ISS-(ISC)2 Seminar: Singapore Security Direction and Approaches to Smart Nation Implementation. By Mr. David Shearer, CISSP, Chief Executive Officer, (ISC)2

1. Security in Smart City Implementation:
Infrastructure and People
David Shearer
(ISC)2 Chief Executive Officer
dshearer@isc2.org | www.isc2.org

2. © Copyright 1989 – 2016, (ISC)2 All Rights Reserved
Stakeholders Involved in Shaping a City
2
Political Leaders,
Managers and
Operators of the
Local Government
The Service Operators – public or
private:
Communication, Electricity,
Education, Transport, Water,
Waste, etc.
Investors:
Private Banks,
Venture Capitalists,
Pension Funds,
International Banks
Solution Providers:
Technology Providers,
Financiers and
Investors
End users and ‘Prosumers’:
Inhabitants and Local Business
Representatives
Source: International Electrotechnical
Commission- Orchestrating infrastructure for
Sustainable Smart Cities

3. © Copyright 1989 – 2016, (ISC)2 All Rights Reserved
Operating Systems for City Infrastructure
» Smart cities are enabled by
recent advances in key
technologies:
• Pervasive sensor networks
• Low-cost communications
• Software-as-a-Service
» Pain points are awaiting to
be solved…
3
Source: International Electrotechnical Commission- Orchestrating infrastructure for sustainable Smart Cities

4. © Copyright 1989 – 2016, (ISC)2 All Rights Reserved
Importance of Standards in Smart City
» Cloud is a crucial part of
any smart city
» Web-services over cloud
» A portal server can allow
for the creation of unified,
even if personalized, user
interfaces, taking into
account individual settings
such as language
» Who is managing the
‘Portal’ & the web service?
4
One portal server structure, integrating systems using standards
from IEC, ISO, JTC1, ITU-T
Source: InternationalElectrotechnicalCommission- Orchestratinginfrastructurefor sustainable
Smart Cities

5. © Copyright 1989 – 2016, (ISC)2 All Rights Reserved
Cloud in a Smart City
• Awareness: Understanding current cloud
usage within an organization and/or a city
• Opportunism: Identifying strong cloud
adoption opportunities ( From ‘Cloud First’ to
‘Cloud-First Security-Now’ Policy)
• Strategy: Building cloud adoption program
- architecture, frameworks, business
alignment and IT skill sets
• Capacity Building: Assessment of own
enterprises’ needs for capacity building
and training in cloud computing-related
areas
5

6. © Copyright 1989 – 2016, (ISC)2 All Rights Reserved
(ISC)² Global Information Security Workforce Study
https://www.isc2cares.org/uploadedFiles/wwwisc2caresorg/Content/GISWS/FrostSullivan-(ISC)%C2%B2-Global-Information-Security-Workforce-Study-2015.pdf

7. © Copyright 1989 – 2016, (ISC)2 All Rights Reserved
Not a Question of if, But How Much
7
Source: 2015 (ISC)² Global InformationSecurity Workforce Study – A Frost and Sullivan Market Study
Most respondents made cloud a priority for their organizations
and continue to do so over the next two years.

8. © Copyright 1989 – 2016, (ISC)2 All Rights Reserved
Prevalence of Cloud Models: SaaS, PaaS, IaaS
8
Source: 2015 (ISC)² GlobalInformation Security Workforce Study – A Frost and Sullivan Market Study
44
24
32
39
26
35
42
24
3534
26
4041
27
33
40
28
32
39
25
36
38
28
33
0
5
10
15
20
25
30
35
40
45
50
Software as a service (SaaS) Platform as a Service (PaaS) Infrastructure as a Service (IaaS)
Worldwide APAC Australia Hong Kong India Japan Singapore South Korea
In%

9. © Copyright 1989 – 2016, (ISC)2 All Rights Reserved
Cloud Adoption Barriers
9
Source: 2015 Cloud Security SpotlightReport
Security is still the biggest perceived barrier to further cloud adoption.
Nine out of ten organizations are very or moderately concerned about
public cloud security.

10. © Copyright 1989 – 2016, (ISC)2 All Rights Reserved
Security Concerns in Public Clouds
10
Source: 2015 Cloud Security SpotlightReport

11. © Copyright 1989 – 2016, (ISC)2 All Rights Reserved
CSA “Notorious 9 Security Threats”
73%
61%
59%
57% 56% 56% 55%
77%
69% 68%
62% 62%
65%
61%
78%
67% 68% 67%
63%
55%
59%
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
Data loss Account Hijacking Malicious Insiders Insufficient Due
Diligence
Insecure APIs Denial of Service Abuse and
Nefarious Use
Worldwide APAC Singapore
11
Source: 2015 (ISC)² GlobalInformation Security Workforce Study – A Frost and Sullivan Market Study

12. © Copyright 1989 – 2016, (ISC)2 All Rights Reserved
Elevating Cloud Assurance
12
Strong data encryption is the top overall choice for elevating cloud information
assurance among APAC countries. Singapore respondents see adopting
security governance as a way of elevating information assurance in the cloud.
18%
11%
9%
7%
6% 6%
16%
10%
7% 8%
7% 8%
14%
9%
4%
11%
5% 6%
0%
2%
4%
6%
8%
10%
12%
14%
16%
18%
20%
Strong encryption of
data
Continuous
monitoring
Incorporating
security into
software design and
implementation
Adopting security
governance
Implementing
identity based
network solutions
Employ Role Based
Access Controls
(RBAC)
Worldwide APAC Singapore
Source: 2015 (ISC)² GlobalInformation Security Workforce Study – A Frost and Sullivan Market Study

13. © Copyright 1989 – 2016, (ISC)2 All Rights Reserved
Demand for Training and Education
In most areas in the APAC region including Singapore, cloud computing is the area requiring the most training
and education, however in Australia, training in BYOD and incident response ranked a close second.
Base: Filtered respondents (n=7,985).
0%
10%
20%
30%
40%
50%
60%
70%
Cloud
computing
Bring-your-
own-device
(BYOD)
Incidence
response
Informationrisk
management
Mobiledevice
management
Forensics
Applications
andsystem
development
security
Accesscontrol
systemsand
methodology
End-user
security
awareness
Security
management
Security
architecture
andmodels
Worldwide APAC Australia Hong Kong India Japan Singapore South Korea

14. © Copyright 1989 – 2016, (ISC)2 All Rights Reserved
Industry Needs…
• Professionals who understand and can apply effective
security measures to cloud environments
• A reliable indicator of overall competency in cloud
security
• Roadmap and career path into cloud security
• Common global understanding of professional
knowledge and best practices in the design,
implementation and management of cloud
computing systems.

15. © Copyright 1989 – 2016, (ISC)2 All Rights Reserved
Credentials for Industry Best Practices
CCSP
Deeper,
advanced
experience-based
cloud security knowledge
CCSK
Broad, Foundational, Baseline
Knowledge

16. © Copyright 1989 – 2016, (ISC)2 All Rights Reserved
Cloud in the Future
Adoption of cloud-based cybersecurity services
• Entrust a broadening range of critical services to the cloud, including real -time
monitoring and analytics, advanced authentication and identity and access
management
Adoption of DevOps to DevSecOps
• Ensure security controls are applied and implemented as part of development before
operational acceptance.
• The importance of ‘bolted-in’ secure software development for cloud-based
operations
Wide use of SaaS covering any cloud service where consumers are able to access software
applications over the internet anywhere, anytime.
• These applications are hosted in the cloud and can be used for a wide range of tasks
for both individuals and organizations
16

17. © Copyright 1989 – 2016, (ISC)2 All Rights Reserved
Properly assess the overall security risk
Cloud providers need the expertise to also ensure
their services meet certain security requirements
Understand how cloud is changing information
security best practices
17
Mandate

18. © Copyright 1996-2015. (ISC)², Inc. All rights reserved.