Secure Iowa Oct 2016

Editor's Notes

• #2: On behalf of AOS and myself, I want to thank Northrup Grumman for the opportunity to speak with you today Collaborative dialogue Not going to read slides
• #4: This is the “You can Quote me, But . . . “ slide
• #7: Compliance Checkbox Complacency Most organizations are at step 2, can hop to step 3 with just a nudge or two 80% of your clients will be somewhere between Level 1 and Level 2. See how once we place the client on the model we can see their needs for moving forward. During the assessment phase, remember our 4 step approach, remember that your client can have elements that exist in Level 3 but have missed elements that are vital at Level 1.
• #8: D&D – disgruntled and disenfranchised insiders – one of the biggest hidden threats companies can face Most companies cannot afford to find and keep the expertise level to meet these needs
• #9: This was from a 2014 Forrester study and has been echoed as recently as January in the WSJ
• #10: Even though cyber security is not just IT’s problem anymore, we are still looked at to help solve/prevent the lion’s share
• #11: This area of overlap where policy/process shortcomings meet technology shortcomings is why cyber sec is no longer only an IT issue
• #13: Click on Picture for Norse Map  Let’s not forget your compute power
• #14: Someone give me an idea of what is the biggest source of cyber incidents… Let me tell you where the real damage is. Everyone concentrates on hacking…
• #15: The FBI has concluded that as much as 75% of the reported cyber incident sin 2015 had an inside threat actor component Who are insiders: Problems at home Failure to be recognized, past over, no raise Ashley Madison/Adult FriendFinder Can I get away with – culture to get over on the man Help the underdog, allegiance to others – company, country , culture employees, trusted partners, vendors and contractors
• #16: Not all these are bad – maybe sign of a go-getter – but perhaps all taken together . . . Risk factors: Ineffective management of privileged users. Inappropriate role and entitlement assignment. Poor overall identity governance. Poor information classification and policy enforcement. Inadequate auditing and analytics. Audit log complexity. Reactive response. No comprehensive written acceptable use policies
• #17: Combating insider threats is immensely bigger and far more complex than merely an IT challenge.  Background Checks Access Controls & Logging reviews Leadership get smarter Encrypt what matters, MFA too End user awareness raising
• #18: Fazio Mechanical Rubbing salt in this wound, according to the 2014 Ponemon study on the Cost of Data Breaches, is the emerging trend that recovery costs for the breached entity are notably higher when perpetrated through a supplier/third party. Facilitated by a malevolent insider, the costs can ramp up even higher and faster.
• #19: Every headline making breach you heard about recently is likely to have some component of inadequate vendor management as a contributing or primary factor
• #20: Employees are best and worst. Tell the Childrens of AL story
• #21: Faked emails that attempt to get you to directly or indirectly divulge or allow access Program or file that appears harmless, but is, in fact, malicious. If the Trojan Horse weren't such a genius example of a social engineering attack, we'd never have named an entire class of malware after it. RSA in 2011. What is known is that RSA's parent company, EMC, spent $66 million recovering from the attack, recruitment xl file to two lists of non-high profile folks Watering holes are more subtle than phishing attacks. Malware is injected into a legitimate website that organizations in the target industry are already likely to visit.  UPS Gal story Too much info being shared by current and former employees Nigerian Prince / Prince / Honduran & Japan Earthquakes Target 40 M CC compromised
• #22: Often because it has yet to happen to a company, or at least that they know of, some companies feel like doing nothing is a viable option. That is risk unto itself
• #23: Well, how many servers do you have, how many web sites, how many mobiles devices/laptops, how many employees?
• #24: Source is Ponemon Institute Cost of Cyber Crime Study 2014 Some organizations’ database contain hundreds of thousands of records – imagine the costs of a breach then The state in which the resident of the affected record(s) gets to define if a breach occurred! Need to free up Run and Maintain dollars to fund additional new development; proactive risk management does that
• #25: We all know nothing ventured, nothing gained. We must take calculated risks. This approach attempts to make sure there are some contingencies and precautions in place . . .
• #27: This 5 step model defines a process. Analysis: We always start by Assessing the organization. What is the clients strategy. Jumping directly into what hardware they need without understanding the development strategy does not serve the clients long term needs. What are the vulnerabilities What are their administrative security controls Collecting as much information you can on the level of security / preparedness of the organization Design: Designing is where we tie in our other offerings to complete a sound strategy. 1. What kinds of mitigation controls do they have; BCP, DR, Scheduled testing, Scheduled exercises. Develop: Develop or build organizational resiliency. Hardware purchases, Cloud support, what are the consulting needs to move forward. Implement: Are you listening? The consulting elements will expose and sometimes redirect the corporate strategy- this directly ties to the hardware support to the strategy.; Example: Penetration testing and consulting can result in the need for new firewalls, IPS/IDS, Identity Access Management, Encryption to name a few. Evaluation: Review the strategy, constantly monitor and make changes as needed. Annually, address strategy changes or redirection.
• #28: TRM defined – Though still to often excluded from the boardroom level, the process seeks to identify technology related risks to a business, assess those risks by determining their potential impact and their likelihood of occurrence, and then to take steps to mitigate the risks to an acceptable level Confidentiality – only those who need to know can or doIntegrity- info is all there & unaltered w/o authorizationAvailability- readily accessible; from wherever & when neededAgility – done right, a best way to help the business get to “ Y E S ”Should be “baked-in” from start to finish on everything IT does, as well as what the organization does with IT
• #29: Zero-day threat detection: New attack vectors and vulnerabilities are discovered every day. Firewalls, IDS/IPS and AV solutions all look for malicious activity at various points within the IT infrastructure, from the perimeter to endpoints. However, many of these solutions are not equipped to detect zero-day attacks. A SIEM can detect activity associated with an attack rather than the attack itself. For instance, a well-crafted spear-phishing attack using a zero-day exploit has a high likelihood of making it through spam filters, firewalls and antivirus software, and being opened by a target user. A SIEM can be configured to detect activity surrounding such an attack. For example, a PDF exploit generally causes the Adobe Reader process to crash. Shortly thereafter, a new process will launch that either listens for an incoming network connection or initiates an outbound connection to the attacker. Many SIEMs offer enhanced endpoint monitoring capabilities that keep track of processes starting and stopping and network connections opening and closing. By correlating process activity and network connections from host machines a SIEM can detect attacks, without ever having to inspect packets or payloads. While IDS/IPS and AV do what they do well, a SIEM provides a safety net that can catch malicious activities that slip through traditional Forensics: A forensics investigation can be a long, drawn-out process. Not only must a forensics analyst interpret log data to determine what actually happened, the analyst must preserve the data in a way that makes it admissible in a court of law. By storing and protecting historical logs, and providing tools to quickly navigate and correlate the data, SIEM technologies allow for rapid, thorough and court-admissible forensics investigations. Since log data represents the digital fingerprints of all activity that occurs across IT infrastructures, it can be mined to detect security, operations and regulatory compliance problems. Consequently, SIEM technology, with its ability to automate log monitoring, correlation, pattern recognition, alerting and forensic investigations, is emerging as a central nervous system for gathering and generating IT intelligence.
• #41: Do an RVA and map the residual risks onto some kind matrix to make prioritized action plan
• #44: It is not getting easier The stakes are very high for getting it wrong Doing nothing wont work Prioritize and plan ahead of need Get some help