Bring Your Own Internet of Things: BYO IoT
|
|
|
- Winfred Turner
- 8 years ago
- Views:
Transcription
1 SESSION ID: CSV F02 Bring Your Own Internet of Things: BYO IoT Carsten Eiram Chief Research Officer Risk Based Jake Kouns CISO Risk Based
2 Agenda What is IoT? What s the Problem? What s the Attack Surface? IoT Security Current State Response and Actions
3 Internet of Things Who Came Up With It?
4 Internet of Things Definition?
5 Internet of Things Definition (Techopedia.com) The Internet of Things (IoT) is a computing concept that describes a future where everyday physical objects will be connected to the Internet and be able to identify themselves to other devices. The term is closely identified with RFID as the method of communication, although it also may include other sensor technologies, wireless technologies or QR codes. The IoT is significant because an object that can represent itself digitally becomes something greater than the object by itself. No longer does the object relate just to you, but is now connected to surrounding objects and database data. When many objects act in unison, they are known as having "ambient intelligence. The Internet of Things is a difficult concept to define precisely. Techopedia.com
6 Internet of Things So, What Is it?
7 Internet of Things Definition (Conclusion) 1. Needs to be networked / connected 2. Some capability of sensing and decision making without human interaction/control Many products have the word Smart in their name or to describe its function
8 Internet of Things Examples (Everyday Life)
9 Internet of Things Examples (Just because we can...)
10 Internet of Things Definition Looking past all the hype, IoT does not just pertain to consumers. From a business perspective, it can: Help to cut costs Save time Improve productivity and efficiency.
11 Internet of Things Process
12 Internet of Things Examples (Retail)
13 Internet of Things Examples (Environmental)
14 Internet of Things Examples (Your Network?)
15 Internet of Things Examples (Your Network?)
16 Internet of Things Why Should You Care?
17 Internet of Things Why Should You Care? The analyst firm Gartner says that by 2020 there will be over 26 billion connected devices that s a lot of connections (some even estimate this number to be much higher, over 100 billion). We expect the number of connected objects to reach 50bn by 2020 (2.7% of things in the world) Cisco explanation internet things that anyone can understand/ content?type=webcontent&articleid=
18 Internet of Things What About YOUR Network? How many IoT devices are on your network today? How many of them do you know about? If they are not already on your company network, they will be soon!
19 What s The Problem?
20 Internet of Things What About YOUR Network?
21 Internet of Things What About YOUR Network?
22 Internet of Things IoT IS Coming!
23 Internet of Things How Is This Different? Even more Shadow IT, where unexpected BI/PD (Bodily Injury, Property Damage) People can get hurt, and property can be damaged Real world impact no longer 1s and 0s
24 Internet of Things What s In The News?
25 Internet of Things What s In The News?
26 Internet of Things What s In The News?
27 Internet of Things Junk Hacking
28 Internet of Things IoT Not Just In Your Garage
29 Internet of Things IoT Connected
30 Internet of Things Tripwire Study release/study criticalinfrastructure executives complacent about internet of things security/
31 Internet of Things Tripwire Key Findings 63% of executives expect business efficiencies and productivity to force adoption of IoT devices despite security risks 46% say that IoT has the potential to become the most significant risk on their networks
32 Internet of Things Tripwire Key Findings 59% of IT personnel working in medium and large sized businesses are concerned that IoT could become the most significant security risk on their networks
33 Internet of Things Tripwire Key Findings Remote workers have an average of 11 IoT devices on their home networks 24% have already connected at least one of these to their enterprise networks
34 Internet of Things Tripwire Key Findings Only 30% of IT professionals believe their company has the technology necessary to adequately evaluate the security of IoT devices 1/5 of the respondents stated that they have no visibility into current protection levels
35 Internet of Things Is There An Impact?
36 Internet of Things 3rd Party Breaches
37 Internet of Things 3rd Party Breaches
38 Internet of Things 3rd Party Breaches
39 Internet of Things 3rd Party Breaches Not just a few 3rd party breaches... In 2015 alone: Source: Cyber Risk Analytics (
40 Internet of Things More Shadow IT With IoT!
41 What s The Attack Surface?
42 Internet of Things Communication Cloud / SaaS Internal Network Mobile App Other Devices
43 Internet of Things Devices (ASA) Remotely accessible services with proper authentication / authorization? Secured communication with other devices, clients, cloud? Secure firmware updating?
44 Internet of Things It s Not Just WiFi During a wireless assessment of a client s WiFi network, InGuardians sniffed for ZigBee, Z wave, and other 900 MHz traffic common for IoT devices It was found that the building contained a ZigBee network that the client was not aware of This network supported devices controlling the building s HVAC system, which put the company s manufacturing process at risk
45 Internet of Things Google!
46 Internet of Things Google!
47 Internet of Things Mobile App (ASA) Remotely accessible services with proper authentication / authorization? Secure storage of data? Loss of device may be similar to losing keys to the kingdom. Secure communication to cloud and devices?
48 Internet of Things Cloud (ASA) Servers securely configured? Mature patch strategy e.g. using VI solution? Secure storage of data? Redundancy and do devices work if no connectivity to cloud?
49 Internet of Things Three Threat Scenarios Enterprise IoT BYOD (BYO IoT) / Cross contamination Remote workers
50 IoT Security Current State
51 Internet of Things What s In The News? Stunt Hacking?
52 Internet of Things IoT Vulns So Far?
53 Internet of Things State of Security Why so relatively few critical vulnerabilies? Requires physical access to devices and often extracting firmware from them, as it s not otherwise readily available
54 Internet of Things State of Security Since there still isn t much IoT vulnerability information (yet!) are there lessons learned from regular embedded devices?
55 Internet of Things State of Security 2016*: * : 13, : 13, : 11, : 10, : 7, : 9, : 8, : 9, : 9,590 Source: VulnDB *YTD January 29 th, 2016
56 Internet of Things State of Security 2016*: * : 13, : 13, : 11, : 10, : 7, : 9, : 8, : 9, : 9,590 Source: VulnDB *YTD January 29 th, 2016
57 Internet of Things TRENDnet
58 Internet of Things D Link
59 Internet of Things TP LINK
60 Internet of Things Everfocus 21 Vulnerabilities
61 Internet of Things Everfocus (Code Maturity) Full reports available at: pdf pdf
62 Internet of Things Topica IP Cameras (TOP 788XMP) No CSRF protection whatsoever Allows e.g. rebooting device or creating user accounts
63 Internet of Things Topica IP Cameras (TOP 788XMP) Supports 3 user types: Viewer, Remote Viewer, and Administrator Restricts access to user_management_config.html but not /cgibin/users.cgi action=add&index=5&username=test&password=test123&privilege=1
64 Internet of Things Mobile Apps
65 Internet of Things State of Security Devices are likely affected by many basic vulnerabilities (low code maturity) Mobile apps may not perform proper TLS certificate validation or store data securely If this is the state of their devices and apps, how much do you trust their cloud with your data?
66 Response and Actions!
67
68 Internet of Things FTC Fines and Penalities
69 Internet of Things FTC Fines and Penalities
70 TRENDnet is: Internet of Things FTC TRENDnet Settlement prohibited from misrepresenting the security of its cameras required to establish a comprehensive information security program designed to address security risks that could result in unauthorized access required to obtain third party assessments of its security programs every two years for the next 20 years. required to notify customers of security issues and updates available to correct any flaw
71 Internet of Things FTC Fines and Penalities
72 Internet of Things FTC Recommendations
73 Internet of Things Where To Start At Your Org?
74 Internet of Things Security Needs A Seat!
75 Internet of Things Find Your IoT! Get an inventory of your current IoT devices Network scanning / mapping know what software is in use where including IoT devices Look at outgoing web traffic / logs to see what IoT devices are talking outbound Know where risk is in your environment Map and track in existing asset management data / CMDBs Ensure you have proper vulnerability intelligence
76 Internet of Things Don t Only Rely On Vuln Scanning Most organizations ONLY use scanners for managing vulnerabilities Many scanners do not even include IoT checks in their products! Even if they did they can t find some of the issues! Even if they did, it is a much longer Time of Exposure than if you truly know your environment (assets) and map to known vulnerabilities Use scanners as a catch all and to help uncover configuration issues, but know IoT isn t a focus yet!
77 Internet of Things Basic Security Foundation! Implement proper network segmentation for all IoT devices where possible Allows for reduction of attack surface Improves incident response ability when devices are clearly indentified
78 Internet of Things IoT Vendors Accept devices are going to be connected to the Internet and can be easily accessed Plan for this and ensure the proper security is in build into the product Ensure software / firmware can be updated and actually update it! Do NOT allow forever day bugs! Plan for updates, limit the use of embedded components where possible Create an easy to use auto update features available Educate staff on security issues Train developers on secure development Create a process and figure out how to respond when issues are found/reported Create an Incident Response team and disclosure vulnerabilities
79 Internet of Things IoT Vendors Implement proper logging and audit history for access and usage Implement access control for the device, including two factor authentication options. Perform source code security audits and product penetration tests Consider creating a bug bounty program to reward reported vulnerabilities in products Understand the 3rd party libraries and code used in the product Select secure libraries from the beginning Monitor for 3rd party vulns and correct.
80 Internet of Things Actions 1. Start talking with your executives about the issues and ensure you are in the loop to conduct the proper risk assessments. 2. IoT is already in your network and more is coming very soon! Inventory current IoT and ensure ongoing monitoring 3. Ensure you incorporate your incident response program to include IoT products and vendors. 4. Work with vendors and pick products that demonstrate they care about security!
81 Thank You!
82 Internet of Things Questions?
83 SESSION ID: CSV F02 Bring Your Own Internet of Things: BYO IoT Carsten Eiram Chief Research Officer Risk Based Jake Kouns CISO Risk Based
Bring Your Own Internet of Things BYO-IoT
Bring Your Own Internet of Things BYO-IoT Carsten Eiram Chief Research Officer che@riskbasedsecurity.com / @CarstenEiram Jake Kouns Chief Information Security Officer jake@riskbasedsecurity.com / @jkouns
PCI Compliance Updates
PCI Compliance Updates E-Commerce / Cloud Security Adam Goslin, Chief Operations Officer AGoslin@HighBitSecurity.com Direct: 248.388.4328 PCI Guidance Google: PCI e-commerce guidance https://www.pcisecuritystandards.org/pdfs/pci_dss_v2_ecommerce_guidelines.pdf
The Internet of Things (IoT) Opportunities and Risks
Session No. 744 The Internet of Things (IoT) Opportunities and Risks David Loomis, CSP Risk Specialist Chubb Group of Insurance Companies Brian Wohnsiedler, CSP Risk Specialist Chubb Group of Insurance
Big Data, Big Risk, Big Rewards. Hussein Syed
Big Data, Big Risk, Big Rewards Hussein Syed Discussion Topics Information Security in healthcare Cyber Security Big Data Security Security and Privacy concerns Security and Privacy Governance Big Data
Internet of Things Security Implications
+ Internet of Things Security Implications Garth Whitacre Senior Security Solution Architect + Agenda 2 n Introduction n What Is The Internet Of Things? n What Happens On The Internet Of Things? n Why
Amadeus Shaping the future of travel
2015 Amadeus IT Group SA Amadeus Shaping the future of travel Neill Cameron Application Security Office 9 July 2015 2015 Amadeus IT Group SA Amadeus in a few words Amadeus is a technology and SaaS company
By: Gerald Gagne. Community Bank Auditors Group Cybersecurity What you need to do now. June 9, 2015
Community Bank Auditors Group Cybersecurity What you need to do now June 9, 2015 By: Gerald Gagne MEMBER OF PKF NORTH AMERICA, AN ASSOCIATION OF LEGALLY INDEPENDENT FIRMS 2015 Wolf & Company, P.C. Cybersecurity
End-user Security Analytics Strengthens Protection with ArcSight
Case Study for XY Bank End-user Security Analytics Strengthens Protection with ArcSight INTRODUCTION Detect and respond to advanced persistent threats (APT) in real-time with Nexthink End-user Security
Network Security Policy
Network Security Policy I. PURPOSE Attacks and security incidents constitute a risk to the University's academic mission. The loss or corruption of data or unauthorized disclosure of information on campus
North Dakota 2013 IT Security Audit Vulnerability Assessment & Penetration Test Project Briefing
North Dakota 2013 IT Security Audit Vulnerability Assessment & Penetration Test Project Briefing Introduction ManTech Project Manager Mark Shaw, Senior Executive Director Cyber Security Solutions Division
Internet of Things (IoT): Security Awareness. Sandra Liepkalns, CRISC sandra.liepkalns@netrus.com
Internet of Things (IoT): Security Awareness Sandra Liepkalns, CRISC sandra.liepkalns@netrus.com So What is the Internet of Things Network of physical objects embedded with: Electronics, software, sensors
THE TOP 4 CONTROLS. www.tripwire.com/20criticalcontrols
THE TOP 4 CONTROLS www.tripwire.com/20criticalcontrols THE TOP 20 CRITICAL SECURITY CONTROLS ARE RATED IN SEVERITY BY THE NSA FROM VERY HIGH DOWN TO LOW. IN THIS MINI-GUIDE, WE RE GOING TO LOOK AT THE
Critical Controls for Cyber Security. www.infogistic.com
Critical Controls for Cyber Security www.infogistic.com Understanding Risk Asset Threat Vulnerability Managing Risks Systematic Approach for Managing Risks Identify, characterize threats Assess the vulnerability
Miami University. Payment Card Data Security Policy
Miami University Payment Card Data Security Policy IT Policy IT Standard IT Guideline IT Procedure IT Informative Issued by: IT Services SCOPE: This policy covers all units within Miami University that
It Won t Happen To Me! A Network and PCI Security Webinar Presented By FMS and VendorSafe
It Won t Happen To Me! A Network and PCI Security Webinar Presented By FMS and VendorSafe Agenda Who Is VendorSafe Technologies? It Won t Happen to Me! PCI DSS Overview The VendorSafe Solution Questions
Hong Kong Information Security Outlook 2015 香 港 資 訊 保 安 展 望
Hong Kong Information Security Outlook 2015 香 港 資 訊 保 安 展 望 Agenda Information Security Trends Year 2014 in Review Outlook for 2015 Advice to the Public Hong Kong Computer Emergency Response Team Coordination
The Protection Mission a constant endeavor
a constant endeavor The IT Protection Mission a constant endeavor As businesses become more and more dependent on IT, IT must face a higher bar for preparedness Cyber preparedness is the process of ensuring
How to Grow and Transform your Security Program into the Cloud
How to Grow and Transform your Security Program into the Cloud Wolfgang Kandek Qualys, Inc. Session ID: SPO-207 Session Classification: Intermediate Agenda Introduction Fundamentals of Vulnerability Management
Risk Analytics for Cyber Security
Risk Analytics for Cyber Security Justin Coker, VP EMEA, Skybox Security IT Challenges 2015, Belgium 2nd October 2014 www.skyboxsecurity.com justin.coker@skyboxsecurity.com +44 (0) 7831 691498 Risk Analytics
Introduction to Runtime Application Self Protection (RASP) Making Applications Self Protecting, Self Diagnosing and Self Testing
Introduction to Runtime Application Self Protection (RASP) Making Applications Self Protecting, Self Diagnosing and Self Testing The cyber security landscape has become increasingly complex in recent years.
In the pursuit of becoming smart
WHITE PAPER In the pursuit of becoming smart The business insight into Comarch IoT Platform Introduction Businesses around the world are seeking the direction for the future, trying to find the right solution
The Changing IT Risk Landscape Understanding and managing existing and emerging risks
The Changing IT Risk Landscape Understanding and managing existing and emerging risks IIA @ Noon Kareem Sadek Senior Manager, Deloitte Canada Chris Close Senior Manager, Deloitte Canada December 2, 2015
How to Practice Safely in an era of Cybercrime and Privacy Fears
How to Practice Safely in an era of Cybercrime and Privacy Fears Christina Harbridge INFORMATION PROTECTION SPECIALIST Information Security The practice of defending information from unauthorised access,
Cyber Security and Information Assurance Controls Prevention and Reaction NOVEMBER 2013
Cyber Security and Information Assurance Controls Prevention and Reaction 1 About Enterprise Risk Management Capabilities Cyber Security Risk Management Information Assurance Strategic Governance Regulatory
Ayla Networks, Inc. SOC 3 SysTrust 2015
Ayla Networks, Inc. SOC 3 SysTrust 2015 SOC 3 SYSTRUST FOR SERVICE ORGANIZATIONS REPORT July 1, 2015 To December 31, 2015 Table of Contents SECTION 1 INDEPENDENT SERVICE AUDITOR S REPORT... 2 SECTION 2
Great Now We Have to Secure an Internet of Things. John Pescatore SANS Director, Emerging Security Trends @John_Pescatore
Great Now We Have to Secure an Internet of Things John Pescatore SANS Director, Emerging Security Trends @John_Pescatore 1 What the Heck is That?? 2 Different Views of the Internet of Things 3 Different
BUILDING A SECURITY OPERATION CENTER (SOC) ACI-BIT Vancouver, BC. Los Angeles World Airports
BUILDING A SECURITY OPERATION CENTER (SOC) ACI-BIT Vancouver, BC. Los Angeles World Airports Building a Security Operation Center Agenda: Auditing Your Network Environment Selecting Effective Security
How to start a software security initiative within your organization: a maturity based and metrics driven approach OWASP
How to start a software security initiative within your organization: a maturity based and metrics driven approach Marco Morana OWASP Lead/ TISO Citigroup OWASP Application Security For E-Government Copyright
Reducing Application Vulnerabilities by Security Engineering
Reducing Application Vulnerabilities by Security Engineering - Subash Newton Manager Projects (Non Functional Testing, PT CoE Group) 2008, Cognizant Technology Solutions. All Rights Reserved. The information
Encyclopedia of Information Assurance Suggested Titles: March 25, 2013 The following titles have not been contracted.
Encyclopedia of Information Assurance Suggested Titles: March 25, 2013 The following titles have not been contracted. Administrative Awareness Case Study: Government Offices Certification and Accreditation:
PCI Wireless Compliance with AirTight WIPS
A White Paper by AirTight Networks, Inc. 339 N. Bernardo Avenue, Suite 200, Mountain View, CA 94043 www.airtightnetworks.com 2013 AirTight Networks, Inc. All rights reserved. Introduction Although [use
Redhawk Network Security, LLC 62958 Layton Ave., Suite One, Bend, OR 97701 sales@redhawksecurity.com 866-605- 6328 www.redhawksecurity.
Planning Guide for Penetration Testing John Pelley, CISSP, ISSAP, MBCI Long seen as a Payment Card Industry (PCI) best practice, penetration testing has become a requirement for PCI 3.1 effective July
Securing Data across the Dynamic Enterprise
Securing Data across the Dynamic Enterprise By Topia Technology Challenge 2014: Ensuring enterprise data security and accessibility Enterprise data must be both secure and accessible tough challenges,
How To Understand The Power Of The Internet Of Things
Next Internet Evolution: Getting Big Data insights from the Internet of Things Internet of things are fast becoming broadly accepted in the world of computing and they should be. Advances in Cloud computing,
Managing Mobile: BYOD, MDM, MAM, and more acronyms. John H Sawyer Senior Security Analyst InGuardians, Inc.
Managing Mobile: BYOD, MDM, MAM, and more acronyms John H Sawyer Senior Security Analyst InGuardians, Inc. Who Am I? InGuardians Senior Security Analyst Penetration Testing Web, Network, Smart Grid, Mobile,
Cybercrime myths, challenges and how to protect our business. Vladimir Kantchev Managing Partner Service Centrix
Cybercrime myths, challenges and how to protect our business Vladimir Kantchev Managing Partner Service Centrix Agenda Cybercrime today Sources and destinations of the attacks Breach techniques How to
The Benefits of an Integrated Approach to Security in the Cloud
The Benefits of an Integrated Approach to Security in the Cloud Judith Hurwitz President and CEO Marcia Kaufman COO and Principal Analyst Daniel Kirsch Senior Analyst Sponsored by IBM Introduction The
Network/Cyber Security
Network/Cyber Security SCAMPS Annual Meeting 2015 Joe Howland,VC3 Source: http://www.information-age.com/technology/security/123458891/how-7-year-old-girl-hacked-public-wi-fi-network-10-minutes Security
Concierge SIEM Reporting Overview
Concierge SIEM Reporting Overview Table of Contents Introduction... 2 Inventory View... 3 Internal Traffic View (IP Flow Data)... 4 External Traffic View (HTTP, SSL and DNS)... 5 Risk View (IPS Alerts
Enterprise Application Enablement for the Internet of Things
Enterprise Application Enablement for the Internet of Things Prof. Dr. Uwe Kubach VP Internet of Things Platform, P&I Technology, SAP SE Public Internet of Things (IoT) Trends 12 50 bn 40 50 % Devices
TASK -040. TDSP Web Portal Project Cyber Security Standards Best Practices
Page 1 of 10 TSK- 040 Determine what PCI, NERC CIP cyber security standards are, which are applicable, and what requirements are around them. Find out what TRE thinks about the NERC CIP cyber security
Who is Watching You? Video Conferencing Security
Who is Watching You? Video Conferencing Security Navid Jam Member of Technical Staff March 1, 2007 SAND# 2007-1115C Computer and Network Security Security Systems and Technology Video Conference and Collaborative
Cyber Security Metrics Dashboards & Analytics
Cyber Security Metrics Dashboards & Analytics Feb, 2014 Robert J. Michalsky Principal, Cyber Security NJVC, LLC Proprietary Data UNCLASSIFIED Agenda Healthcare Sector Threats Recent History Security Metrics
Data Security Concerns for the Electric Grid
Data Security Concerns for the Electric Grid Data Security Concerns for the Electric Grid The U.S. power grid infrastructure is a vital component of modern society and commerce, and represents a critical
Mobility Challenges & Trends The Financial Services Point Of View
Mobility Challenges & Trends The Financial Services Point Of View Nikos Theodosiou Cloud Computing Solutions Presales/Marketing Engineer The New World Agenda The Mobile World The Challenges The Solutions
Securing Smart City Platforms IoT, M2M, Cloud and Big Data
SESSION ID: SSC-W10 Securing Smart City Platforms IoT, M2M, Cloud and Big Data Ibrahim Al Mallouhi Vice President - Operations Emirates Integrated Telecommunication Company (du) Roshan Daluwakgoda Senior
Average annual cost of security incidents
Breaches reported Annual number of data breaches Average annual cost of security incidents Among companies with revenues over $1 billion Regulatory mandates 900 800 700 600 500 400 300 200 100 0 2011 2012
Threat and Vulnerability Management (TVM) Protecting IT assets through a comprehensive program. Chicago IIA/ISACA
www.pwc.com Vulnerability Management (TVM) Protecting IT assets through a comprehensive program Chicago IIA/ISACA 2 nd Annual Hacking Conference Introductions Paul Hinds Managing Director Cybersecurity
Smart (and safe) Lighting:
Smart (and safe) Lighting: An Overview of Cyber Security October 29, 2015 Jason Brown CISO, Merit Network Agenda 2 The New Normal Discuss Methodologies of Security Recap Q & A Target Hack 3 40,000 credit
Cyber - Security and Investigations. Ingrid Beierly August 18, 2008
Cyber - Security and Investigations Ingrid Beierly August 18, 2008 Agenda Visa Cyber - Security and Investigations Today s Targets Recent Attack Patterns Hacking Statistics (removed) Top Merchant Vulnerabilities
Compliance Guide ISO 27002. Compliance Guide. September 2015. Contents. Introduction 1. Detailed Controls Mapping 2.
ISO 27002 Compliance Guide September 2015 Contents Compliance Guide 01 02 03 Introduction 1 Detailed Controls Mapping 2 About Rapid7 7 01 INTRODUCTION If you re looking for a comprehensive, global framework
Agenda. All Summit Sessions will be held in CA Thayer Ballroom (unless noted).
Program Guide SANS Securing the Internet of Things Summit 2013 Agenda All Summit Sessions will be held in CA Thayer Ballroom (unless noted). All approved presentations will be available online following
Who Controls Your Information in the Cloud?
Who Controls Your Information in the Cloud? threat protection compliance archiving & governance secure communication Contents Who Controls Your Information in the Cloud?...3 How Common Are Information
IT Best Practices Audit TCS offers a wide range of IT Best Practices Audit content covering 15 subjects and over 2200 topics, including:
IT Best Practices Audit TCS offers a wide range of IT Best Practices Audit content covering 15 subjects and over 2200 topics, including: 1. IT Cost Containment 84 topics 2. Cloud Computing Readiness 225
Information Security @ Blue Valley Schools FEBRUARY 2015
Information Security @ Blue Valley Schools FEBRUARY 2015 Student Data Privacy & Security Blue Valley is committed to providing an education beyond expectations to each of our students. To support that
IoT Security: Problems, Challenges and Solutions
IoT Security: Problems, Challenges and Solutions Liwei Ren, Ph.D Trend Micro Background Liwei Ren Research interests Data security & privacy, network security Data compression, math modeling & algorithms
The Impact of Wireless LAN Technology on Compliance to the PCI Data Security Standard
The Impact of Wireless LAN Technology on to the PCI Data Security Standard 339 N. Bernardo Avenue, Suite 200 Mountain View, CA 94043 www.airtightnetworks.net Wireless LANs and PCI Retailers today use computers
Feeling Vulnerable? Jamie S. Herman, C CISO, CISM, CISSP Balazs Bucsay, OSCE, OSCP, GIAC, GPEN
Feeling Vulnerable? Jamie S. Herman, C CISO, CISM, CISSP Balazs Bucsay, OSCE, OSCP, GIAC, GPEN Balazs Bucsay A Little About Us Hungarian Hacker 14 years of experience in IT- Security Strictly technical
Combating a new generation of cybercriminal with in-depth security monitoring. 1 st Advanced Data Analysis Security Operation Center
Combating a new generation of cybercriminal with in-depth security monitoring 1 st Advanced Data Analysis Security Operation Center The Challenge Don t leave your systems unmonitored. It takes an average
This session was presented by Jim Stickley of TraceSecurity on Wednesday, October 23 rd at the Cyber Security Summit.
The hidden risks of mobile applications This session was presented by Jim Stickley of TraceSecurity on Wednesday, October 23 rd at the Cyber Security Summit. To learn more about TraceSecurity visit www.tracesecurity.com
APIs The Next Hacker Target Or a Business and Security Opportunity?
APIs The Next Hacker Target Or a Business and Security Opportunity? SESSION ID: SEC-T07 Tim Mather VP, CISO Cadence Design Systems @mather_tim Why Should You Care About APIs? Amazon Web Services EC2 alone
Attachment A. Identification of Risks/Cybersecurity Governance
Attachment A Identification of Risks/Cybersecurity Governance 1. For each of the following practices employed by the Firm for management of information security assets, please provide the month and year
Introduction Jim Rowland, Senior System Architect and Project Manager Daly
Introduction Jim Rowland, Senior System Architect and Project Manager Daly Stepping Up to Enterprise Vulnerability Management Keren Cummins, Director, Federal and MidAtlantic Markets ncircle Presentation
SECURITY OVERVIEW FOR MY.ENDNOTE.COM. In line with commercial industry standards, Thomson Reuters employs a dedicated security team to protect our
ENDNOTE ONLINE SECURITY OVERVIEW FOR MY.ENDNOTE.COM In line with commercial industry standards, Thomson Reuters employs a dedicated security team to protect our servers from attacks and other attempts
PCI COMPLIANCE REQUIREMENTS COMPLIANCE CALENDAR
PCI COMPLIANCE REQUIREMENTS COMPLIANCE CALENDAR AUTHOR: UDIT PATHAK SENIOR SECURITY ANALYST udit.pathak@niiconsulting.com Public Network Intelligence India 1 Contents 1. Background... 3 2. PCI Compliance
How To Protect Your Data From Being Stolen
DATA SECURITY & PCI DSS COMPLIANCE PROTECTING CUSTOMER DATA WHAT IS PCI DSS? PAYMENT CARD INDUSTRY DATA SECURITY STANDARD A SET OF REQUIREMENTS FOR ANY ORGANIZATION OR MERCHANT THAT ACCEPTS, TRANSMITS
Cisco Master Security Specialization Practice Areas Summary. June 2015
Cisco Master Security Specialization Practice Areas Summary June 2015 New Master Security Model Prerequisites Advanced Security Architecture Specialization (ASAS) (1) CCIE Security (1) CCNP Security (1)
Challenges of Automated Web Application Scanning
1 Challenges of Automated Web Application Scanning "Why automated scanning only solves half the problem." Blackhat Windows 2004 Seattle, WA Jeremiah Grossman (CEO) WhiteHat Security, Inc. 2 Speaker Bio
Patch and Vulnerability Management Program
Patch and Vulnerability Management Program What is it? A security practice designed to proactively prevent the exploitation of IT vulnerabilities within an organization To reduce the time and money spent
Presented by Evan Sylvester, CISSP
Presented by Evan Sylvester, CISSP Who Am I? Evan Sylvester FAST Information Security Officer MBA, Texas State University BBA in Management Information Systems at the University of Texas Certified Information
Threat Intelligence: What is it, and How Can it Protect You from Today s Advanced Cyber-Attacks A Webroot publication featuring analyst research
Threat Intelligence: What is it, and How Can it Protect You from Today s Advanced Cyber-Attacks A Webroot publication featuring analyst research 2 3 6 7 9 9 Issue 1 Welcome From the Gartner Files Definition:
From Rivals to BFF: WAF & VA Unite OWASP 07.23.2009. The OWASP Foundation http://www.owasp.org
From Rivals to BFF: WAF & VA Unite 07.23.2009 Brian Contos, Chief Security Strategist Imperva Inc. brian.contos@imperva.com +1 (650) 832.6054 Copyright The Foundation Permission is granted to copy, distribute
Goals. Understanding security testing
Getting The Most Value From Your Next Network Penetration Test Jerald Dawkins, Ph.D. True Digital Security p. o. b o x 3 5 6 2 3 t u l s a, O K 7 4 1 5 3 p. 8 6 6. 4 3 0. 2 5 9 5 f. 8 7 7. 7 2 0. 4 0 3
Worldwide Security and Vulnerability Management 2009 2013 Forecast and 2008 Vendor Shares
EXCERPT Worldwide Security and Vulnerability Management 2009 2013 Forecast and 2008 Vendor Shares IN THIS EXCERPT Global Headquarters: 5 Speen Street Framingham, MA 01701 USA P.508.872.8200 F.508.935.4015
CHEAT SHEET: PCI DSS 3.1 COMPLIANCE
CHEAT SHEET: PCI DSS 3.1 COMPLIANCE WHAT IS PCI DSS? Payment Card Industry Data Security Standard Information security standard for organizations that handle data for debit, credit, prepaid, e-purse, ATM,
Big Data and Security: At the Edge of Prediction
Big Data and Security: At the Edge of Prediction Mark Seward Splunk Inc. Fred Wilmot Splunk Inc. Session ID: Session Classification: SPO2-T17 Intermediate The Way Cyber Adversaries Think Where is the most
KASPERSKY SECURITY INTELLIGENCE SERVICES. EXPERT SERVICES. www.kaspersky.com
KASPERSKY SECURITY INTELLIGENCE SERVICES. EXPERT SERVICES www.kaspersky.com EXPERT SERVICES Expert Services from Kaspersky Lab are exactly that the services of our in-house experts, many of them global
Healthcare Security Vulnerabilities. Adam Goslin Chief Operations Officer High Bit Security
Healthcare Security Vulnerabilities Adam Goslin Chief Operations Officer High Bit Security Webinar Overview IT Security and Data Loss Breach Sources / Additional Information Recent Medical Breach / Loss
Course Title: Penetration Testing: Network & Perimeter Testing
Course Title: Penetration Testing: Network & Perimeter Testing Page 1 of 7 Course Description: The Security Analyst Series from EC-Council Press is comprised of five books covering a broad base of topics
Eliminating Cybersecurity Blind Spots
Eliminating Cybersecurity Blind Spots Challenges for Business April 15, 2015 Table of Contents Introduction... 3 Risk Management... 3 The Risk Blind Spot... 4 Continuous Asset Visibility... 5 Passive Network
Securing the Service Desk in the Cloud
TECHNICAL WHITE PAPER Securing the Service Desk in the Cloud BMC s Security Strategy for ITSM in the SaaS Environment Introduction Faced with a growing number of regulatory, corporate, and industry requirements,
What is Management Responsible For?
What is Management Responsible For? Matthew J. Putvinski, CPA, CISA, CISSP MEMBER OF PKF NORTH AMERICA, AN ASSOCIATION OF LEGALLY INDEPENDENT FIRMS 2011 Wolf & Company, P.C. About Wolf & Company, P.C Regional
Security Management. Keeping the IT Security Administrator Busy
Security Management Keeping the IT Security Administrator Busy Dr. Jane LeClair Chief Operating Officer National Cybersecurity Institute, Excelsior College James L. Antonakos SUNY Distinguished Teaching
Software Supply Chains: Another Bug Bites the Dust.
SESSION ID: STR-T08 Software Supply Chains: Another Bug Bites the Dust. Todd Inskeep 1 Global Security Assessments VP Samsung Business Services @Todd_Inskeep Series of Recent, Large, Long-term Security
Understanding the Security Vendor Landscape Using the Cyber Defense Matrix
SESSION ID: PDIL-W02F Understanding the Security Vendor Landscape Using the Cyber Defense Matrix Sounil Yu sounil@gmail.com @sounilyu Disclaimers The views, opinions, and positions expressed in this presentation
WHITE PAPER ON SECURITY TESTING IN TELECOM NETWORK
WHITE PAPER ON SECURITY TESTING IN TELECOM NETWORK DATE OF RELEASE: 27 th July 2012 Table of Contents 1. Introduction... 2 2. Need for securing Telecom Networks... 3 3. Security Assessment Techniques...
2011 Forrester Research, Inc. Reproduction Prohibited
1 2011 Forrester Research, Inc. Reproduction Prohibited Information Security Metrics Present Information that Matters to the Business Ed Ferrara, Principal Research Analyst July 12, 2011 2 2009 2011 Forrester
Getting Started with the iscan Online Data Breach Risk Intelligence Platform
Getting Started with the iscan Online Data Breach Risk Intelligence Platform 2 Table of Contents Overview... 3 Data Breach Risk Intelligence... 3 Data Breach Prevention Lifecycle Defined... 3 Choosing
Effective Threat Management. Building a complete lifecycle to manage enterprise threats.
Effective Threat Management Building a complete lifecycle to manage enterprise threats. Threat Management Lifecycle Assimilation of Operational Security Disciplines into an Interdependent System of Proactive
Real World Healthcare Security Exposures. Brian Selfridge, Partner, Meditology Services
Real World Healthcare Security Exposures Brian Selfridge, Partner, Meditology Services 2 Agenda Introduction Background and Industry Context Anatomy of a Pen Test Top 10 Healthcare Security Exposures Lessons
Cybersecurity: A View from the Boardroom
An Executive Brief from Cisco Cybersecurity: A View from the Boardroom In the modern economy, every company runs on IT. That makes security the business of every person in the organization, from the chief
Simple. Smart. Professional. A 2BSecured Company
Cloud7 Managed Security Services Simple. Smart. Professional A 2BSecured Company Cloud7 is the Managed service division of 2bsecure What is security managed service? managed security services (MSS) are
WHITE PAPER. The Need for Wireless Intrusion Prevention in Retail Networks
WHITE PAPER The Need for Wireless Intrusion Prevention in Retail Networks The Need for Wireless Intrusion Prevention in Retail Networks Firewalls and VPNs are well-established perimeter security solutions.
Overview Commitment to Energy and Utilities Robert Held Sr. Systems Engineer Strategic Energy August 2015
Overview Commitment to Energy and Utilities Robert Held Sr. Systems Engineer Strategic Energy August 2015 Tripwire Evolution 18+ Years of Innovation 1997 Tripwire File System Monitoring from open source
PCI DSS Policies Outline. PCI DSS Policies. All Rights Reserved. ecfirst. 2010. Page 1 of 7 www.ecfirst.com
Policy/Procedure Description PCI DSS Policies Install and Maintain a Firewall Configuration to Protect Cardholder Data Establish Firewall and Router Configuration Standards Build a Firewall Configuration
Major Risks and Recommended Solutions
Major Risks and Recommended Solutions www.icdsecurity.com OVERVIEW Are you familiar with the main security risks that threaten data centers? This paper provides an overview of the most common and major
Computer Forensics and Incident Response in the Cloud. Stephen Coty AlertLogic, Inc. @Twitter AlertLogic_ACID
Computer Forensics and Incident Response in the Cloud SESSION ID: ANF-T07A Stephen Coty AlertLogic, Inc. @Twitter AlertLogic_ACID Why forensics in the cloud? Cloud market revenue will increase at a 36%
How To Protect Your Data From Theft
Understanding the Effectiveness of a Data Protection Program IIA: Almost Free Seminar 21 June 2011 Agenda Data protection overview Case studies Ernst & Young s point of view Understanding the effectiveness
Best Practices for Threat & Vulnerability Management. Don t let vulnerabilities monopolize your organization.
Best Practices for Threat & Vulnerability Management Don t let vulnerabilities monopolize your organization. Table of Contents 1. Are You in the Lead? 2. A Winning Vulnerability Management Program 3. Vulnerability
Continuous Network Monitoring
Continuous Network Monitoring Eliminate periodic assessment processes that expose security and compliance programs to failure Continuous Network Monitoring Continuous network monitoring and assessment