Cybercrime & Cybersecurity: the Ongoing Battle International Hellenic University

Transcription

1 Cybercrime & Cybersecurity: the Ongoing Battle International Hellenic University Andreas Athanasoulias, CISM, CISSP Information Security Officer & Security Consultant

2 Brief introduction My career path Information Security: a growing expert area Defined? Domains Indicative Skillset Career Paths Certifications & Certification Bodies 2

3 Academic Path BSc. Computer Science Informatics & Telecommunications Department University of Athens Last semester: Cryptography, Computer Security Thesis: subject of Network Security MSc. Information Security Information Security Group (ISG) Royal Holloway University of London Security Management, Cryptography, Network Security, Computer Security, Software Security, Computer Crime, Smart Cards/Tokens & Security Dissertation: Fraud in electronic cards & countermeasures 3

4 Professional Path Information Security Consultant ITSRC BU Syntax IT Group (Greece & UAE) Penetration testing IT Governance, Risk & Compliance projects Solutions Enablement (various vendors) Business Unit Manager ITSRC BU Syntax IT Group (Greece & UAE) Information Security Officer & Security Consultant Uni Systems (Greece, Western & S-eastern Europe) Information Security Frameworks ISO & Risk Assessments Security Metrics Business Continuity Frameworks 4

5 Confidentiality Integrity Availability Information Security 5

6 Preservation of confidentiality, integrity and availability of information. In addition, other properties, such as authenticity, accountability, non-repudiation, and reliability can also be involved. ~ ISO 27000:2014 Ensures that within the enterprise, information is protected against disclosure to unauthorized users (confidentiality), improper modification (integrity), and non access when required (availability) ~ ISACA Glossary of Terms "Information security is the protection of information and minimizes the risk of exposing information to unauthorized parties." ~Venter and Eloff,

7 Attributed: JohnManuel, Wikipedia 7

8 Security & Risk Management Security, Risk, Compliance, Law, Regulations, Business Continuity Asset Security Classification, Retention, Data Security Security Engineering Engineering & Management of Security Communication & Network Security Design & protection of Network Security 8

9 Identity & Access Management Controlling Access & Managing Identity Security Assessment & Testing Design, perform & analyze security testing Security Operations Foundational Concepts, Investigations, Incident Management & Disaster Recovery Software Development Security Understand, apply and enforce software security 9

10 Application Security Data Loss Prevention Ethical Hacking (web, network, systems) Digital Forensics Governance Compliance Audit (Policies, Procedures, Management Systems) Incident Detection & Response Secure Code Development PKI Identity Management Business Continuity Security Operation Center Security Information & Event Management 10

11 Information Security Consultant Information Security Analyst Information Security Manager/ Officer Security Architect Security Administrator IT Risk & Compliance Manager Data Security Specialist Cloud Security Engineer (System, Network, Web) Penetration Tester Digital Forensics Analyst Incident Responder Malware Analyst Disaster Recovery/ Business Continuity Manager Security Operation Center (SOC) Analyst 11

12 CISSP Security Professionals CCSP Cloud HCISPP Healthcare & Regulations (ISC)² - International Information Systems Security Certification Consortium CSSLP Secure sw Developments SSCP Security Engineers CCFP Digital Forensics 12

13 CISA Auditors CRISC Risk & Information Systems Control ISACA - Information Systems Audit and Control Association CISM Security Managers CGEIT Governance 13

14 Security Administration GSE (expert) Forensics Legal GIAC Global Information Assurance Certification (powered by SANS) Management Software Security Audit 14

15 Ethical Hackers CISO Digital Forensics EC Council Disaster Recovery Professionals Security Analysts Incident Handlers 15

16 Offensive Security Offensive Security Certified Professional (OSCP) CompTIA Security+ CASP ISO certifications ISMS ISO LA & I BCMS ISO LA & I Cloud Security ISO (draft) 16

17 Uni Systems Copyright

18 Andreas Athanasoulias LinkedIn: