A6 pragmatic journey into cyber security
0 likes122 views
The document discusses cyber security and presents a framework for an effective cyber security program. It outlines the key elements of a comprehensive security approach, including assessing risks, architecting security controls, applying protections, administering security operations, raising user awareness, ensuring agility, defining the appropriate risk appetite, and aligning security with business needs. The framework emphasizes that security is a continuous process requiring skills in various areas to successfully manage risks.
A6 pragmatic journey into cyber security
- 1. A6 a pragmatic Journey into Cyber Security Jorge Sebastiao, CISSP ICT Expert Huawei http://linkedin.com/in/sebastiao/ Twitter: @4jorge
- 2. Disclaimer & Copyright • Please note that this presentation is for informational, knowledge sharing and educational purposes only. Any comments or statements made herein do not necessarily reflect the views of Huawei. The information is intended for the recipient's use only and should not be cited, reproduced or distributed to any third party without the prior consent of the authors. Although great care is taken to ensure accuracy of information neither the author, nor Huawei can be held responsible for any decision made on the basis of the information cited. • The content of this presentation is based on information gathered in good faith from both primary and secondary sources and is believed to be correct at the time of publication. The author can however provide no guarantee regarding the accuracy of this content and therefore accepts no liability whatsoever for any actions taken that subsequently prove incorrect. • The practices listed in the document are provided as is and as guidance and the author and Huawei do not claim that these comprise the only practices to be followed. The readers are urged to make informed decisions in their usage. • The information presented in this presentation is not intended to be, and should not be construed as, an offer to sell any products or services or a solicitation of an offer to buy any products or services . Any such offer or sale will be made pursuant to, and the information presented at this meeting is qualified in its entirety by, authorized offering documents and related disclosure schedules or similar disclosure documentation. • All logos and brand names belong to their respective owners and we do not claim any relationship or association, implied or otherwise, with them. • Use of any materials by virtue of relationships and associations, if any, are mentioned explicitly. • Author has taken care to attribute all sources for external materials used in this presentation, and any oversight is regretted. If you, as owner, or as viewer, find any reason to dispute the use of these materials kindly communicate the same to author. • Any omissions, in terms of attribution, may be due to an error of author and not intentional.
- 3. Google review of email Phishing
- 5. Is That an Office Phone In Your Pocket?
- 6. The future is here
- 10. M2M and Google Voice?
- 11. Smart Meters and Nest Hack
- 14. Hacking IIoT SCADA sensors Industrial Scale Risks
- 15. Challenges Disengagement from the changing customer mindset Lack of confidence in return on investment Lack of regulatory certainty on new market structures Privacy, security and resilience Poorly formulated M&A and strategic partnerships Failure to define new business metrics Failure to capitalize on new types of connectivity Insufficient information to turn demand into value Failure to shift the business model from minutes to bytes Lack of organizational flexibility
- 16. Mobile Malware up 148,778 samples 2013
- 17. 5th Challenge -Protection against State Sponsored Attacks • # 19M89. %6/><345% • I </>%' X71>%><. %v' ; >0%7?%# /4@q%
- 18. Is there an elephant in the room?
- 19. 0 Day Exploits - Guaranteed
- 20. Rogue & Clueless Users
- 21. Our security enemy is? Security Nightmare
- 22. Cyberspace CharacteristicsAsymmetric Attribution Problems No Borders Complex Interconnected Systems
- 25. Wrong Skills?
- 26. What is next?
- 27. Think outside the box 2
- 28. Effective Security is hidden deep underneath… Technology ProcessPeople
- 30. Modeling Risk and Threats Threats Vulnerabilities Controls Risks Assets Security Requirements Business Impact exploit exposeincreaseincrease increase have protect against met by indicate reduce
- 31. CONSEQUENCE LIKLIEHOOD FV T Risk Group 1 Risk Group 2 Risk Group 3 HighLow L o w H i g h RESPONSE PROTECTION Target Risk Risk Reduction Strategies!
- 32. 4As A4 of Security Assess Evaluate, Audit, Check Architect Plan, Design Apply Build, Implement, Do Administer Operate, Act
- 33. 5As A5 of Security Assess Evaluate, Audit, Check Architect Plan, Design Apply Build, Implement, Do Administer Operate, Act Awareness Intelligence, User
- 34. 6As A6 of Security Assess Evaluate, Audit, Check Architect Plan, Design Apply Build, Implement, Do Administer Operate, Act Awareness Intelligence, User Agility Timeliness of Response
- 35. A6 - Process Business Risk Controls Maturity
- 36. Defense in depth
- 37. The « defence in depth »
- 38. TBS- Time Based Security Protection DetectionResponse SECURITY P>D+R Anti-virus VPN Firewall, IPS Access Control Grid Time Response Patch Mgmt Incidence Response Disaster Recovery Vulnerability Testing SIEM Log Correlation CCTV, Access Control
- 40. Cyber Attack Recovery Agility Risk Active Business Can you successfully recover?
- 41. Road to Security Metrics Security Metrics KPIs, Testing Results CSA Controls, Compliance, Operational, Financial CoBIT SOX ISMS ISO27001 PCI HIPAA Time Based Security ISMS ISO22301 ISMS ISO20000
- 42. Final Goal Is Total Integrated Security Information Security Management IoT, Device Security Management
- 43. Winning the War Red Teaming Solve Attribution Continuous Vulnerability Mgmt Crowd Sourcing/Bug Bounty Fusing Crisis Management Vertical CERT Integration Encryption Exchange Knowledge Data Leak Prevention Threat Management Reputation Management Big Data Honeynets Machine Learning Sandbox Security Metrics Empower end users Continuous Training Attack / Take down
- 44. 10As A10 of Security Assess Evaluate, Audit, Check Architect Plan, Design Apply Build, Implement, Do Administer Operate, Act, Respond Awareness Intelligence, User Agility Timeliness of Response Appetite How much Risk can you take? Alignment Business focus Assumption Something is wrong? Authorization Right to access, authentication
- 45. Don’t bring a knife to gun fight
- 46. “…Security is a continuous skilled process…”… Jorge Sebastiao http://linkedin.com/in/sebastiao
- 47. Questions Jorge Sebastiao, CISSP ICT Expert Huawei http://linkedin.com/in/sebastiao/ Twitter: @4jorge