Cyber Security John Leek Chief Strategist
AGENDA The Changing Business Landscape Acknowledge cybersecurity as an enterprise-wide risk management issue not just an IT issue How to develop a cybersecurity program Identify risks to avoid, accept, mitigate or transfer through insurance and understand the plans with each approach
Changing Business and Technology Landscape
Cloud Based Applications ERP
Digitization is Disrupting Business Models
Companies are Evolving to Elastic Staffing Models Core business team Rapidly add resources with right skills/right time Many remote workers Collaboration tools Worker flexibility Dynamic workforce
Business in 2016 Task Workers Office Workers Remote Workers Cloud Workers Hosted Server-based Applications and Desktops Remote desktops Tablets Mobile Devices Line of Business Apps Dynamics CRM Dynamics GP, SL, AX, NAV Transportation Management Virtual Businesses Still must meet security requirements
Mobile Challenges For BYOD Support Multiple Mobile Devices Laptops Desktops Tablets and smartphones running ios, Android, Windows Phone, BlackBerry remote workers mobile workers Must keep devices up-to-date Corporate applications Compliance to corporate security policy Anti-Virus / Anti-Malware Encryption Adequate Passwords Web Filtering Separation of personal vs. business data Wipe Business Data Device Location Tracking Access Rights
Millennials Create New Challenges for Business
Cybercrime Overview
Sources of Cyber Risk Internal Systems 3 rd Party Apps 3 rd Party Providers Core Applications
Top 5 Industries: Cyber Crime Losses Motivation Opportunity Rationalization Source: Statista
Understanding Cybercrime Two Major Categories: 1. Those that target devices Viruses, malware, electronic attacks 2. Those that use applications or users as a means fraud identity theft through social engineering as well as cyber stalking or cyber warfare.
How Viruses / Malware Infect Computers* * Anti-Virus Products 82,000 new viruses are created and released everyday! Anti-virus product block KNOWN viruses. New viruses may not be recognized
Phishing
Organized Crime
Cyber Fraud
Understanding the Risk Source: Symantec
Are we really a Cyber Security Target? Is it Possible that my company will be attacked? Its Probable! How much does it cost to mitigate? Can we control cyber threats? How can we keep pace?
Targets are Changing: Criminals are Focused on low hanging fruit Source: Symantec
What Can You Do?
Risk Management Process Risk Matrix Developing Mitigating Controls Deploy Controls Vulnerability Scans Penetration Testing Social Engineering Testing Physical Phishing Strategic Planning Vendor Management Board of Directors Review Security Policies Internal/3rd Party Audit Training Policies AntiPhishing Controls Anti-Virus/anti-malware Mobile Device Management Web Filtering (reputation, pattern, context) Application Delivery Controllers Firewalls Intrusion Prevention SEIM Security Monitoring Denial of Service Protection 22
Risk Management Process Risk Matrix Develop Mitigating Controls Deploy Controls 1. Identify Issues, Set Context 2. Assess Key Risk Areas 3. Measuring Likelihood 4. Ranking Risks System Name Supporting Systems Email System Information Sensitivity (H/M/L) Likelihood L=1,M=2,H=3 Impact L=1,M=2,H=3 Risk Level L=1,M=2,H= 3 L/M 2 Safeguards in Place Policies, Procedures, Controls Administrative and Organization Informal acceptable use policies Business Associate Agreement in place Physical Rely on infrastructure safeguards Technical Rely on infrastructure safeguards Emails Spam Filter (Barracuda) Residual Risk L=1,M=2, H=3 Residual Risk Acceptable? (Y/N) 1 Y Evaluation (Audit) Cycle Enhance Safeguards Safeguards Recommendations In Order of Priority per Asset Administrative and Organization 1. Implement Email Security Policies to address email acceptable use, malware and phishing email response, encryption needs to be refined to meet users requirements. Schedule a training session with all employees by 6/30/2015 and obtain signed acknowledgments to adhere to the policy. Physical -- Review e-mail vendor's SSAE16 to ensure appropriate controls are in place. Technical 3. Barracuda anti-spam and DLP in place. Mobile Devices (BYOD and company supplied) L/M 1 Administrative and Organization Informal accetable use policies Physical Rely on infrastructure safeguards Technical Rely on infrastructure safeguards 1 Y Enhance Safeguards Administrative and Organization Implement MDM Security Policies to address acceptable use, malware, encryption and right to wipe/destroy corporate data maintained on BYOD devices. Only compliant devices allowed to connect. Physical -- Review and select produt that will enforce policies. Technical Hosted e-mail provider can wipe devices if needed in the interim if devices are lost, stolen or someone leaves Miller group. NetStandard will pursue testing of MDM with multi-tenant hosted Exchange. Network Shares H 3 Administrative and Organization Physical Rely on infrastructure safeguards Technical Rely on infrastructure safeguards 3 N Enhance Safeguards Administrative and Organization 1. Implement Access Control Policies and Procedures to enforce least privilege and need to know requirements for ephi, PHI, PII. Implement Information Classification and Handling Policies and Procedures to address define access and storage requirements. Implement Information Retention and Destruction Policies and Procedures to restrict the amount and location of ephi/pii/phi on systems and in work areas. Implement Security Incident Response Policies and Procedures so that breach of ephi/pii can be reported and contained timely. Physical 2. Rely on server room and offices safeguard recommendations below Technical 3. Rely on rely on server, border device, Active Directory safeguard recommendations below
Developing Mitigating Controls Risk Matrix Develop Mitigating Controls Deploy Controls Identify Objective Assess Options Assess Internal Capabilities Determine Scope Establish Key Success Factors Design Process Identify Roles Identify Steps Identify Metrics Implement Control Check Evaluate Residual Risk Verify Success Factors Refine Process as Needed
Developing Mitigating Controls Risk Matrix Develop Mitigating Controls Deploy Controls Top 20 Security Controls http://www.sans.org/critical-security-controls/
Developing Mitigating Controls Risk Matrix Develop Mitigating Controls Deploy Controls Example: Cloud-based Rights Management
Testing IT Controls Vulnerability Scans Penetration Testing Social Engineering Testing Physical Phishing
Testing IT Controls Vulnerability Scans Penetration Testing Social Engineering Testing Physical Phishing
Testing IT Controls Vulnerability Scans Penetration Testing Social Engineering Testing Physical Phishing
Implementing Controls Protect Anti-Virus/anti-malware Mobile Device Management Web Filtering (reputation, pattern, context) Application Delivery Controllers Firewalls Intrusion Prevention SEIM Security Monitoring Denial of Service Protection Firewall Remote VPN to Corp Assets Web Filter Multi-Factor Auth Vulnerability Scanning Encryption Anti-Virus Anti-malware
Implementing Controls Risk Matrix Develop Mitigating Controls Deploy Controls Example: File Sharing Controls Establish formal policies around use of file sharing services Educate users Establish controls 1. Use tools to enforce file rights management 2. Devices Controlled by AD set group policy to allow access to only approved file sharing services 3. Use web filtering to block access to unapproved file sharing services 4. Use MDM tools to block use of unauthorized services 5. Limit access to corporate resource to only approved resources
ESTABLISHING EFFECTIVE CYBER RISK GOVERNANCE PROGRAM 32
IT Governance Governance Strategic Planning Vendor Management Board of Directors Review Security Policies Audit Training 9. Periodic Plan Review 1. State the Mission 2. Define Current State 8. Detail Implementation Plan NetStandard Strategic Planning Process 3. SWOT 7. Define Strategic 3 Year Plan 6. Establish Critical Success Factors 5. Define Future State 4. Define Business Objectives
IT Governance: Organization Structure Governance Strategic Planning Vendor Management Board of Directors Review Security Policies Audit Training
Employee Training Process: make sure everyone understands controls. Metrics: Foster an environment of continuous improvement by gathering relevant metrics and reporting on them. Experience: Train users by giving them practice (i.e. e-mail phishing tests)
Addressing Residual Risk Insurance
Insurance -- Average cost of a data breach $880,334 Cover Residual Risks with Insurance First-Party Cyber Liability Insurance can pay for the costs of a breach on YOUR network Cyber Liability Insurance may cover data security incidents including: Malware attacks DDOS attacks Ransomware Phishing schemes Insider data breaches Malfunctions leading to accidental disclosure Breaches caused by employee error
Did We Cover These Acknowledge cybersecurity as an enterprise-wide risk management issue not just an IT issue Understand the legal implications of cyber risks Access cybersecurity expertise, and discuss during board meetings Provide adequate staffing and budget Identify risks to avoid, accept, mitigate or transfer through insurance and understand the plans with each approach
Thank You! John Leek, NetStandard 30 year career working at companies in the insurance, financial, and transportation industries 10 years working with small to medium businesses Email: jleek@netstandard.com www.linkedin.com/johnleek/ Twitter: @john_leek