Visualizing the Business Impact of Technical Cyber Risks
|
|
|
- Anastasia Beasley
- 8 years ago
- Views:
Transcription
1 Visualizing the Business Impact of Technical Cyber Risks May 21, 2014 Henk Jonkers Senior Research Consultant, BiZZdesign
2 Agenda Introduction and problem statement Enterprise Architecture with ArchiMate and TOGAF Enterprise Risk & Security Management with ArchiMate Case Study: Pentest-based Business Impact Analysis Visualizing the business impact of cyber risks Conclusions
3 Henk Jonkers Senior Research Consultant at BiZZdesign Enterprise architecture, ArchiMate and TOGAF Editor of the ArchiMate 2.1 standard Enterprise Risk & Security Management Business Decision Management Case study in collaboration with Bart Seghers, Thales Cyber Security
4 Integrated service offering Enterprise Architecture Management Business Model Management Business Process Management Business Decision Management Consulting services Tooling Training Best practices
5 Customers, offices and partners worldwide Netherlands: Enschede, Amersfoort North America: Toronto, Boston Belgium: Leuven UK: London Slovakia / Eastern Europe: Bratislava France: Paris Germany / Central Europe: Düsseldorf Sweden / Nordic countries: Stockholm Partners Latin America: Dux Diligens Mexico: Unycorp Australia: Neodata Portugal: Process Sphere
6 What you will learn today How to incorporate risk and security aspects in your EA models Combining Enterprise Risk & Security Management with ArchiMate brings risk and security to the boardroom How to visualize vulnerabilities of the IT infrastructure in your EA models How to achieve more balanced decision making based on risk and security measures
7 Problem statement Organizations are increasingly networked and thus more complex Attacks on information systems are becoming increasingly sophisticated Attacks use digital, physical and social engineering and the departments responsible for each of these domains within an organization operate in silos Current risk management methods cannot handle the resulting complexity
8 Limitations of current approaches Existing information security and risk management methods do not systematically identify potential attacks They are based on, e.g., checklists, heuristics and experience Security controls are applied in a bottom-up way They are not based on a thorough analysis of risks and vulnerabilities No explicit definition of security principles and requirements Focus on only IT security They have difficulties in dealing with complex attacks on socio-technical systems, combining physical/digital access, and social engineering Focus on preventive security controls Corrective and curative controls are not considered
9 Characteristics of Enterprise Risk & Security Management Integral vision on security: protection of business, information, application and technology assets Structured identification and analysis of risks and vulnerabilities Supports strategic risk management Supports Security by Design
10 ENTERPRISE ARCHITECTURE WITH ARCHIMATE AND TOGAF
11 What is Enterprise Architecture? A discipline, with the objective of steering changes Information architecture Process architecture A product A design that shows the coherence between products, processes, organisation, information supply and infrastructure, based on a vision and certain explicit starting points, principles and preferences A process Way of working Aimed at the development and use of enterprise architectures within an enterprise With people and resources? Application architecture Technical architecture
12 Ingredients for a successful EA practice TOGAF ArchiMate Process Viewpoints Language Repository, Reference Models
13 The TOGAF Architecture Development Method (ADM)
14 The ArchiMate language A basis for High-level modelling within domains ArchiMate language Visualizations Modeling relationships between domains Relating detailed design models Analysis
15 Implementation & Migration Technology Application Business Passive structure Behavior Active structure Motivation
16 ArchiMate + TOGAF Free download of the whitepaper Enterprise Architecture with TOGAF 9.1 and ArchiMate here: /download/293
17 ENTERPRISE RISK & SECURITY MANAGEMENT WITH ARCHIMATE
18 Why ArchiMate for Risk & Security Architecture? Widely accepted open standard for modeling enterprise architecture Tool support widely available Good fit with other EA and security frameworks (TOGAF, Zachman, SABSA) ArchiMate models integrate business, information, application and technology architecture Link with (security) requirements, principles goals (Motivation extension) Traceability Link with detailed design languages for business processes and IT solutions (e.g., BPMN and UML) Suitable as a basis for (qualitative and quantitative) analysis and visualization
19 ArchiMate Risk project Collaboration of ArchiMate Forum and Security Forum Two areas of concern: Risk analysis Security deployment (risk mitigation) Investigate how (specializations of) existing ArchiMate concepts (Core and extensions) can be used Inspired on well-established risk and security standards and frameworks, including COSO, FAIR, SABSA White paper in progress
20 Proposal for a Risk Overlay for ArchiMate
21 Proposal for a Risk Overlay for ArchiMate
22 Enterprise Risk Management with ArchiMate Assess risks Identify threats Specify required control measures Analyze vulnerabilities Implement control measures Execute ArchiMate & monitor Core
23 CASE STUDY: PENTEST-BASED BUSINESS IMPACT ANALYSIS
24 Case study partners Tools, methods and best practices for Enterprise Architecture, Business Process Management, Enterprise Risk& Security Mgt. Cyber security consultancy, solutions and services Pentesting and Pentest-based BIA
25 What is a pentest? Goal pentest: Find weak spots and threats in a network infrastructure and/or a web application Advise on ways to fix and mitigate these weak spots and threats Pentesting from different perspectives: External: what can a hacker (ab)use or do from the internet? Internal: what can a hacker or employee do when he/she is in your network?
26 Pentest approach Partly automated (vulnerability scan) Human interpretation and customized advice
27 Automated vulnerability scans
28 HTML report of a vulnerability scan
29 Details of a vulnerability
30 Host perspective
31 Approach Option 1 Option 1 configuration from EA 1. Use the enterprise architecture to set the scope of the pentest Top-down analysis 2. Perform a focused pentest 3. Import and analyze results in EA model Bottom-up analysis Insight in risks to (critical) business processes
32 Approach Option 2 Option 2 Manual configuration 1. Perform pentest or use results from a previously performed pentest 2. Create Enterprise Architecture Possibly partly automated, based on pentest results 3. Import and analyze pentest results in the EA model Bottom-up analysis Insight in risks to (critical) business processes
33 Top-down analysis
34 Perform pentest
35 Bottom-up analysis
36 Business impact of technical risks Example: Missing critical patches on Database Server VA 01 Missing critical patches which can lead to jeopardization of the server Technical risk Complexity (to exploit) Effort (to solve) Present on system(s) Description High Meidum Low (Database Server) This system misses critical patches for the Microsoft Operating System concerning the following security bulletins: MS08-067: Conficker patch Published in 2008 MS06-040: Published in 2006 This leads to multiple weaknesses on the system. Exploiting these weaknesses can lead to Running own/arbitrary code on the system Buffer overflow in the server service which may put the system in jeopardy Recommendation Impact on Business Business risk Business recommendation Install missing patches Business processes Intake and Notify requester depend on this Database Server and are the processes that fill this server with (sensitive) data. When this server is compromised by exploitation of abovementioned vulnerabilities, then the attacker can steal personal data from the registering applicants as well as modify who will be informed on its registration request. Medium Because of the low effort necessary to process the (technical) recommendation in combination with the Medium business risk, we recommend to process the technical recommendation within 1 month.
37 Summary of a pentest-based BIA
38 VISUALIZING THE BUSINESS IMPACT OF CYBER RISKS
39 Risk analysis
40 Example visualization: Risk factor versus process criticality Acceptable with mitigation Unacceptable Acceptable
41 Example visualization: Confidentiality, Availability and Integrity
42 CONCLUSIONS
43 Business value of pentest-based BIA A pentest-based BIA: Makes the business impact as a result of cyber risks visible and measurable Top-down-analyse Powerful management dashboard Facilitates focused testing of technical components supporting critical business processes Provides insight in the business risk when adding new components to your technical infrastructure Increases the return on investment for your enterprise architecture effort Bottom-up-analyse ( business impact ) Insight in the impact that cyber risks have on your business
44 Summary Current risk management approaches, working in isolation, fall short in the complexity of current organizations A model-based approach for Enterprise Risk & Security Management is needed Systematic analysis of threats and vulnerabilities Integrated design of control measures The ArchiMate language provides the hooks for integrated risk & security modeling, integrated with Enterprise Architecture EA models support business impact analysis of technical risks / vulnerabilities
45 Integrated tool suite Architecture Tools Design, communicate & analyze architectures Incorporating risk & security aspects Easy to use Integrated in one repository tools/bizzdesign-architect/
46 Consultancy on Enterprise Architecture and Enterprise Risk & Security Management Integrated consultancy Workshops and consultancy services Kick-start your EA or Enterprise Risk & Security Management initiative Implementing TOGAF, ArchiMate, Enterprise Risk & Security Management
47 Training on Enterprise Architecture ArchiMate & Architect training, 3 days (open/in house) ArchiMate language BiZZdesign Architect includes ArchiMate certification TOGAF certified training, 4 days (open/in house) Foundation 2 days, Practitioner 2 days Includes TOGAF certification Security architecture training, 1 day Modelling a security architecture with ArchiMate
48 Contact info and more information A copy of these slides: and select webinars" blog.bizzdesign.com Free trial version: Whitepaper EA with ArchiMate and TOGAF : download/293 Downloadable versions of the full specifications of ArchiMate and TOGAF at Many whitepapers, and recorded webinars General information about BiZZdesign: The website of our Academy: Our Tool, BiZZdesign Architect
Modelling, Analysing and Improving an ERP Architecture with ArchiMate
Modelling, Analysing and Improving an ERP Architecture with ArchiMate June 25th, 2014 Heinz-Juergen Scherer, TransWare Tim Vehof, BiZZdesign Agenda Introduction Enterprise Architecture ERP systems and
Building a strong data management capability with TOGAF and ArchiMate. Bas van Gils b.vangils@bizzdesign.com
Building a strong data management capability with TOGAF and ArchiMate Bas van Gils b.vangils@bizzdesign.com Dr. Bas van Gils +31-(0)6-484 320 88 b.vangils@bizzdesign.nl http://linkedin.com/in/basvg http://blog.bizzdesign.com
Building Business Capabilities
Building Business Capabilities using BiZZdesign Architect and ArchiMate October 17 th, 2013 Your presenter today Business and IT majors, University of Twente, Netherlands Experience in application, business
From Capability-Based Planning to Competitive Advantage Assembling Your Business Transformation Value Network
From Capability-Based Planning to Competitive Advantage Assembling Your Business Transformation Value Network Marc Lankhorst, BiZZdesign Iver Band, Cambia Health Solutions INTRODUCTIONS 2 1 Marc Lankhorst
Business Requirements as the Basis for Enterprise Architecture and Project Architectures. Harmen van den Berg
Business Requirements as the Basis for Enterprise Architecture and Project Architectures Harmen van den Berg And the speaker is... Harmen van den Berg Manager BiZZdesign International Trainer for ArchiMate
Information Security is not an IT problem! Enterprise Risk & Security Management
Information Security is not an IT problem! Enterprise Risk & Security Management Raymond Slot Security Seminar 20 maart 2015 Some Security Incidents in 2014 Anthem 80 million customer records exposed JPMorgan
Enterprise Architecture with TOGAF 9.1 and ArchiMate 2.0 1. Henk Jonkers, Dick Quartel, Bas van Gils and Henry Franken
White Paper Publication date: May 31 st, 2012 Enterprise with TOGAF 9.1 and ArchiMate 2.0 1 Henk Jonkers, Dick Quartel, Bas van Gils and Henry Franken Executive summary With the appearance of Version 2.0,
Enterprise Security Architecture for Cyber Security. M.M.Veeraragaloo 5 th September 2013
Enterprise Security Architecture for Cyber Security M.M.Veeraragaloo 5 th September 2013 Outline Cyber Security Overview TOGAF and Sherwood Applied Business Security Architecture (SABSA) o o Overview of
Security-as-a-Service (Sec-aaS) Framework. Service Introduction
Security-as-a-Service (Sec-aaS) Framework Service Introduction Need of Information Security Program In current high-tech environment, we are getting more dependent on information systems. This dependency
Enterprise Portfolio Management
Enterprise Portfolio Management Managing large volumes of structured data Through its powerful capabilities as a structural modeling tool, ABACUS Summary provides of whitepaper a ready-to-go Summary solution
BiZZdesign Academy. BiZZdesign www.bizzdesign.com. Training Program 2013. Your Partner in Building Strong Organizations
BiZZdesign Academy Training Program 2013 BiZZdesign www.bizzdesign.com Your Partner in Building Strong Organizations The wants and needs of the customer are always well-integrated in the training sessions.
PASTA Abstract. Process for Attack S imulation & Threat Assessment Abstract. VerSprite, LLC Copyright 2013
2013 PASTA Abstract Process for Attack S imulation & Threat Assessment Abstract VerSprite, LLC Copyright 2013 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
THREAT VISIBILITY & VULNERABILITY ASSESSMENT
THREAT VISIBILITY & VULNERABILITY ASSESSMENT Date: April 15, 2015 IKANOW Analysts: Casey Pence IKANOW Platform Build: 1.34 11921 Freedom Drive, Reston, VA 20190 IKANOW.com TABLE OF CONTENTS 1 Key Findings
How we see malware introduced Phishing Targeted Phishing Water hole Download (software (+ free ), music, films, serialz)
How we see malware introduced Phishing Targeted Phishing Water hole Download (software (+ free ), music, films, serialz) Domain.Local DC Client DomainAdmin Attack Operator Advise Protect Detect Respond
ensuring security the way how we do it
ensuring security the way how we do it HUSTEF, 2015.11.18 Attila Tóth 1 Nokia Solutions and Networks 2014 Disclaimer The ideas, processes, tools are presented from a practitioner s point of view working
BUILDING AN EFFECTIVE VULNERABILITY MANAGEMENT PROGRAM. Henrik Åkerstrand Account Executive Nordics
BUILDING AN EFFECTIVE VULNERABILITY MANAGEMENT PROGRAM Henrik Åkerstrand Account Executive Nordics WHY is vulnerability management important? WHAT are some considerations you should make? HOW can we help
Best Practices Top 10: Keep your e-marketing safe from threats
Best Practices Top 10: Keep your e-marketing safe from threats Months of work on a marketing campaign can go down the drain in a matter of minutes thanks to an unforeseen vulnerability on your campaign
CS 356 Lecture 25 and 26 Operating System Security. Spring 2013
CS 356 Lecture 25 and 26 Operating System Security Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control
Module F13 The TOGAF Certification for People Program
Module F13 The TOGAF Certification for People Program V9.1 Edition Copyright 010-011 Slide 1 of All rights reserved Published by The Open Group, 011 The TOGAF Certification for People Program Slide of
G-Cloud III Services Service Definition Accenture Cloud Security Services
G-Cloud III Services Service Definition Accenture Cloud Security Services 1 Table of contents 1. Scope of our services... 3 2. Approach... 3 3. Assets and tools... 4 4. Outcomes... 5 5. Pricing... 5 6.
SAST, DAST and Vulnerability Assessments, 1+1+1 = 4
SAST, DAST and Vulnerability Assessments, 1+1+1 = 4 Gordon MacKay Digital Defense, Inc. Chris Wysopal Veracode Session ID: Session Classification: ASEC-W25 Intermediate AGENDA Risk Management Challenges
North Dakota 2013 IT Security Audit Vulnerability Assessment & Penetration Test Project Briefing
North Dakota 2013 IT Security Audit Vulnerability Assessment & Penetration Test Project Briefing Introduction ManTech Project Manager Mark Shaw, Senior Executive Director Cyber Security Solutions Division
ArchiMate Extension for Modeling the TOGAF Implementation and Migration Phases
ArchiMate Extension for Modeling the TOGAF Implementation and Migration Phases A White Paper by: Henk Jonkers, Harmen van den Berg, Maria-Eugenia Iacob, and Dick Quartel December 2010 Copyright 2010 The
Security Assessment and Compliance Services
Security Assessment and Compliance Services Despite the best efforts of IT security teams, hackers and malicious code continue to find their way into corporate networks. Adding to the pressure is the fact
G- Cloud Specialist Cloud Services. Security and Penetration Testing. Overview
Description C Service Overview G- Cloud Specialist Cloud Services Security and Penetration Testing This document provides a description of TVS s Security and Penetration Testing Service offered under the
Session 9: Changing Paradigms and Challenges Tools for Space Systems Cyber Situational Awareness
Session 9: Changing Paradigms and Challenges Tools for Space Systems Cyber Situational Awareness Wayne A. Wheeler The Aerospace Corporation GSAW 2015, Los Angeles, CA, March 2015 Agenda Emerging cyber
Practice Description Business process management and enterprise architecture
Practice Description Business process management and enterprise architecture 1. Description of the practice The BPM & EA practice assists organisations in 1 keeping in control of the performance of their
Seven Practical Steps to Delivering More Secure Software. January 2011
Seven Practical Steps to Delivering More Secure Software January 2011 Table of Contents Actions You Can Take Today 3 Delivering More Secure Code: The Seven Steps 4 Step 1: Quick Evaluation and Plan 5 Step
Technology Blueprint. Protect Your Email Servers. Guard the data and availability that enable business-critical communications
Technology Blueprint Protect Your Email Servers Guard the data and availability that enable business-critical communications LEVEL 1 2 3 4 5 SECURITY CONNECTED REFERENCE ARCHITECTURE LEVEL 1 2 4 5 3 Security
locuz.com Professional Services Security Audit Services
locuz.com Professional Services Security Audit Services Today s Security Landscape Today, over 80% of attacks against a company s network come at the Application Layer not the Network or System layer.
Top five strategies for combating modern threats Is anti-virus dead?
Top five strategies for combating modern threats Is anti-virus dead? Today s fast, targeted, silent threats take advantage of the open network and new technologies that support an increasingly mobile workforce.
THE BLUENOSE SECURITY FRAMEWORK
THE BLUENOSE SECURITY FRAMEWORK Bluenose Analytics, Inc. All rights reserved TABLE OF CONTENTS Bluenose Analytics, Inc. Security Whitepaper ISO 27001/27002 / 1 The Four Pillars of Our Security Program
Approach to Information Security Architecture. Kaapro Kanto Chief Architect, Security and Privacy TeliaSonera
Approach to Information Security Architecture Kaapro Kanto Chief Architect, Security and Privacy TeliaSonera About TeliaSonera TeliaSonera provides network access and telecommunication services that help
The Value of Vulnerability Management*
The Value of Vulnerability Management* *ISACA/IIA Dallas Presented by: Robert Buchheit, Director Advisory Practice, Dallas Ricky Allen, Manager Advisory Practice, Houston *connectedthinking PwC Agenda
Secure Web Applications. The front line defense
Secure Web Applications The front line defense Agenda Web Application Security Threat Overview Exploiting Web Applications Common Attacks & Preventative techniques Developing Secure Web Applications -Security
Module 6 Essentials of Enterprise Architecture Tools
Process-Centric Service-Oriented Module 6 Essentials of Enterprise Architecture Tools Capability-Driven Understand the need and necessity for a EA Tool IASA Global - India Chapter Webinar by Vinu Jade
Cloud Infrastructure Security Management
www.netconsulting.co.uk Cloud Infrastructure Security Management Visualise your cloud network, identify security gaps and reduce the risks of cyber attacks. Being able to see, understand and control your
THE OPEN UNIVERSITY OF TANZANIA
THE OPEN UNIVERSITY OF TANZANIA Institute of Educational and Management Technologies COURSE OUTLINES FOR DIPLOMA IN COMPUTER SCIENCE 2 nd YEAR (NTA LEVEL 6) SEMESTER I 06101: Advanced Website Design Gather
PCI Vulnerability Validation Report
Friday, March 9, 013 PCI Vulnerability Validation Report Introduction This report shows the results of a vulnerability validation tests conducted by CORE Impact Professional Professional in support of
Copyright protected. Use is for Single Users only via a VHP Approved License. For information and printed versions please see www.vanharen.
ArchiMAte 2.0 A Pocket Guide The Open Group Publications available from Van Haren Publishing The TOGAF Series: togaf Version 9.1 togaf Version 9.1 A Pocket Guide togaf 9 Foundation Study Guide, 2nd edition
BUILDING AN OFFENSIVE SECURITY PROGRAM BUILDING AN OFFENSIVE SECURITY PROGRAM
BUILDING AN OFFENSIVE SECURITY PROGRAM Common Gaps in Security Programs Outsourcing highly skilled security resources can be cost prohibitive. Annual assessments don t provide the coverage necessary. Software
Ethical Hacking and Penetration Testing Presented by: Adam Baneth Managing director
Whiteshield Ethical Hacking and Penetration Testing Presented by: Adam Baneth Managing director Hacking Facts Success Hacking stories Stories IV. 1111,111111,lennon@xds.com TEAS,test123,TEST123@SS.COM
Real-Time Security Intelligence for Greater Visibility and Information-Asset Protection
Real-Time Security Intelligence for Greater Visibility and Information-Asset Protection Take the Effort Out of Log Management and Gain the Actionable Information You Need to Improve Your Organisation s
How To Manage A Vulnerability Management Program
VULNERABILITY MANAGEMENT A White Paper Presented by: MindPoint Group, LLC 8078 Edinburgh Drive Springfield, VA 22153 (o) 703.636.2033 (f) 866.761.7457 www.mindpointgroup.com blog.mindpointgroup.com SBA
Protect Your Organization With the Certification That Maps to a Master s-level Education in Software Assurance
Protect Your Organization With the Certification That Maps to a Master s-level Education in Software Assurance Sponsored by the U.S. Department of Homeland Security (DHS), the Software Engineering Institute
CHECKLIST: ONLINE SECURITY STRATEGY KEY CONSIDERATIONS MELBOURNE IT ENTERPRISE SERVICES
ONLINE SECURITY STRATEGY KEY CONSIDERATIONS MELBOURNE IT ENTERPRISE SERVICES Cyber threats continue to rapidly evolve in frequency and sophistication, posing a constant and serious threat to business organisations
Enterprise Architecture at Work
Marc Lankhorst et al. Enterprise Architecture at Work Modelling, Communication and Analysis Third Edition 4y Springer Contents 1 Introduction to Enterprise Architecture 1 1.1 Architecture 1 1.2 Enterprise
FedVTE Training Catalog SPRING 2015. advance. Free cybersecurity training for government personnel. fedvte.usalearning.gov
FedVTE Training Catalog SPRING 2015 advance. Free cybersecurity training for government personnel. fedvte.usalearning.gov If you need any assistance please contact the FedVTE Help Desk here or email the
Overview TECHIS60441. Carry out security testing activities
Overview Information, services and systems can be attacked in various ways. Understanding the technical and social perspectives, how attacks work, the technologies and approaches used are key to being
Hope is not a strategy. Jérôme Bei
Hope is not a strategy Jérôme Bei Press Highlights Conficker hits German Government! 3000 Clients down! Datatheft at German Telekom: 17.000.000 Customer Records lost! About 1.000.000 pieces of Malware
The Perusal and Review of Different Aspects of the Architecture of Information Security
The Perusal and Review of Different Aspects of the Architecture of Information Security Vipin Kumar Research Scholar, CMJ University, Shillong, Meghalaya (India) Abstract The purpose of the security architecture
Intel Security Certified Product Specialist Security Information Event Management (SIEM)
Intel Security Certified Product Specialist Security Information Event Management (SIEM) Why Get Intel Security Certified? As technology and security threats continue to evolve, organizations are looking
PENETRATION TESTING GUIDE. www.tbgsecurity.com 1
PENETRATION TESTING GUIDE www.tbgsecurity.com 1 Table of Contents What is a... 3 What is the difference between Ethical Hacking and other types of hackers and testing I ve heard about?... 3 How does a
Website Security: It s Not all About the Hacker Anymore
Website Security: It s Not all About the Hacker Anymore Mike Smart Sr. Manager, Products and Solutions Trust Services & Website Security Website Security 1 Website Security Challenges Evolving Web Use
Business Security Architecture: Weaving Information Security into Your Organization's Enterprise Architecture through SABSA
This article was downloaded by: [188.204.15.66] On: 20 February 2012, At: 01:40 Publisher: Taylor & Francis Informa Ltd Registered in England and Wales Registered Number: 1072954 Registered office: Mortimer
RSA envision. Platform. Real-time Actionable Security Information, Streamlined Incident Handling, Effective Security Measures. RSA Solution Brief
RSA Solution Brief RSA envision Platform Real-time Actionable Information, Streamlined Incident Handling, Effective Measures RSA Solution Brief The job of Operations, whether a large organization with
Medical Device Security Health Imaging Digital Capture. Security Assessment Report for the Kodak DR V2.0
Medical Device Security Health Imaging Digital Capture Security Assessment Report for the Kodak DR V2.0 Version 1.0 Eastman Kodak Company, Health Imaging Group Page 1 Table of Contents Table of Contents
14 October 2015 ISACA Curaçao Conference By: Paul Helmich
Governance, Risk & Compliance A practical approach 14 October 2015 ISACA Curaçao Conference By: Paul Helmich Topics today What is GRC? How much of all the GRC literature, tools, etc. do I need to study
An Integrated CyberSecurity Approach for HEP Grids. Workshop Report. http://hpcrd.lbl.gov/hepcybersecurity/
An Integrated CyberSecurity Approach for HEP Grids Workshop Report http://hpcrd.lbl.gov/hepcybersecurity/ 1. Introduction The CMS and ATLAS experiments at the Large Hadron Collider (LHC) being built at
The Cyber Threat Profiler
Whitepaper The Cyber Threat Profiler Good Intelligence is essential to efficient system protection INTRODUCTION As the world becomes more dependent on cyber connectivity, the volume of cyber attacks are
Protecting Your Organisation from Targeted Cyber Intrusion
Protecting Your Organisation from Targeted Cyber Intrusion How the 35 mitigations against targeted cyber intrusion published by Defence Signals Directorate can be implemented on the Microsoft technology
Establishing Testing Knowledge and Experience Sharing at Siemens
WWW.QUALTECHCONFERENCES.COM Europe s Premier Software Testing Event World Forum Convention Centre, The Hague, Netherlands The Future of Software Testing Establishing Testing Knowledge and Experience Sharing
Announcement of a new IAEA Co-ordinated Research Programme (CRP)
Announcement of a new IAEA Co-ordinated Research Programme (CRP) 1. Title of Co-ordinated Research Programme Design and engineering aspects of the robustness of digital instrumentation and control (I&C)
ABB s approach concerning IS Security for Automation Systems
ABB s approach concerning IS Security for Automation Systems Copyright 2006 ABB. All rights reserved. Stefan Kubik stefan.kubik@de.abb.com The problem Most manufacturing facilities are more connected (and
Indian Computer Emergency Response Team (CERT-In) Annual Report (2010)
Indian Computer Emergency Response Team (CERT-In) Annual Report (2010) Indian Computer Emergency Response Team (CERT-In) Department of Information Technology Ministry of Communications & Information Technology
ArchiMate and TOGAF. What is the added value?
ArchiMate and TOGAF What is the added value? Why use TOGAF next to ArchiMate? ArchiMate provides a (visual) language ArchiMate provides a content framework TOGAF provides a process TOGAF provides a way
Medical Device Security Health Imaging Digital Capture. Security Assessment Report for the Kodak CR V4.1
Medical Device Security Health Imaging Digital Capture Security Assessment Report for the Kodak CR V4.1 Version 1.0 Eastman Kodak Company, Health Imaging Group Page 1 Table of Contents Table of Contents
Cyber threat intelligence and the lessons from law enforcement. kpmg.com/cybersecurity
Cyber threat intelligence and the lessons from law enforcement kpmg.com/cybersecurity Introduction Cyber security breaches are rarely out of the media s eye. As adversary sophistication increases, many
WHITEPAPER. Nessus Exploit Integration
Nessus Exploit Integration v2 Tenable Network Security has committed to providing context around vulnerabilities, and correlating them to other sources, such as available exploits. We currently pull information
FedVTE Training Catalog SUMMER 2015. advance. Free cybersecurity training for government personnel. fedvte.usalearning.gov
FedVTE Training Catalog SUMMER 2015 advance. Free cybersecurity training for government personnel. fedvte.usalearning.gov Access FedVTE online at: fedvte.usalearning.gov If you need any assistance please
McAfee Database Security. Dan Sarel, VP Database Security Products
McAfee Database Security Dan Sarel, VP Database Security Products Agenda Databases why are they so frail and why most customers Do very little about it? Databases more about the security problem Introducing
HP ProLiant Essentials Vulnerability and Patch Management Pack Planning Guide
HP ProLiant Essentials Vulnerability and Patch Management Pack Planning Guide Product overview... 3 Vulnerability scanning components... 3 Vulnerability fix and patch components... 3 Checklist... 4 Pre-installation
ENISA s Study on the Evolving Threat Landscape. European Network and Information Security Agency
ENISA s Study on the Evolving Threat Landscape European Network and Information Security Agency Agenda Introduction to ENISA Preliminary remarks The ENISA report Major findings Conclusions 2 ENISA The
Information Security Management at the Olympics: Finding the Needle in the Haystack
Information Security Management at the Olympics: Finding the Needle in the Haystack Markus J. Krauss VP Cloud Computing and Service Provider mjk@netiq.com Chris Van Den Abbeele Solution Manager ISRM chris.vandenabbeele@atos.net
White Paper An Enterprise Security Program and Architecture to Support Business Drivers
White Paper An Enterprise Security Program and Architecture to Support Business Drivers seccuris.com (866) 644-8442 Contents Introduction... 3 Information Assurance... 4 Sherwood Applied Business Security
Practitioner Certificate in Information Assurance Architecture (PCiIAA)
Practitioner Certificate in Information Assurance Architecture (PCiIAA) 15 th August, 2015 v2.1 Course Introduction 1.1. Overview A Security Architect (SA) is a senior-level enterprise architect role,
End-user Security Analytics Strengthens Protection with ArcSight
Case Study for XY Bank End-user Security Analytics Strengthens Protection with ArcSight INTRODUCTION Detect and respond to advanced persistent threats (APT) in real-time with Nexthink End-user Security
FEELING VULNERABLE? YOU SHOULD BE.
VULNERABILITY ASSESSMENT FEELING VULNERABLE? YOU SHOULD BE. CONTENTS Feeling Vulnerable? You should be 3-4 Summary of Research 5 Did you remember to lock the door? 6 Filling the information vacuum 7 Quantifying
PCI DSS Overview and Solutions. Anwar McEntee Anwar_McEntee@rapid7.com
PCI DSS Overview and Solutions Anwar McEntee Anwar_McEntee@rapid7.com Agenda Threat environment and risk PCI DSS overview Who we are Solutions and where we can help Market presence High Profile Hacks in
Pass-the-Hash. Solution Brief
Solution Brief What is Pass-the-Hash? The tools and techniques that hackers use to infiltrate an organization are constantly evolving. Credential theft is a consistent concern as compromised credentials
Grid and Multi-Grid Management
Key Benefits High Availability, Massive Scalability Infoblox Provides always on network services through scalable, redundant, reliable and faulttolerant architecture Guarantees data integrity and availability
Cyber R &D Research Roundtable
Cyber R &D Research Roundtable 2 May 2013 N A T I O N A L S E C U R I T Y E N E R G Y & E N V I R O N M E N T H E A L T H C Y B E R S E C U R I T Y Changing Environment Rapidly Evolving Threat Changes
Addressing FISMA Assessment Requirements
SOLUTION BRIEF Heeding FISMA s Call for Security Metrics and Continuous Network Monitoring Addressing FISMA Assessment Requirements Using RedSeal november 2011 WHITE PAPER RedSeal Networks, Inc. 3965 Freedom
Information Technology Risk Management
Find What Matters Information Technology Risk Management Control What Counts The Cyber-Security Discussion Series for Federal Government security experts... by Carson Associates your bridge to better IT
HP Application Security Center
HP Application Security Center Web application security across the application lifecycle Solution brief HP Application Security Center helps security professionals, quality assurance (QA) specialists and
Business Process (BPMN) Course
Business Process (BPMN) Course 2 day course held as Public or On Site Course We also offer bespoke foundation & advanced modules which can be developed/adapted to suit requirements Course Objectives Day
Medical Device Security Health Imaging Digital Capture. Security Assessment Report for the Kodak Capture Link Server V1.00
Medical Device Security Health Imaging Digital Capture Security Assessment Report for the Kodak Capture Link Server V1.00 Version 1.0 Eastman Kodak Company, Health Imaging Group Page 1 Table of Contents
Information Technology Cluster
Network Systems Pathway Information Technology Cluster Assistant Network Technician -- This major prepares students to install, configure, operate, and connections to remote sites in a wide area network
Patch management with GFI LANguard N.S.S. & Microsoft SUS
Patch management with GFI LANguard N.S.S. & Microsoft SUS A cost-effective and easy solution for network-wide patch management This white paper provides an overview of how to use GFI LANguard Network Security
White Paper What Solutions Architects Should Know About The TOGAF ADM
White Paper What Solutions Architects Should Know About The TOGAF ADM WP0015 October 2011 The Open Group Architecture Framework 1 (TOGAF) is the most widely referenced architecture framework currently
INCREASINGLY, ORGANIZATIONS ARE ASKING WHAT CAN T GO TO THE CLOUD, RATHER THAN WHAT CAN. Albin Penič Technical Team Leader Eastern Europe
INCREASINGLY, ORGANIZATIONS ARE ASKING WHAT CAN T GO TO THE CLOUD, RATHER THAN WHAT CAN Albin Penič Technical Team Leader Eastern Europe Trend Micro 27 years focused on security software Headquartered
Applying the 80/20 approach for Operational Excellence. How to combat new age threats, optimize investments and increase security.
Applying the 80/20 approach for Operational Excellence How to combat new age threats, optimize investments and increase security Vinod Vasudevan Agenda Current Threat Landscape The 80/20 Approach Achieving
The Open Group Architectural Framework
The Open Group Architectural Framework Background TOGAF is a step-by-step method for developing an enterprise architecture, using a set of prescribed tools. It is freely available on the Open Group website
The Importance of Vulnerability Assessment For Your Organisation
RCS Newsletter January 2011 Vulnerability Assessment Fitting it into your Increasing incidents of automated attacks on information systems Automated attacks on information systems, and especially attacks
Modelling the Business Case Study 3 Attendance Monitoring Project and Enterprise Architecture
Modelling the Business Case Study 3 Attendance Monitoring Project and Enterprise Architecture Background: Currently, in Roehampton University, class attendance data is collected and used as one of the
Risk Analytics for Cyber Security
Risk Analytics for Cyber Security Justin Coker, VP EMEA, Skybox Security IT Challenges 2015, Belgium 2nd October 2014 www.skyboxsecurity.com justin.coker@skyboxsecurity.com +44 (0) 7831 691498 Risk Analytics
SECURITY RISK MANAGEMENT. FIRST 2007 Seville, Spain
SECURITY RISK MANAGEMENT FROM TECHNOLOGY VISION TO MARKET REALITY Avi Corfas, VP EMEA Skybox Security FIRST 2007 Seville, Spain Topics The Risk Assessment Challenge What Is IT Security Risk Management?
PCI DSS Reporting WHITEPAPER
WHITEPAPER PCI DSS Reporting CONTENTS Executive Summary 2 Latest Patches not Installed 3 Vulnerability Dashboard 4 Web Application Protection 5 Users Logging into Sensitive Servers 6 Failed Login Attempts