Best Practice Strategies for Managing and Mitigating Key Cyber Risks. Brendan Saunders, Principal Security Consultant - November 2015

Transcription

1 Best Practice Strategies for Managing and Mitigating Key Cyber Risks Brendan Saunders, Principal Security Consultant - November

2 Agenda Key Cyber Risks Technical Threats People The Cyber Assurance Lifecycle The Cyber Security Maturity Model The NCC Group Approach 2

3 Key Cyber Risks Where are we vulnerable? Technical Off-the-Shelf Products Internally-developed Products Procedural People Processes 3

4 Technical Threats Out-of-Date, Unpatched Software Windows XP/Windows Server 2003 Over-reliance on Anti-virus Products In-house Developed Applications Outdated component versions in custom applications Network Segregation Physical Network Entry Points (Wired & Wireless) BYOD and Remote Workers

5 A Defence-in-Depth Approach 3 rd Party Perimeter DMZ User NW Core NW

6 People

7 Phishing: Statistics

8 The Insider Threat Layer 8 Failures can be intentional as well as accidental Between 40-60% reported incidents the result of insiders Employee Profile for Insider Threats Contractors and Service Staff Lack of Effective Staff Vetting Failure to enforce Separation of Duties for Trusted Employees

9 So why does this matter? 9

10 The Cyber Assurance Lifecycle Prepare Knowledge is Power, Know your Environment, Know how you need to Respond, Know what you need to test Assess Internal Assessment, External Expertise, Contextualise Vulnerabilities and Threats to Determine the Risks Maintain Effective Change Control, Patch Everything Respond Effective Monitoring, Alerting and an Effective Response Plan may save your business Review Repeat the Cycle, Expect Change, Remain Flexible

11 Implementation Cyber Maturity Model Overall cyber resilience None Ability to defend against some attacks Ability to defend and detect common incidents Ability to defend, detect and respond to most incidents Ability to defend, detect, respond and gain intelligence Standards and validation Cyber Essentials Cyber Essentials + ISO CE+, ISO plus paper validation CE+, ISO, paper & tech validation CE+, ISO, paper, tech & end-to-end ongoing validation Contractual cover / supplier relationship None Minimal cyber security requirements Allows independent cyber security review Independent validation / information shared plus requires proactive notification of incidents Approach to risk management Ad-hoc Conformance and audit driven Audit and proactive Audit, proactive with dynamic risk models.. plus continual validation of risk models Cyber security strategy Reactive Regulatory (customer) driven Regulatory, customer and maybe peer driven Regulatory, customer, peer & threat driven Regulatory, peer, customer, threat and intelligence driven Immature Early Starter Progressive Semi-Mature Mature NCC Group Supply Chain Cyber Security Maturity Model for Enterprise Risk Management

12 Implementation Cyber Maturity Model - Today Overall cyber resilience None Ability to defend against some attacks Ability to defend and detect common incidents Ability to defend, detect and respond to most incidents Ability to defend, detect, respond and gain intelligence Standards and validation Cyber Essentials Cyber Essentials + ISO CE+, ISO plus paper validation CE+, ISO, paper & tech validation CE+, ISO, paper, tech & end-to-end ongoing validation Contractual cover / supplier relationship None Minimal cyber security requirements Allows independent cyber security review Independent validation / information shared plus requires proactive notification of incidents Approach to risk management Ad-hoc Conformance and audit driven Audit and proactive Audit, proactive with dynamic risk models.. plus continual validation of risk models Cyber security strategy Reactive Regulatory (customer) driven Regulatory, customer and maybe peer driven Regulatory, customer, peer & threat driven Regulatory, peer, customer, threat and intelligence driven Immature Early Starter Progressive Semi-Mature Mature NCC Group Supply Chain Cyber Security Maturity Model for Enterprise Risk Management

13 Further reading / viewing

14 Points of Contact Brendan Saunders Principal Security Consultant M: E: 14

15 Locations North America Atlanta Austin Chicago New York San Francisco Seattle Sunnyvale Europe Manchester - Head Office Amsterdam Basingstoke Cambridge Copenhagen Cheltenham Edinburgh Glasgow Leatherhead Leeds London Luxembourg Malmö Milton Keynes Munich Vilnius Wetherby Zurich Australia Sydney 15