Defending Against Cyber Security Threats to the Payment and Banking Systems
|
|
|
- Randolph Townsend
- 10 years ago
- Views:
Transcription
1 NYU Leonard N. Stern School of Business Master of Science Risk Management RISK MANAGEMENT SYMPOSIUM 2015 Defending Against Cyber Security Threats to the Payment and Banking Systems Andrew Koh Class of 2010 MSRM Class of 2009 MSGF 1
2 LINKEDIN Profile: Thought leader, speaker, moderator, panelist, writer, advisor Selected conferences: World Cards & Payments; Financial Times; RiskMinds Asia; Bloomberg; Cards & Payments Asia; The Asian Banker. Presented to central banks, regulators, government agencies, financial institutions, varsities, private equity & fin-tech firms. Published articles for award winning magazine: Strategic Risk Asia. 25 years in banking, finance, payment & cards sectors Experiences in Basel, ERM, GRC, Fraud, Outsourcing, RCSA, KRIs, Stress Testing, Incident Response, BCP, Audit frameworks & systems. Currently, he is the Deputy Chief Manager of Risk Control in China Construction Bank, S'pore. and was Vce President of ERM for NETS. Avid Lifelong Learner Class of 2010 MS Risk Managment (Stern) Class of 2009 MS Global Finance (Stern + HKUST) 2
3 AGENDA Part 1 - Cyber Security Threats High risk, high profile threats to payments & banking systems. Increasing sophistication and scale of threats. Defense and Attack Technologies Using data, analytics and intelligence to combat threats. Power of collaboration and the role of regulators. Part 2 - Defending against Cyber Threats/ORM Perspective Defining roles and responsibilities in cyber risk governance. Identifying and protecting information assets most important to your firm and susceptible to cyber threats. How can Key Risk Indicators (KRIs) effectively interact with other tools to monitor attempts of cyber-attacks? Interplay of Incident Response and Business Continuity planning. Questions & Answers 3
4 Part 1 - Cyber Security Threats 4
5 High risk, High profile threats to payments & banking systems. 5
6 High risk, High profile threats to payments & banking systems. DATA IS THE NEW CURRENCY! 6
7 High risk, High profile threats to payments & banking systems. CYBERSECURITY THREATS FOR 2015 & BEYOND! 7
8 High risk, High profile threats to payments & banking ystems Top 5 Threats Identified By NETS - Singapore national payment operator Cyber-Terrorist Groups 1 Politically motivated Groups 2 Hackers / Hacking Incidents 3 Cyber Loss Incidents 4 Payments Disruptions due to cyber-attacks and related incidents 5 8
9 High risk, High profile threats to payments & banking ystems Top 5 Threats Identified CCB Singapore Cybercriminals and their actions 1 Insider Threats 2 Brand & Reputational risks 3 Non compliance to regulatory requirements on cybersecurity. Business Disruptions 5 4 9
10 Increasing Sophistication & Scale of Threat Sony Hack / North Korea Govt. link Turbotax hack / 18 U.S. states JP Morgan Chase hack / 83mio records 10
11 Increasing Sophistication & Scale of Threat(NETS & CCB S'pore) ( Feb 2014 MTGOX 150,000 DDoS attacks per second for several days Nov 2014 Sony Its like 1,000 robberies done in 50 states in 1 day 11
12 Defense and Attack Technologies (NETS & CCB S'pore) VIRUS (1990s) (NETS (NETS) ANTI-VIRUS, FIREWALLS (1990s) WORMS (2000s) INTRUSION DETECTION & PREVENTION (2000s) BOTNETS (late 2000s to current) DLP, APPLICATION-AWARE FIREWALLS (late 2000s to current) APTs (current) NETWORK FLOW ANALYSIS 12
13 Defense and Attack Technologies (NETS) Top 5 Security Threat Defense Used by Organization (CISO) (Source: CISCO Annual Security Report 2015) Network security, firewalls, intrusion prevention 64% Web security 62% /messaging security 58% Data Loss Prevention (DLP) 55% Encryption/privacy/data protection 55% 13
14 Defense and Attack Technologies Huge Gaps in Defense Technologies we use today Firms using yesterday s technologies to defend against cyber threats. Advances in technological innovations far exceeding security and risk management practices. Profits come first! There is a popular web-browser that can bypass firewalls w/o hacking. Lack of committed resources to defend against cyber-attacks. Most firms still view cyber threats as isolated, IT related issues. Severe Knowledge Gaps in Cyber Risks & Security No skills and mindset for board of directors and C-Suite executives to make informed decisions. Lack of staff cybersecurity awareness to guard against cyber threats. 14
15 Using data, analytics and intelligence to combat threats(nets ) (NETS) BIG DATA 15
16 Using data, analytics and intelligence to combat threats. (NETS) BIG DATA + BIZ INTELLIGENCE 16
17 Power of collaboration and the role of regulators.. (NETS & CCB S'pore) 17
18 Power of collaboration and the role of regulators. 18
19 Part 2 - Defending against Cyber Threats from an Operational Risk Manager s Perspective. 19
20 Defining roles and responsibilities in cyber risk governance.. 20
21 Defining roles and responsibilities in cyber risk governance. (NETS & CCB S'pore). Board of directors ( Senior Management Responsible for cyber risk framework. Responsible for implementation and daily management of cyber risk framework. Cyber Risk & Security Committee Cyber Risk Champions (Biz & Support Units) Comprises of ORM, ERM, ITRM, Tech Ops, General Ops, BCM, Legal, Compliance, Audit (advisory). Cyber risk identification & assessment. Raise cyber risk warning alerts and recommend solutions to issues raised. 21
22 Strong Risk Culture Identifying and protecting information assets most important to your firm and susceptible to cyber threats. (NETS ERM). Cyber Risk Governance 22
23 Strong Risk Culture Identifying and protecting information assets most important to your firm and susceptible to cyber threats. (CCB S'pore). Cyber Risk Governance 23
24 Identifying and protecting information assets most important to your firm and susceptible to cyber threats. (NETS & CCB S'pore). Criteria Used Risk Tools Definition Single Point of Failures Most Vulnerable Attack Surface Area Risk Strategies Selection Process Mapping + RCSA Cyber Security & Risk Assessment Risk Impacts Dependent on whether it s data or assets or both. Failure at a single vector resulting in severe business disruptions/penalties, etc Success rate of cyber attacks can lead to brand & reputational risks for firms. 24
25 Definition of Information Assets (NETS) Components DATA APPLICATION HOST INTERNAL NETWORK PHYSICAL SECURITY POLICIES, PROCEDURES & AWARENESS Protection Technologies Data Encryption Application Hardening; Anti-virus Authentication; Update Mgmt Network Segmentation; IPSec; Network IDS. Guards; Locks; Tracking Devices User Education & Training 25
26 Definition of Information Assets (CCB S'pore) 26
27 Definition & Risk Strategies Selection (NETS) (NETS) 27
28 Single Point of Failure END-TO-END PROCESS MAPPING (Level 1) Cyber threats 28
29 Single Point of Failures END-TO-END PROCESS MAPPING (Level 2) Cyber threats 29
30 Strong Risk Culture Identifying and protecting information assets most important to your firm and susceptible to cyber threats.. Cyber Risk Governance 30
31 Cyber Security & Risk Assessment (Scenario Based Approach) 31
32 RISK & CONTROL SELF ASSESSMENT Risk Description Identification 1. Economic ALL RISKS Likelihood Impact Gross Risk Gross Risk Score Gross Risk Ranking Risk Assessment Gross Risk Rating Likeli hood Impact Residual Risk Residual Risk Score Residual Risk Ranking Financial loss Residual Risk Rating Risk Control Register Effective Controls in place? (Y/N) Transaction Value Operational System Availability NA NA NA NA NA NA NA NA NA NA Staff Attrition NA NA NA NA NA NA NA NA NA NA 3. Brand and Reputation Damage to reputation NA NA NA NA NA NA NA NA NA NA 4. Regulatory Non-compliance NA NA NA NA NA NA NA NA NA NA 5. Client Customer Impact NA NA NA NA NA NA NA NA NA NA Merchant Impact NA NA NA NA NA NA NA NA NA NA 32
33 Strong Risk Culture Identifying and protecting information assets most important to your firm and susceptible to cyber threats.. Cyber Risk Governance 33
34 RISK & CONTROL SELF ASSESSMENT Risk Description Identification 1. Economic ALL RISKS Likelihood Impact Gross Risk Gross Risk Score Gross Risk Ranking Risk Assessment Gross Risk Rating Likeli hood Impact Residual Risk Residual Risk Score Residual Risk Ranking Financial loss NA NA NA NA NA NA NA NA NA NA Residual Risk Rating Risk Control Register Effective Controls in place? (Y/N) Transaction Value NA NA NA NA NA NA NA NA NA NA 2. Operational System Availability NA NA NA NA NA NA NA NA NA NA Staff Attrition NA NA NA NA NA NA NA NA NA NA 3. Brand and Reputation Damage to reputation NA NA NA NA NA NA NA NA NA NA 4. Regulatory Non-compliance NA NA NA NA NA NA NA NA NA NA 5. Client Customer Impact NA NA NA NA NA NA NA NA NA NA Merchant Impact NA NA NA NA NA NA NA NA NA NA 34
35 Strong Risk Culture Identifying and protecting information assets most important to your firm and susceptible to cyber threats.. Cyber Risk Governance 35
36 RISK & CONTROL SELF ASSESSMENT Risk Description Identification 1. Economic ALL RISKS Likelihood Impact Gross Risk Gross Risk Score Gross Risk Ranking Risk Assessment Gross Risk Rating Likeli hood Impact Residual Risk Residual Risk Score Residual Risk Ranking Financial loss NA NA NA NA NA NA NA NA NA NA Residual Risk Rating Risk Control Register Effective Controls in place? (Y/N) Transaction Value NA NA NA NA NA NA NA NA NA NA 2. Operational System Availability NA NA NA NA NA NA NA NA NA NA Staff Attrition NA NA NA NA NA NA NA NA NA NA 3. Brand and Reputation Damage to reputation NA NA NA NA NA NA NA NA NA NA 4. Regulatory Non-compliance NA NA NA NA NA NA NA NA NA NA 5. Client Customer Impact NA NA NA NA NA NA NA NA NA NA Merchant Impact NA NA NA NA NA NA NA NA NA NA Key Risk Indicators Review KRI Thresholds 36
37 CREATE YOUR FIRM S CYBER RISK UNIVERSE Human Risk Fraud Risk Flaws & Bugs Outsourcing Risk Encryption Risk Governance Risk Reputation Risk Escalation Risk Technology Risk Disruption Risk Malware Risk Vendor Risk Regulatory Risk Vulnerabilities Project Risk Compliance Risk Monitoring Risk Legal Risk Threats Risk Reporting Risk Audit PCI DSS Application Risk NYU Leonard N. Stern of Business - MSRM Risk Management 37 Symposium 30 May
38 OPERATIONAL RISK MANAGEMENT RISK HEAT MAP NYU Leonard N. Stern of Business - MSRM Risk Management 38 Symposium 30 May
39 OPERATIONAL RISK MANAGEMENT RISK HEAT MAP CYBER- RISKS (Possible, Catastrophic) 39
40 Strong Risk Culture OPERATIONAL RISK MANAGEMENT RISK HEAT MAP Cyber Risk Governance 40
41 MONITOR & IMPROVE OPS RISK PROGRAM Define Key Risk Indicators 1 Risk Parameter Risk Score = Likelihood x Impact Risk Scores Time Frame Likelihood Impact 2 Risk Escalation 4 New Ops process New Obj / Strategy New Risk New System Economic Operational Brand & Reputation Regulatory Tier 1 Tier 2 Tier 3 Client Impact Insignificant Minor Moderate Major Severe NYU Leonard N. Stern of Business - MSRM Risk Management 41 Symposium 30 May 2015
42 How can Key Risk Indicators (KRIs) effectively interact with other tools to monitor attempts of cyber-attacks? KRI Metrics Risk Owners Scope of Responsibilities Percentage of Failure rates Volume of data passing thru network traffic System disruptions Technology Team (NETS & CCB Security & Risk Team Business, Technology, Security & Risk Product and/or services Failure Testing Cycles Managing data traffic passing thru firewalls defenses via setting up filter rules for data packets. Managing system downtime, investigate root causes & incident escalation 42
43 How can Key Risk Indicators (KRIs) effectively interact with other tools to monitor attempts of cyber-attacks? 43
44 Interplay of Incident Response and Business Continuity planning. CURRENT STATE OF CYBER INCIDENT RESPONSE CYBER-ATTACKS CAN STRIKE WITHIN SECONDS! DATA CAN BE STOLEN WITHIN MINUTES! 44
45 Interplay of Incident Response and Business Continuity planning. (NETS & CCB ) LOW CYBER INCIDENTS HIGH CYBER INCIDENTS Notification Timing Ownership Notification Timing Ownership Biz Unit Dept Head Immediate Biz Unit Dept Head Senior Mgmt Immediate CEO ORM Dept Head < 30 mins - ERM + ORM Dept Heads Immediate - Cyber Alert Team < 45 mins - Cyber Alert Team Immediate 45
46 Interplay of Incident Response and Business Continuity planning(nets & CCB). (NETS & CCB) 46
47 KEY TAKEAWAYS Part 1 - Cyber Security Threats Aware of high risk/profile threats + their rising sophistication/ scale. Huge Gaps in Cyber Defense Technologies and Expertise. Ideas to use big data, analytics & intelligence to combat threats. Common goals in collaborating with peers and regulators. Part 2 - Defending against Cyber Threats/ORM Perspective Need to set-up cyber risk governance. Know how to identify & protect key assets against cyber threats. Define key KRIs metrics to monitor attempts of cyber-attacks. Understanding the problem in Incident Response and to use Business Continuity planning to address them. 47
48 Some Useful References: Andrew Koh : Rethinking enterprise risk management A new educational series looking at practical ideas for managing a variety of risks, (StrategicRISK, Asia edition, Issue 5, Sep. 2014): file:///c:/users/andrew%20koh/downloads/sr-asia- September-2014.pdf Andrew Koh : Rethinking enterprise risk management Our Educational Series Examines Emerging Risks and Scenario Analysis (StrategicRISK, Asia edition, Issue 6, Jan 2015): Models of Escalation and De-escalation in Cyber Conflict John C. Mallery Computer Science & Artificial Intelligence Laboratory Massachusetts Institute of Technology Presentation at the 2011 Workshop on Cyber Security and Global Affairs, Budapest, Hungary, May 31 June 2, 2011.Version: 3/29/ :04 AM Verizon 2015 Data Breach Investigations Report: An ISACA and RSA Conference Survey: State of Cybersecurity: Implications for 2015: aspx CISCO Annual Security Report 2015: annual-security-report/index.html 48
49 If You Have Trouble Sleeping After This. Contact Information 49
50 NYU Leonard N. Stern School of Business Master of Science Risk Management RISK MANAGEMENT SYMPOSIUM 2015 Defending Against Cyber Security Threats to the Payment and Banking Systems Q & A Andrew Koh Class of 2010 MSRM Class of 2009 MSGF 50
Who Drives Cybersecurity in Your Business? Milan Patel, K2 Intelligence. AIBA Quarterly Meeting September 10, 2015
Who Drives Cybersecurity in Your Business? Milan Patel, K2 Intelligence AIBA Quarterly Meeting September 10, 2015 The Answer 2 Everyone The relationship between the board, C-suite, IT, and compliance leaders
ABUSE OF PAYMENT SYSTEMS IN FRAUD, MONEY LAUNDERING, AND OTHER FINANCIAL CRIMES
ABUSE OF PAYMENT SYSTEMS IN FRAUD, MONEY LAUNDERING, AND OTHER FINANCIAL CRIMES Financial criminals continue to abuse different payment systems by committing fraud, money laundering, and other crimes.
Belmont Savings Bank. Are there Hackers at the gate? 2013 Wolf & Company, P.C.
Belmont Savings Bank Are there Hackers at the gate? 2013 Wolf & Company, P.C. MEMBER OF PKF NORTH AMERICA, AN ASSOCIATION OF LEGALLY INDEPENDENT FIRMS 2013 Wolf & Company, P.C. About Wolf & Company, P.C.
Vulnerability Risk Management 2.0. Best Practices for Managing Risk in the New Digital War
Vulnerability Risk Management 2.0 Best Practices for Managing Risk in the New Digital War In 2015, 17 new security vulnerabilities are identified every day. One nearly every 90 minutes. This consistent
MEMORANDUM. Date: October 28, 2013. Federally Regulated Financial Institutions. Subject: Cyber Security Self-Assessment Guidance
MEMORANDUM Date: October 28, 2013 To: Federally Regulated Financial Institutions Subject: Guidance The increasing frequency and sophistication of recent cyber-attacks has resulted in an elevated risk profile
Security for Financial Services: Addressing the Perception Gaps in a Dynamic Landscape
White Paper Security for Financial Services: Addressing the Perception Gaps in a Dynamic Landscape Financial services organizations have a unique relationship with technology: electronic data and transactions
Update On Smart Grid Cyber Security
Update On Smart Grid Cyber Security Kshamit Dixit Manager IT Security, Toronto Hydro, Ontario, Canada 1 Agenda Cyber Security Overview Security Framework Securing Smart Grid 2 Smart Grid Attack Threats
Cybersecurity The role of Internal Audit
Cybersecurity The role of Internal Audit Cyber risk High on the agenda Audit committees and board members are seeing cybersecurity as a top risk, underscored by recent headlines and increased government
Security and Privacy
Security and Privacy Matthew McCormack, CISSP, CSSLP CTO, Global Public Sector, RSA The Security Division of EMC 1 BILLIONS OF USERS MILLIONS/BILLIONS OF APPS 2010 Cloud Big Data Social Mobile Devices
How NETGEAR ProSecure UTM Helps Small Businesses Meet PCI Requirements
How NETGEAR ProSecure UTM Helps Small Businesses Meet PCI Requirements I n t r o d u c t i o n The Payment Card Industry Data Security Standard (PCI DSS) was developed in 2004 by the PCI Security Standards
Cyber-Security. FAS Annual Conference September 12, 2014
Cyber-Security FAS Annual Conference September 12, 2014 Maysar Al-Samadi Vice President, Professional Standards IIROC Cyber-Security IIROC Rule 17.16 BCP The regulatory landscape Canadian Government policy
Combating a new generation of cybercriminal with in-depth security monitoring
Cybersecurity Services Combating a new generation of cybercriminal with in-depth security monitoring 1 st Advanced Data Analysis Security Operation Center The Challenge Don t leave your systems unmonitored.
Information Security and Risk Management
Information Security and Risk Management COSO and COBIT Standards and Requirements Page 1 Topics Information Security Industry Standards and COBIT Framework Relation to COSO Internal Control Risk Management
How To Protect Yourself From Cyber Threats
Cyber Security for Non- Profit Organizations Scott Lawler CISSP- ISSAP, ISSMP, HCISPP Copyright 2015 LP3 May 2015 Agenda IT Security Basics e- Discovery Compliance Legal Risk Disaster Plans Non- Profit
WHAT EVERY CEO, CIO AND CFO NEEDS TO KNOW ABOUT CYBER SECURITY.
WHAT EVERY CEO, CIO AND CFO NEEDS TO KNOW ABOUT CYBER SECURITY. A guide for IT security from BIOS The Problem SME s, Enterprises and government agencies are under virtually constant attack today. There
Combating a new generation of cybercriminal with in-depth security monitoring. 1 st Advanced Data Analysis Security Operation Center
Combating a new generation of cybercriminal with in-depth security monitoring 1 st Advanced Data Analysis Security Operation Center The Challenge Don t leave your systems unmonitored. It takes an average
CYBER SECURITY SERVICES PWNED
CYBER SECURITY SERVICES PWNED Jens Thonke Capital Market Day 16 Sept 2015 1 AGENDA Cyber Security Services in brief Market overview and key trends Offering and channels Competition Enabling growth Performance
KEY TRENDS AND DRIVERS OF SECURITY
CYBERSECURITY: ISSUES AND ISACA S RESPONSE Speaker: Renato Burazer, CISA,CISM,CRISC,CGEIT,CISSP KEY TRENDS AND DRIVERS OF SECURITY Consumerization Emerging Trends Continual Regulatory and Compliance Pressures
Analyzing Security for Retailers An analysis of what retailers can do to improve their network security
Analyzing Security for Retailers An analysis of what retailers can do to improve their network security Clone Systems Business Security Intelligence Properly Secure Every Business Network Executive Summary
Accenture Intelligent Security for the Digital Enterprise. Archer s important role in solving today's pressing security challenges
Accenture Intelligent Security for the Digital Enterprise Archer s important role in solving today's pressing security challenges The opportunity to improve cyber security has never been greater 229 2,287
A Wake-Up Call? Fight Back Against Cybercrime. Prepared for: Ricky Link Managing Director, Southwest Region May 15, 2014
A Wake-Up Call? Fight Back Against Cybercrime Prepared for: Ricky Link Managing Director, Southwest Region May 15, 2014 1 Coalfire Background Leading Information Security Consulting Firm Offices: Atlanta,
Cyber Security. John Leek Chief Strategist
Cyber Security John Leek Chief Strategist AGENDA The Changing Business Landscape Acknowledge cybersecurity as an enterprise-wide risk management issue not just an IT issue How to develop a cybersecurity
Payment Card Industry Data Security Standard Training. Chris Harper Vice President of Technical Services Secure Enterprise Computing, Inc.
Payment Card Industry Data Security Standard Training Chris Harper Vice President of Technical Services Secure Enterprise Computing, Inc. March 27, 2012 Agenda Check-In 9:00-9:30 PCI Intro and History
Overcoming PCI Compliance Challenges
Overcoming PCI Compliance Challenges Randy Rosenbaum - Security Services Exec. Alert Logic, CPISM Brian Anderson - Product Manager, Security Services, SunGard AS www.sungardas.com Goal: Understand the
Defending Against Data Beaches: Internal Controls for Cybersecurity
Defending Against Data Beaches: Internal Controls for Cybersecurity Presented by: Michael Walter, Managing Director and Chris Manning, Associate Director Protiviti Atlanta Office Agenda Defining Cybersecurity
RSA Archer Risk Intelligence
RSA Archer Risk Intelligence Harnessing Risk to Exploit Opportunity June 4, 2014 Steve Schlarman GRC Strategist 1 Risk and Compliance Where is it today? 2 Governance, Risk, & Compliance Today 3 4 A New
By: Gerald Gagne. Community Bank Auditors Group Cybersecurity What you need to do now. June 9, 2015
Community Bank Auditors Group Cybersecurity What you need to do now June 9, 2015 By: Gerald Gagne MEMBER OF PKF NORTH AMERICA, AN ASSOCIATION OF LEGALLY INDEPENDENT FIRMS 2015 Wolf & Company, P.C. Cybersecurity
Cybersecurity and internal audit. August 15, 2014
Cybersecurity and internal audit August 15, 2014 arket insights: what we are seeing so far? 60% of organizations see increased risk from using social networking, cloud computing and personal mobile devices
Cybersecurity: Protecting Your Business. March 11, 2015
Cybersecurity: Protecting Your Business March 11, 2015 Grant Thornton. All LLP. rights All reserved. rights reserved. Agenda Introductions Presenters Cybersecurity Cybersecurity Trends Cybersecurity Attacks
CYBER SECURITY INFORMATION SHARING & COLLABORATION
Corporate Information Security CYBER SECURITY INFORMATION SHARING & COLLABORATION David N. Saul Senior Vice President & Chief Scientist 28 June 2013 Discussion Flow The Evolving Threat Environment Drivers
CYBER SECURITY, A GROWING CIO PRIORITY
www.wipro.com CYBER SECURITY, A GROWING CIO PRIORITY Bivin John Verghese, Practitioner - Managed Security Services, Wipro Ltd. Contents 03 ------------------------------------- Abstract 03 -------------------------------------
Cyber Security Metrics Dashboards & Analytics
Cyber Security Metrics Dashboards & Analytics Feb, 2014 Robert J. Michalsky Principal, Cyber Security NJVC, LLC Proprietary Data UNCLASSIFIED Agenda Healthcare Sector Threats Recent History Security Metrics
Business Continuity for Cyber Threat
Business Continuity for Cyber Threat April 1, 2014 Workshop Session #3 3:00 5:30 PM Susan Rogers, MBCP, MBCI Cyberwise CP S2 What happens when a computer program can activate physical machinery? Between
RLI PROFESSIONAL SERVICES GROUP PROFESSIONAL LEARNING EVENT PSGLE 123. Cybersecurity: A Growing Concern for Small Businesses
RLI PROFESSIONAL SERVICES GROUP PROFESSIONAL LEARNING EVENT PSGLE 123 Cybersecurity: A Growing Concern for Small Businesses Copyright Materials This presentation is protected by US and International Copyright
October 24, 2014. Mitigating Legal and Business Risks of Cyber Breaches
October 24, 2014 Mitigating Legal and Business Risks of Cyber Breaches AGENDA Introductions Cyber Threat Landscape Cyber Risk Mitigation Strategies 1 Introductions 2 Introductions To Be Confirmed Title
Italy. EY s Global Information Security Survey 2013
Italy EY s Global Information Security Survey 2013 EY s Global Information Security Survey 2013 This year s survey our 16th edition captures the responses of 1,909 C-suite and senior level IT and information
Maintaining PCI-DSS compliance. Daniele Bertolotti [email protected] Antonio Ricci [email protected]
Maintaining PCI-DSS compliance Daniele Bertolotti [email protected] Antonio Ricci [email protected] Sessione di Studio Milano, 21 Febbraio 2013 Agenda 1 Maintaining PCI-DSS compliance
Internal audit of cybersecurity. Presentation to the Atlanta IIA Chapter January 2015
Internal audit of cybersecurity Presentation to the Atlanta IIA Chapter January 2015 Agenda Executive summary Why is this topic important? Cyber attacks: increasing complexity arket insights: What are
IT AUDIT WHO WE ARE. Current Trends and Top Risks of 2015 10/9/2015. Eric Vyverberg. Randy Armknecht. David Kupinski
IT AUDIT Current Trends and Top Risks of 2015 2 02 Eric Vyverberg WHO WE ARE David Kupinski Randy Armknecht Associate Director Internal Audit Protiviti 317.510.4661 [email protected] Managing
How GCs And Boards Can Brace For The Cybersecurity Storm - Law360
Page 1 of 6 Portfolio Media. Inc. 860 Broadway, 6th Floor New York, NY 10003 www.law360.com Phone: +1 646 783 7100 Fax: +1 646 783 7161 [email protected] How GCs And Boards Can Brace For The Cybersecurity
Franchise Data Compromise Trends and Cardholder. December, 2010
Franchise Data Compromise Trends and Cardholder Security Best Practices December, 2010 Franchise Data Security Agenda Cardholder Data Compromise Overview Breach Commonalities Hacking Techniques Franchisee
EMERGING THREATS & STRATEGIES FOR DEFENSE. Stephen Coty Chief Security Evangelist @StephenCoty
EMERGING THREATS & STRATEGIES FOR DEFENSE Stephen Coty Chief Security Evangelist @StephenCoty Industry Analysis 2014 Data Breaches - Ponemon Ponemon 2014 Data Breach Report *Statistics from 2013 Verizon
January IIA / ISACA Joint Meeting Pre-meeting. Cybersecurity Update for Internal Auditors. Matt Wilson, PwC Risk Assurance Director
January IIA / ISACA Joint Meeting Pre-meeting Cybersecurity Update for Internal Auditors Matt Wilson, Risk Assurance Director Introduction and agenda Themes from The Global State of Information Security
ASSUMING A STATE OF COMPROMISE: EFFECTIVE DETECTION OF SECURITY BREACHES
ASSUMING A STATE OF COMPROMISE: EFFECTIVE DETECTION OF SECURITY BREACHES Leonard Levy PricewaterhouseCoopers LLP Session ID: SEC-W03 Session Classification: Intermediate Agenda The opportunity Assuming
Managed Security Services for Data
A v a y a G l o b a l S e r v i c e s Managed Security Services for Data P r o a c t i v e l y M a n a g i n g Y o u r N e t w o r k S e c u r i t y 2 4 x 7 x 3 6 5 IP Telephony Contact Centers Unified
Small Firm Focus: A Practical Approach to Cybersecurity Friday, May 29 9:00 a.m. 10:15 a.m.
Small Firm Focus: A Practical Approach to Cybersecurity Friday, May 29 9:00 a.m. 10:15 a.m. Topics: Explain why it is important for firms of all sizes to address cybersecurity risk. Demonstrate awareness
PCI Compliance Top 10 Questions and Answers
Where every interaction matters. PCI Compliance Top 10 Questions and Answers White Paper October 2013 By: Peer 1 Hosting Product Team www.peer1.com Contents What is PCI Compliance and PCI DSS? 3 Who needs
PCI DSS. Payment Card Industry Data Security Standard. www.tuv.com/id
PCI DSS Payment Card Industry Data Security Standard www.tuv.com/id What Is PCI DSS? PCI DSS (Payment Card Industry Data Security Standard) is the common security standard of all major credit cards brands.the
BREAKING THE KILL CHAIN AN EARLY WARNING SYSTEM FOR ADVANCED THREAT
BREAKING THE KILL CHAIN AN EARLY WARNING SYSTEM FOR ADVANCED THREAT Rashmi Knowles RSA, The Security Division of EMC Session ID: Session Classification: SPO-W07 Intermediate APT1 maintained access to
Rethinking Information Security for Advanced Threats. CEB Information Risk Leadership Council
Rethinking Information Security for Advanced Threats CEB Information Risk Leadership Council Advanced threats differ from conventional security threats along many dimensions, making them much more difficult
NATIONAL CYBER SECURITY AWARENESS MONTH
NATIONAL CYBER SECURITY AWARENESS MONTH Tip 1: Security is everyone s responsibility. Develop an awareness framework that challenges, educates and empowers your customers and employees to be part of the
Information Technology
Information Technology Information Technology Session Structure Board of director actions Significant and emerging IT risks Practical questions Resources Compensating Controls at the Directorate Level
Compliance Doesn t Mean Security Achieving Security and Compliance with the latest Regulations and Standards
Compliance Doesn t Mean Security Achieving Security and Compliance with the latest Regulations and Standards Paul de Graaff Chief Strategy Officer Vanguard Integrity Professionals March 11, 2014 Session
Ed McMurray, CISA, CISSP, CTGA CoNetrix
Ed McMurray, CISA, CISSP, CTGA CoNetrix AGENDA Introduction Cybersecurity Recent News Regulatory Statements NIST Cybersecurity Framework FFIEC Cybersecurity Assessment Questions Information Security Stats
Secure by design: taking a strategic approach to cybersecurity
Secure by design: taking a strategic approach to cybersecurity The cybersecurity market is overly focused on auditing policy compliance and performing vulnerability testing when the level of business risk
PCI DSS Overview and Solutions. Anwar McEntee [email protected]
PCI DSS Overview and Solutions Anwar McEntee [email protected] Agenda Threat environment and risk PCI DSS overview Who we are Solutions and where we can help Market presence High Profile Hacks in
whitepaper 4 Best Practices for Building PCI DSS Compliant Networks
4 Best Practices for Building PCI DSS Compliant Networks Cardholder data is a lucrative and tempting target for cyber criminals. Recent highly publicized accounts of hackers breaching trusted retailers
Over 20 years experience in Information Security Management, Risk Management, Third Party Oversight and IT Audit.
CYBERSECURITY: ISSUES AND ISACA S RESPONSE June 2014 BILL S BIO Over 20 years experience in Information Security Management, Risk Management, Third Party Oversight and IT Audit. Vice President Controls
Cybersecurity: What CFO s Need to Know
Cybersecurity: What CFO s Need to Know William J. Nowik, CISA, CISSP, QSA PCIP MEMBER OF PKF NORTH AMERICA, AN ASSOCIATION OF LEGALLY INDEPENDENT FIRMS 2014 Wolf & Company, P.C. Today s Agenda Introduction
The session is about to commence. Please switch your phone to silent!
The session is about to commence. Please switch your phone to silent! 1 Defend with Confidence Against Advanced Threats Nicholas Chia SE Manager, SEA RSA 2 TRUST? Years to earn, seconds to break 3 Market
Modular Network Security. Tyler Carter, McAfee Network Security
Modular Network Security Tyler Carter, McAfee Network Security Surviving Today s IT Challenges DDos BOTS PCI SOX / J-SOX Data Exfiltration Shady RAT Malware Microsoft Patches Web Attacks No Single Solution
Cyber Security Auditing for Credit Unions. ACUIA Fall Meeting October 7-9, 2015
Cyber Security Auditing for Credit Unions ACUIA Fall Meeting October 7-9, 2015 Topics Introduction Cyber Security Auditing Program Discuss an effective and compliant Cyber Security Auditing Program from
RETHINKING ORC: NRF S CYBER SECURITY EFFORTS. OMG Cross Domain Threat & Risk Information Exchange Day, March 23, 2015
RETHINKING ORC: NRF S CYBER SECURITY EFFORTS OMG Cross Domain Threat & Risk Information Exchange Day, March 23, 2015 No Organization is Secure Source: http://www.informationisbeautiful.net An Average
NETWORK SECURITY. 3 Key Elements
NETWORK SECURITY 3 Key Elements OVERVIEW Network is fast becoming critical and required infrastructure in organizations or even in our live nowadays. Human networking is important in many aspects especially
Cybersecurity Global status update. Dr. Hamadoun I. Touré Secretary-General, ITU
Cybersecurity Global status update Dr. Hamadoun I. Touré Secretary-General, ITU Cybercrime takes a toll on the global economy - Online fraud, identity theft, and lost intellectual property; - On governments,
Addressing APTs and Modern Malware with Security Intelligence Date: September 2013 Author: Jon Oltsik, Senior Principal Analyst
ESG Brief Addressing APTs and Modern Malware with Security Intelligence Date: September 2013 Author: Jon Oltsik, Senior Principal Analyst Abstract: APTs first came on the scene in 2010, creating a wave
The Onslaught of Cyber Security Threats and What that Means to You
The Onslaught of Cyber Security Threats and What that Means to You No End in Sight for Cyber Crime Growth Number of mobile devices affected IBM Number of accounts hacked CNN Money Number of malware samples
CYBERSECURITY: ISSUES AND ISACA S RESPONSE
CYBERSECURITY: ISSUES AND ISACA S RESPONSE June 2014 KEY TRENDS AND DRIVERS OF SECURITY Consumerization Emerging Trends Continual Regulatory and Compliance Pressures Mobile devices Social media Cloud services
CYBER & PRIVACY INSURANCE FOR FINANCIAL INSTITUTIONS
CYBER & PRIVACY INSURANCE FOR FINANCIAL INSTITUTIONS 1 As regulators around the world move to tighten compliance requirements for financial institutions, improvement in cyber security controls will become
EC-Council. Certified Ethical Hacker. Program Brochure
EC-Council C Certified E Ethical Hacker Program Brochure Course Description The (CEH) program is the core of the most desired information security training system any information security professional
Cybersecurity: A Growing Concern for All Businesses. RLI Design Professionals Design Professionals Learning Event DPLE 160 October 7, 2015
Cybersecurity: A Growing Concern for All Businesses RLI Design Professionals Design Professionals Learning Event DPLE 160 October 7, 2015 RLI Design Professionals is a Registered Provider with The American
Internet threats: steps to security for your small business
Internet threats: 7 steps to security for your small business Proactive solutions for small businesses A restaurant offers free WiFi to its patrons. The controller of an accounting firm receives a confidential
Privacy Governance and Compliance Framework Accountability
Privacy Governance and Framework Accountability Agenda Global Data Protection and Privacy (DPP) Organization Structure Privacy The 3 Lines of Defense (LOD) Model: Overview Privacy The 3 Lines of Defense
A Decision Maker s Guide to Securing an IT Infrastructure
A Decision Maker s Guide to Securing an IT Infrastructure A Rackspace White Paper Spring 2010 Summary With so many malicious attacks taking place now, securing an IT infrastructure is vital. The purpose
WAN security threat landscape and best mitigation practices. Rex Stover Vice President, Americas, Enterprise & ICP Sales
WAN security threat landscape and best mitigation practices. Rex Stover Vice President, Americas, Enterprise & ICP Sales The Cost of Cybercrime Sony $171m PlayStation 3 data breach (April 2011) $3 trillion
AppGuard. Defeats Malware
AppGuard Defeats Malware and phishing attacks, drive-by-downloads, zero-day attacks, watering hole attacks, weaponized documents, ransomware, and other undetectable advanced threats by preventing exploits
Effective Methods to Detect Current Security Threats
terreactive AG. Swiss Cyber Storm 2015. Effective Methods to Detect Current Security Threats Taking your IT security to the next level, you have to consider a paradigm shift. In the past companies mostly
I ve been breached! Now what?
I ve been breached! Now what? THE AFTERMATH OF A BREACH & STEPS TO REDUCE RISK The number of data breaches in the United States in 2014 hit a record high. And 2015 is not looking any better. There have
PCI Compliance. Top 10 Questions & Answers
PCI Compliance Top 10 Questions & Answers 1. What is PCI Compliance and PCI DSS? 2. Who needs to follow the PCI Data Security Standard? 3. What happens if I don t comply? 4. What are the basic requirements
Cyber Risk Mitigation via Security Monitoring. Enhanced by Managed Services
Cyber Risk Mitigation via Security Monitoring Enhanced by Managed Services Focus: Up to But Not Including Corporate and 3 rd Party Networks Level 4 Corporate and 3 rd Party/Vendor/Contractor/Maintenance
Cyber Warfare. Global Economic Crime Survey. Causes of Cyber Attacks. David Childers, CEO Compli Vivek Krishnamurthy, Foley Hoag LLP. Why Cybercrime?
Cyber Warfare David Childers, CEO Compli Vivek Krishnamurthy, Foley Hoag LLP Global Economic Crime Survey Cyber crime is the fastest growing economic crime up more than 2300% since 2009 1 in 10 companies
RETHINKING CYBER SECURITY Changing the Business Conversation
RETHINKING CYBER SECURITY Changing the Business Conversation October 2015 Introduction: Diane Smith Michigan Delegate Higher Education Conference Speaker Board Member 2 1 1. Historical Review Agenda 2.