Information Security @ AVL
1 like699 views
H. Czamai presented on information security at AVL, an automotive engineering company. AVL has implemented an Information Security Management System (ISMS) based on ISO 27001 to ensure information security through organizational and technical measures. This includes an ISO 27001 certification, security awareness training, global policies, audits, and technical controls like firewalls, access management, and encryption. AVL also manages risks through threat detection and vulnerability management processes. The presentation discussed AVL's global operations, top security threats, and cloud security strategy using Microsoft services like Azure and Intune.
Information Security @ AVL
- 1. H. Czamai AVL List GmbH (Headquarters) Public INFORMATION SECURITY @ AVL
- 2. H. Czamai | | 20 März 2017 | 2Public AGENDA „Aus dem Leben eines IT-Security-Verantwortlichen“ Introduction AVL ISMS @ AVL How AVL survives in the Cybersecurity Jungle
- 3. H. Czamai | | 20 März 2017 | 3Public AVL achieves unique results in regards to the development and improvement of all types of powertrains as well as in the field of measurement and test technology. AVL – over 65 years’ experience Involved in more than 1,500 engine development projects More than 4,000 engine testbed installations OUR EXPERIENCE FOR YOUR SUCCESS
- 4. 4Public ENTERPRISE DEVELOPMENT AUTOMOTIVE 5 powertrain elements EXPERIENCE More than 65 years ! GLOBAL FOOTPRINT 30 engineering locations >220 test beds Global customer support network ONE PARTNER INNOVATION 1500 granted patents RESEARCH 10% of turnover in-house R&D GROWTH SALES 1995: 0.15 billion € 2015: 1.27 billion € prev. 2016: 1.41 billion € STAFF 8,050 employees 65% engineers & scientists 0 100 200 300 400 500 600 700 800 900 1.000 1.100 1.200 1.300 1.400 1.500 Mio. €
- 5. H. Czamai | | 20 März 2017 | 5Public SOLUTIONS FOR ALL CUSTOMER SEGMENTS Passenger Cars Racing2-Wheelers Construction Commercial Vehicle Agriculture Locomotive Power PlantsMarine Powertrain Engineering Simulation & Testing Development Platform
- 6. H. Czamai | | 20 März 2017 | 6Public AVL – A GLOBAL PARTNER *Headquarters in Graz Austria* Croatia Czech Republic France Germany Great Britain Romania Russia Slovenia Spain Sweden Turkey Hungary Italy Poland South America Argentina Brazil Asia China India Indonesia Japan Korea Malaysia Taiwan Thailand Vietnam Australia North America Mexico USA Europe
- 7. H. Czamai | | 20 März 2017 | 7Public AVL POWERTRAIN – A NETWORK OF TECHNICAL CENTERS *Headquarters in Graz Austria* France Germany Great Britain Hungary Sweden Turkey South America Brazil Asia China India Japan Korea Australia North America USA Europe Ann Arbor, USA Plymouth, USA Paris, FRA Lake Forest, USA Sao Paulo, BRA Sydney, AUS Gotenborg, SWEBudapest, HUN Istanbul, TUR Basildon, UK Shanghai, CHN Remscheid, GER Munich, GER Stuttgart, GER Regensburg, GERNeuenstadt, GER Ingolstadt, GERCoventry, UK Tianjin, CHN Steyr, AUT Haninge, SWE Södertälje,SWEHQ Graz, AUT + another 9 Engineering Offices Delhi-Gurgaon, IND Tokyo, JPNSeoul, KOR
- 8. H. Czamai | | 20 März 2017 | 8Public ORIENTATION FOR AN INNOVATIVE FUTURE AFFORDABLE CO2 REDUCTION AVL PROVIDES INNOVATIVE SOLUTIONS - SUPPORTING OUR CUSTOMERS TO MEET THESE MAJOR CHALLENGES MASTERING SPEED & COMPLEXITY TO MARKET STRATEGIC GLOBAL PARTNER
- 9. H. Czamai | | 20 März 2017 | 9Public CHALLENGES FOR INFORMATION SECURITY A STRUCTURED APPROACH (E.G. ISO27001 ISMS) ALLOWS US TO ENSURE THE NECESSARY LEVEL OF INFORMATION SECURITY MASTERING SPEED & COMPLEXITY TECHNOLOGY THREATS GLOBAL SETUP CULTURES AWARENESS
- 10. H. Czamai | | 20 März 2017 | 10Public Internal Hannes Czamai Global IT Security Officer hannes.czamai@avl.com Phone: +43 316 787 744, Fax: +43 316 787 1473 Mobile: +43 664 4225512, Office: +43 316 787 1768 AVL LIST GMBH A-8020 Graz, Hans-List-Platz 1 www.avl.com http://www.xing.com/profile/Hannes_Czamai/xc www.linkedin.com/in/hannes-czamai 10
- 11. H. Czamai | | 20 März 2017 | 11Public ISO 27001: THE INFORMATION SECURITY MANAGEMENT SYSTEM (ISMS) INORMATION SECURITY is more than IT SECURITY
- 12. H. Czamai | | 20 März 2017 | 12Public Internal ISMS: INFORMATION SECURITY APPROACH 12 Organizational Measures ISO 27001 Certification, Awareness trainings, IT processes, HR processes, Contract management, Global policies, Audits, Affiliate assessments, Background checks, Security clearance, Comprehensive backup & disaster concepts, Phy. zone concept, … Technical Measures Port security, LAN / WAN / Firewall management Access- and identity management (FIM) + AD + Policies Server / Storage / Datacenter (Server room) standards, Client COE / CAx Hardware + Software standards, Patch-, Antivirus-, Antimalware- Management, Access control system, Video surveillance, Fences, and many more … technical : organizational = 30% : 70%
- 13. H. Czamai | | 20 März 2017 | 13Public ORGANIZATION: FROM ACTING TO REACTING Reacting IT IT IT Business Acting IT User User SECURITY Reacting Security Acting Security
- 14. H. Czamai | | 20 März 2017 | 14Public AVL PROCESS LANDSCAPE – SECURITY & PROCESSES Information Security Processes IT / Operational Processes Business Processes
- 15. H. Czamai | | 20 März 2017 | 15Public AVL ISMS – IT RISK MANAGEMENT Information Objects IT System Business Process Estimate Damage Model IT Service Rate C I A GAP Analysis Measures Problem Mgmt. Sensitivity = Priority RATING BBB
- 16. H. Czamai | | 20 März 2017 | 16Public
- 17. H. Czamai | | 20 März 2017 | 17Public TOP THREATS Lack of awareness Industrial espionage Data loss or theft Social engineering Travelling user Vulnerabilities in Apps CEO/Fake President Fraud Attack Crypto Locker + Ransomware DDOS blackmail APTs
- 18. H. Czamai | | 20 März 2017 | 18Public VULNERABILITY / THREAT MANAGEMENT Permanent detection of malicious activities
- 19. H. Czamai | | 20 März 2017 | 19Public ATA – THE SWISS KNIFE AGAINST DC ATTACKS Detects with help of machine learning: Brute force Sensitive account exposed in plain text auth. Service exposing accounts in plain text auth. Honey Token account suspicious activities. Unusual protocol implementation. Malicious Data Protection Private Information Request. Abnormal Behavior (pass the hash, pass the ticket).
- 20. H. Czamai | | 20 März 2017 | 20Public CLOUD STRATEGY Customer Requirements Legal Requirements Identity / Access Management Technical Measures (crypt) Audit- Log Management Risk Analysis Contract Management
- 21. H. Czamai | | 20 März 2017 | 21Public CLOUD PROJECTS WITH MICROSOFT AD Federation Service AVL Streaming AVL Software Repository Azure Information Protection Cloud encryption MS Intune MDM
- 22. H. Czamai | | 20 März 2017 | 22Public ARE WE SECURE ENOUGH? YES … BUT IT IS NOT ONLY A MATTER OF TECHNOLOGY Photo: Tobias Hellsten
- 23. H. Czamai | | 20 März 2017 | 23Public TECHNOLOGY