SAM05_Barber PW (7-9-15)
Download as PPTX, PDF2 likes295 views
This document discusses a potential cybersecurity assessment for a customer by a SAM and cloud partner. It provides an overview of what a cybersecurity assessment entails and the benefits it could provide to both partners and customers. For partners, it is an opportunity to strengthen relationships with customers and discuss additional cloud and software opportunities. For customers, an assessment establishes good security practices, prepares their environment to respond to threats, and helps minimize cyber risks and their related costs. The document then outlines UnifyCloud's tools and services that can help customers assess, remediate, and monitor their environment as they migrate workloads to the cloud with Microsoft solutions like Office 365 and Azure.
SAM05_Barber PW (7-9-15)
- 6. CIO and SAM partner discussion Isn’t this just another way for Microsoft to get data for a True-Up? A Cybersecurity assessment? Is that like a pen test? What is in it for me? What’s the big deal with Cybersecurity, we are not big or famous like Sony or the US Federal Government after all? We are moving to the cloud, doesn’t that just solve all this Cybersecurity nonsense? You are a licensing guy, why are you suddenly qualified to be a Cybersecurity SME? Answers are contained in the deck that can be downloaded.
- 7. For SAM partners: • Take advantage of a Cybersecurity SAM Engagement as one step towards having a discussion about larger customer opportunities (e.g., O365/Azure, Core IO, Migration to latest OS, Systems Center) • Broaden the value of a SAM engagement by providing data that can be rationalized against other internal data so the customer receives a more integrated view of their environment. • Develop a long-term trusted advisor relationship by establishing credibility and demonstrating customer- focused problem solving. • Highlight the overall benefits of incorporating SAM best practices within the organization. • Increase customer satisfaction by helping your customers solve critical business challenges.
- 8. For customers: • A foundation for securely managing software assets and promoting good Cybersecurity hygiene in a holistic, integrated way. • A view of the software estate can prepare a resilient IT infrastructure that can respond to threats, and meet their agreement obligations. • Added policies and controls help ensure that a secure IT infrastructure within the organization provides an effective defense against attacks. • Minimizing cyber risks helps organizations decrease costs from data loss, fraud from theft, loss in revenue, labor, support, employee downtime, cost to locate and reinstall lost data, customer support, and negative reputation. • A solid Cybersecurity program helps to accelerate the migration to the cloud and adoption of mobile.
- 9. “Antivirus and security products are designed for and focus on protecting you from prevalent classes of in the wild… threats coming from criminals, thugs and digital mobsters. It is not designed to protect you from the digital equivalent of Seal Team Six. So if you're the guy that finds himself in the crosshairs… you're not safe.” --F-Secure “News from the Lab”, May 30, 2012
- 10. Traditional IT Modern IT Script kiddies; Cybercrime Cyber-espionage; Cyber-warfare Cybercriminals State sponsored actions; Unlimited resources Attacks on fortune 500 All sectors and even suppliers getting targeted Software solutions Hardware rooted trust the only way Secure the perimeter Assume breach; Protect at all levels Hoping I don‘t get hacked You will be hacked. Did I successfully mitigate? Company owned and tightly managed devices Bring your own device, varied management
- 11. Source: The Guardian “INFORMATION SECURITY BREACHES SURVEY 2014” “There has been a significant rise in the cost of individual breaches. The overall cost of security breaches for all type of organizations has increased.” “10% of organizations that suffered a breach in the last year were so badly damaged by the attack that they had to change the nature of their business.” Specifically, for small businesses: • 60% had a security breach • 59% expect there will be more security incidents next year • 33% were attacked by an unauthorized outsider • 45% had an infection from viruses or malware • 31% of the worst breaches were caused by human error • 70% keep their worst security incident under wraps. So what’s in the news is just the tip of the iceberg. Key observations: 1. While the number of breaches has decreased, the scale and cost has nearly doubled. 2. The investment in security as part of total IT budget is increasing across all sectors. 3. There has been a marked increase in spending on IT Security in small businesses. 4. Risk-based decisions are being made about the introduction of mobile devices.
- 12. The reality is that businesses are far more exposed running outdated and unpatched client and server operating systems: • Windows XP is 21 times more likely to be infected by malware than Window 8 • Windows 7 is 6 times more likely to be infected by malware than Window 8 Running pirated software makes the situation even worse. Criminals embrace pirated software because it is: • Lucrative • Spreads malware • Less risky and has a low barrier to entry As a result, one out of three computers with counterfeit software installed will be infected by malware.
- 13. Cloud • Designed for Security from the ground up; Azure development adheres to Microsoft’s SDL. • Adheres to a rigorous set of Security controls that govern operations and support. • Deploys a combination of preventive, defensive, and reactive controls. • Tight access controls on sensitive data, including two-factor authentication to perform sensitive operations. • Controls that enhance independent detection of malicious activity. • Multiple levels of monitoring, logging, and reporting. • A global, 24x7 incident response service that mitigates attacks and malicious activity
- 14. Gather preliminary information about the existing environment, future goals, and security concerns Security considerations Applications, OS, and data security Infrastructure People Organizational profile Environment Cybersecurity Concerns Basic information about the organization
- 15. Match installations with licenses Inventory deployed software ...build a detailed report on your current state Microsoft
- 16. A Cybersecurity Assessment will assess the current status using generally accepted security controls. The assessment will cover topics such as: • Authorized and unauthorized devices • Authorized and unauthorized software • Secure configurations for hardware and software • Malware defenses • Application software security Increasing the efficiency of each control raises the success rate of the defenses in the environment.
- 17. The recommended set of deliverables (required for Incentive SOW) include:
- 19. Assessment finding: Windows Server 2003 has been discovered in the Litware IT infrastructure and support is scheduled to end on July 14, 2015 after which time no further support will be provided by Microsoft including security patches. This brings to Litware elevated risk from data loss or malicious attacks, future problems of incompatible software that may not run on Windows Server 2003, and problems meeting certain regulatory requirements that require fully supported systems.
- 20. 11. Limitation and Control of Network Ports, Protocols and Services 12. Controlled Use of Administrative Privileges 13. Boundary Defense 14. Maintenance, Monitoring, and Analysis of Audit Logs 15. Controlled Access Based on the Need to Know 16. Account Monitoring and Control 17. Data Protection 18. Incident Response and Management 19. Secure Network Engineering 20. Penetration Tests and Red Team Exercises 1. Inventory of Authorized and Unauthorized Devices 2. Inventory of Authorized and Unauthorized Software 3. Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers 4. Continuous Vulnerability Assessment and Remediation 5. Malware Defenses 6. Application Software Security 7. Wireless Access Control 8. Data Recovery Capability 9. Security Skills Assessment and Appropriate Training to Fill Gaps 10. Secure Configurations for Network Devices such as Firewalls, Routers, and Switches
- 21. 11. Limitation and Control of Network Ports, Protocols and Services 12. Controlled Use of Administrative Privileges 13. Boundary Defense 14. Maintenance, Monitoring, and Analysis of Audit Logs 15. Controlled Access Based on the Need to Know 16. Account Monitoring and Control 17. Data Protection 18. Incident Response and Management 19. Secure Network Engineering 20. Penetration Tests and Red Team Exercises 1. Inventory of Authorized and Unauthorized Devices 2. Inventory of Authorized and Unauthorized Software 3. Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers 4. Continuous Vulnerability Assessment and Remediation 5. Malware Defenses 6. Application Software Security 7. Wireless Access Control 8. Data Recovery Capability 9. Security Skills Assessment and Appropriate Training to Fill Gaps 10. Secure Configurations for Network Devices such as Firewalls, Routers, and Switches
- 23. Basic The program is tactical at best and the risks of a Cybersecurity issue are significant. Standardized The program is proactive and the risks of a Cybersecurity issue are moderate. Dynamic The program is strategic and optimal and the risks of a Cybersecurity issue are minimal. Rationalized The program is holistic and fully operational and the risks of a Cybersecurity issue are limited.
- 24. SAM Cybersecurity Assessment Report • Organization and IT Overview SAM Cybersecurity Goals • Summary of Inventory Tools Cybersecurity Summary • Critical Security Controls (v5.1) Current Cybersecurity Maturity Findings and Recommendations • Current Cybersecurity Maturity Findings • Cybersecurity Future State and Recommendations SAM Policies and Procedures for Cybersecurity
- 28. Review the SAM Cybersecurity Engagement Kit and sample reports Become familiar with the Critical Security Controls (v5.1) Prepare to deliver a Cybersecurity Assessment by: • Obtaining your SAM competency • Training up a resource to be a credible Cybersecurity SME (e.g., pass CISSP) • Hiring a resource with Cybersecurity skills and certifications; or by • Partnering with Microsoft or a Microsoft Partner for deeper Cybersecurity expertise
- 30. Key Services Providing a current / future state analysis of Cybersecurity for a Hybrid IT environment (on-premises, Cloud, Mobile). Using IT discovery tools, provide a roadmap for migrating to “Modern IT” using Office 365, SQL Database, and the Azure platforms. Starting with a detailed Application Cloud Readiness Assessment (ACRA) and using our tools and offshore Azure resources, we evaluate, re-architect and remediate apps to run effectively in Azure. Assessment, Remediation, and Monitoring Tools Using IT inventory data from discovery tools like MAP, the Assessor tool creates a Data Center Modernization Report on what a Modern IT environment will look like once Office 365, SQL Azure and Azure platforms (IaaS / PaaS) are used. Using static code analysis, SQL scripts and configuration data, the Validator tool analyzes and recommends changes down to the code block level dramatically reducing remediation time even suggesting sample code to accelerate the remediation effort. Navigator serves as the repository for the suite of tools to allow Services settings and coding best practices to remain in sync in both the Dev/Test and production environments to minimize IT risk. Navigator is updated as Azure features and settings are enhanced. Once applications are deployed into an Azure subscription, the Monitor tool scans Azure-based applications for out of compliance conditions against policy and standards as new Azure features are released, applications are upgraded, and Cloud IT policies evolve. Accelerating Azure adoption and driving consumption in FY16 through migration and risk management tools and services. As a Microsoft Cloud, Cybersecurity and SAM partner, UnifyCloud LLC has developed tools and related services focusing on the key sales motion scenarios for FY16 including: • Transform the Datacenter • Enable Application Innovation • Unlock Data Insights • Ensure IT Security & Controls
Editor's Notes
- #3: Perspectives on the session title: Mitigating Customer Risk Cybersecurity SAM Engagement Hi, I am Norm Barber…. Joining me is Don Morrison,
- #19: 18
- #20: Key Points: The first step is to find out more about your organization and any concerns regarding the security of your environment. We will cover topics such as: Organizational Profile: What are your cybersecurity concerns? What are your objectives from the engagement? What level of risk tolerance do you have? Were there any recent cyber security incidents you had to deal with? In those incidents what have you realized that you were not able to do? What did you miss the most? Basic Information: How many clients and servers are in the organization? What processes are already in place to manage software and other assets? Infrastructure Security: Do employees work remotely? Do external contractors access your network? Applications Security: Does the company develop applications? Does it store sensitive data processed by those applications? Operations Security: Does the corporate network connect to external networks? Does the organization receive data feeds from external parties? People Security: Does the company outsource computer maintenance? Can employees download sensitive company data to your workstations? Environment: How many employees are in the organization? Is there high turnover in the IT department?
- #21: Key Points: In the initial part of the engagement, we will discuss your organization’s future goals and objectives. After establishing an organization’s goals and objectives, the next step of a Cybersecurity SAM engagement is to develop a clear understanding of the current state of the software assets in your environment. This information will provide the basis for the cybersecurity assessment.
- #22: Key Points: As part of the assessment, we will: Explain the control and talk about what it covers. Assess your current status relative to each control Provide you with recommendations on related Microsoft service and product offerings Note to presenter: Add recommendations on any additional services that your organization can also provide as a follow up from the engagement. Further details: Authorized and Unauthorized Devices: This control covers the Hardware Asset Management aspect of ITAM and is a critical control to implement. It recommends the usage of a hardware asset inventory management system to keep track of any changes to the IT hardware assets and also recommends that the introduction of new hardware to a network updates this system automatically. Also covered in this control is the authentication and authorization of devices and systems when they are accessing the network infrastructure. Authorized and Unauthorized Software: Software Inventory management can be mapped to Software Asset Management. In this control, partners should recommend to customers best practices around SAM, how to implement mature SAM processes in place, and tools guidance should be provided. Secure Configurations for Hardware and Software: The right configuration for deployed software and its interactions in a network goes a long way in stopping and/or slowing down threats. This control covers the discussions around making sure configuration management is maintained and templates are configured for different user scenario and workloads. Configuration management also covers areas around change control processes. Malware Defenses: Unauthorized execution of malicious software in the environment should be prevented with strong Antivirus (AV) defenses configured in the environment. A deployed but unmanaged antivirus solution does little to protect an environment. All reports and activity updates from AV software consoles and alert messages generated by these software should be monitored and reviewed. Application Software Security: Application software security relates to the security of any software developed in-house in the customer environment. Any software that will receive input from external users in the form of direct or indirect interaction should be developed with secure development principles.
- #23: Executive Overview Report. This report contains and Executive Summary, summary of project background and scope, engagement results, recommendations and next steps. Microsoft Deployment, Usage and Entitlement Analysis Reports: The Established Deployment Position (EDP) spreadsheet (NOTE: Defined in “Deliverables to Microsoft” section below.) The Effective License Position (ELP) spreadsheet (NOTE: Defined in “Deliverables to Microsoft” section below.) Cybersecurity Assessment Report. This report must contain at a minimum: Assessment of the Customer’s overall Cybersecurity state, in relation to their current IT infrastructure Cybersecurity roadmap to assist the Customer in better protecting their IT assets, including all business, licensing and technology guidance Assessment of Customer’s cybersecurity-related SAM policies and procedures strengths, weaknesses and areas of opportunity, including recommendations for improvement Advice on how to engage with a cybersecurity professional, if needed, and a list of additional resources on cybersecurity, such as the Council on Cybersecurity, that would benefit the customer Licensing Optimization Recommendations Report. This report must contain the risks, liabilities and issues associated with the current licensing practices and prioritized recommendations on how to better manage their licenses to minimize risks in the future. The report should also contain, but is not limited to: Identification of all of Customer’s Volume License Agreements (VLAs) with Microsoft and a recommendation on any beneficial consolidation Consumption information, detailing installed products that are unused or under-utilized (e.g., no use in last six months) Recommendations on repeatable, simplified inventory collection process for future True-ups (for Enterprise Agreement customers only) Additional Customer-specific recommendations based on captured data and insights
- #38: Perspectives on the session title: Mitigating Customer Risk Cybersecurity SAM Engagement Hi, I am Norm Barber…. Joining me is Don Morrison,