, Senior Principal Analyst ESG Brief Addressing APTs and Modern Malware with Security Intelligence Date: September 2013 Author: Jon Oltsik, Senior Principal Analyst Abstract: APTs first came on the scene in 2010, creating a wave

More information

IA/CYBERSECURITY IS CRITICAL TO OPERATE IN CYBERSPACE

IA/CYBERSECURITY IS CRITICAL TO OPERATE IN CYBERSPACE IA/CYBERSECURITY IS CRITICAL TO OPERATE IN CYBERSPACE Commanders, leaders, and managers are responsible for ensuring that Information Assurance/Cybersecurity is part of all Army operations, missions and

More information

Are your people playing an effective role in your cyber resilience?

Are your people playing an effective role in your cyber resilience? Are your people playing an effective role in your cyber resilience? 01 Cyber attacks are now business as usual for organizations around the world. Organizations have typically trusted in technology to

More information

White Paper A SECURITY GUIDE TO PROTECTING IP PHONE SYSTEMS AGAINST ATTACK. A balancing act

White Paper A SECURITY GUIDE TO PROTECTING IP PHONE SYSTEMS AGAINST ATTACK. A balancing act A SECURITY GUIDE TO PROTECTING IP PHONE SYSTEMS AGAINST ATTACK With organizations rushing to adopt Voice over IP (VoIP) technology to cut costs and integrate applications designed to serve customers better,

More information

OCT Training & Technology Solutions Training@qc.cuny.edu (718) 997-4875

OCT Training & Technology Solutions Training@qc.cuny.edu (718) 997-4875 OCT Training & Technology Solutions Training@qc.cuny.edu (718) 997-4875 Understanding Information Security Information Security Information security refers to safeguarding information from misuse and theft,

More information

2 0 1 4 F G F O A A N N U A L C O N F E R E N C E

2 0 1 4 F G F O A A N N U A L C O N F E R E N C E I T G OV E R NANCE 2 0 1 4 F G F O A A N N U A L C O N F E R E N C E RAJ PATEL Plante Moran 248.223.3428 raj.patel@plantemoran.com This presentation will discuss current threats faced by public institutions,

More information

HOSTING. Managed Security Solutions. Managed Security. ECSC Solutions

HOSTING. Managed Security Solutions. Managed Security. ECSC Solutions Managed Security Managed Security MANAGED SECURITY SOLUTIONS I would highly recommend for your company s network review... were by far the best company IT Manager, Credit Management Agency Presenting IT

More information

External Supplier Control Requirements

External Supplier Control Requirements External Supplier Control s Cyber Security For Suppliers Categorised as Low Cyber Risk 1. Asset Protection and System Configuration Barclays Data and the assets or systems storing or processing it must

More information

CYBER SECURITY GUIDANCE

CYBER SECURITY GUIDANCE CYBER SECURITY GUIDANCE With the pervasiveness of information technology (IT) and cyber networks systems in nearly every aspect of society, effectively securing the Nation s critical infrastructure requires

More information

INFORMATION SECURITY FOR YOUR AGENCY

INFORMATION SECURITY FOR YOUR AGENCY INFORMATION SECURITY FOR YOUR AGENCY Presenter: Chad Knutson Secure Banking Solutions, LLC CONTACT INFORMATION Dr. Kevin Streff Professor at Dakota State University Director - National Center for the Protection

More information

Cyber Attacks and Liabilities Why do so many Organizations keep Getting Hacked, Sued and Fined?

Cyber Attacks and Liabilities Why do so many Organizations keep Getting Hacked, Sued and Fined? Cyber Attacks and Liabilities Why do so many Organizations keep Getting Hacked, Sued and Fined? PRESENTED BY RICK SHAW, AWAREITY Webinar Objectives Employees (and third parties) are the weakest links Learn

More information

2011 NATIONAL SMALL BUSINESS STUDY

2011 NATIONAL SMALL BUSINESS STUDY 2011 NATIONAL SMALL BUSINESS STUDY The National Cyber Security Alliance has conducted a new study with Symantec to analyze cyber security practices, behaviors and perceptions of small businesses throughout

More information

PREPARED TESTIMONY OF THE NATIONAL CYBER SECURITY ALLIANCE MICHAEL KAISER, EXECUTIVE DIRECTOR ON THE STATE OF CYBERSECURITY AND SMALL BUSINESS

PREPARED TESTIMONY OF THE NATIONAL CYBER SECURITY ALLIANCE MICHAEL KAISER, EXECUTIVE DIRECTOR ON THE STATE OF CYBERSECURITY AND SMALL BUSINESS PREPARED TESTIMONY OF THE NATIONAL CYBER SECURITY ALLIANCE MICHAEL KAISER, EXECUTIVE DIRECTOR ON THE STATE OF CYBERSECURITY AND SMALL BUSINESS BEFORE THE COMMITTEE ON HOUSE SMALL BUSINESS SUBCOMMITTEE

More information

October Is National Cyber Security Awareness Month!

October Is National Cyber Security Awareness Month! (0 West Virginia Executive Branch Privacy Tip October Is National Cyber Security Awareness Month! In recognition of National Cyber Security Month, we are supplying tips to keep you safe in your work life

More information

Risk Assessment Guide

Risk Assessment Guide KirkpatrickPrice Assessment Guide Designed Exclusively for PRISM International Members KirkpatrickPrice. innovation. integrity. delivered. KirkpatrickPrice Assessment Guide 2 Document Purpose The Assessment

More information

Building a Business Case:

Building a Business Case: Building a Business Case: Cloud-Based Security for Small and Medium-Size Businesses table of contents + Key Business Drivers... 3... 4... 6 A TechTarget White Paper brought to you by Investing in IT security

More information

Security Practices for Online Collaboration and Social Media

Security Practices for Online Collaboration and Social Media Cisco IT Best Practice Collaboration Security Cisco on Cisco Best Practice Security Practices for Online Collaboration and Social Media January 2012 2013 Cisco and/or its affiliates. All rights reserved.

More information

PROTECT YOUR COMPUTER AND YOUR PRIVACY!

PROTECT YOUR COMPUTER AND YOUR PRIVACY! PROTECT YOUR COMPUTER AND YOUR PRIVACY! Fraud comes in many shapes simple: the loss of both money protecting your computer and Take action and get peace of and sizes, but the outcome is and time. That

More information

Defending Against Data Beaches: Internal Controls for Cybersecurity

Defending Against Data Beaches: Internal Controls for Cybersecurity Defending Against Data Beaches: Internal Controls for Cybersecurity Presented by: Michael Walter, Managing Director and Chris Manning, Associate Director Protiviti Atlanta Office Agenda Defining Cybersecurity

More information

Real World Healthcare Security Exposures. Brian Selfridge, Partner, Meditology Services

Real World Healthcare Security Exposures. Brian Selfridge, Partner, Meditology Services Real World Healthcare Security Exposures Brian Selfridge, Partner, Meditology Services 2 Agenda Introduction Background and Industry Context Anatomy of a Pen Test Top 10 Healthcare Security Exposures Lessons

More information

Cyber Security Awareness. Internet Safety Intro. www.staysafeonline.org

Cyber Security Awareness. Internet Safety Intro. www.staysafeonline.org Cyber Security Awareness Internet Safety Intro www.staysafeonline.org 1 What is Cyber Security? Cyber Security is the body of technologies, processes and practices designed to protect from attack, damage

More information

Network Security for End Users in Health Care

Network Security for End Users in Health Care Network Security for End Users in Health Care Virginia Health Information Technology Regional Extension Center is funded by grant #90RC0022/01 from the Office of the National Coordinator for Health Information

More information

How Secure is Your SCADA System?

How Secure is Your SCADA System? How Secure is Your SCADA System? Charles Drobny GlobaLogix, Inc. Houston, TX, USA Our Industry is a Target 40% of cyber attacks on Critical Infrastructure targets are aimed at the Energy Industry The potential

More information

Defensible Strategy To. Cyber Incident Response

Defensible Strategy To. Cyber Incident Response Cyber Incident Response Defensible Strategy To Cyber Incident Response Cyber Incident Response Plans Every company should develop a written plan (cyber incident response plan) that identifies cyber attack

More information

Brief. The BakerHostetler Data Security Incident Response Report 2015

Brief. The BakerHostetler Data Security Incident Response Report 2015 Brief The BakerHostetler Data Security Incident Response Report 2015 The rate of disclosures of security incidents in 2015 continues at a pace that caused many to call 2013 and then 2014 the year of the

More information

Data Security Best Practices. White Paper

Data Security Best Practices. White Paper White Paper Revised July, 2013 Keeping Business Data Safe Security, it s the number one concern of companies when adopting new technologies involving business data. Due to the recent data breaches on several

More information

FINAL May 2005. Guideline on Security Systems for Safeguarding Customer Information

FINAL May 2005. Guideline on Security Systems for Safeguarding Customer Information FINAL May 2005 Guideline on Security Systems for Safeguarding Customer Information Table of Contents 1 Introduction 1 1.1 Purpose of Guideline 1 2 Definitions 2 3 Internal Controls and Procedures 2 3.1

More information

Small businesses: What you need to know about cyber security

Small businesses: What you need to know about cyber security Small businesses: What you need to know about cyber security Contents Why you need to know about cyber security... 3 Understanding the risks to your business... 4 How you can manage the risks... 5 Planning

More information

Cal Poly PCI DSS Compliance Training and Information. Information Security http://security.calpoly.edu 1

Cal Poly PCI DSS Compliance Training and Information. Information Security http://security.calpoly.edu 1 Cal Poly PCI DSS Compliance Training and Information Information Security http://security.calpoly.edu 1 Training Objectives Understanding PCI DSS What is it? How to comply with requirements Appropriate

More information