Effective Cyber Security: Successful Approaches and Experiences

ISONEffective Cyber security:Successful approachesand experiences April 5, 2012 Presenter Phil Marasco

Agenda• Continuing Trends• New Elements• Defensive Techniques• Scaling to “X”• Questions

Recent News60 Minutes did a story on the first known control system attack Source: CBSnews.com

Last Week’s NewsRock Center did a story on a Trojan used to steal money Source: MSNBC.MSN.com

FBI says we are behindExecutive Assistant Director of the FBI thinks criminals are ahead.

Identity trading is rampantStolen credit cards are sold in large lots for prices aslow as $.40 to $10 depending on interval and methodused to collect the information.Personal Identity information commands $25 to $50(depending on quality).

Unpatched exploits on saleSource: Forbes.com

Internal vs. External• Historical threats • Us vs. them • Inbound Only (except for “inside jobs”)• Advanced Persistent Threats• Blended attacks/RSA• SPAM/Phishing

New Frontiers• Small Business is expanding online • Offering Online “Experiences” • Member-Only Areas • Monetize Social Media • Group-on Discounts • Gift Cards

New Dangers• Web sites that store your data • Financial Risks • Personal Information Leakage• Internal Threats • Zombies • FBI and the DNSChanger scam• Brand Exposure (and explosion)

New SPAM VectorsUS Postal Service couldn’t deliver your packageAmerican Airlines wants you to get that $19 fare to NY you left behind during your failed web sessionThe National Check Clearing Center says you are about to bounce a checkVISA Security department says your credit card has been blockedPAYPAL says you are suspected of illegal activityA gentleman in the Philippines would like you to hold his inheritance check while he travels to the US.A lawyer in Thailand wants to see if you know a guy who died and will handle his $10 million estate.

New Questions• What’s it worth to you?• What can you actually do?• What can be done for me?• How often do I look?In a corporate environment the bigger question is:X vs. 10X vs. 100X

New Personal ToolsIdentity Monitoring• Epic.org (Electronic Privacy Info Center)• http://www.youhavedownloaded.com/• https://www.pwnedlist.com/• http://www.Google.com• http://www.Pipl.com• Donttrack.us

New LEO Tools

What we do• Penetration testing • Network • Application • Physical• Security Awareness• Compliance• Security Practice • Policy lifecycle • Security team augmentation

Who is ISON?• Managed IT Services Firm• Focus on small to medium business• Extension of an organization – With IT personnel – Without IT personnel• 30+ years industry experience

Wrap up• Technical Corporate • Use a patch management process • Implement a secure baseline • Monitor your network • Manage your vulnerabilities • Be careful with remote access• Behaviors • Put security and acceptable use policies in place • Conduct security awareness training regularly • Be careful with your data

Questions?

Thank You! www.ISON.com

Effective Cyber Security: Successful Approaches and Experiences

by InnoTech

Accessibility

Categories

Upload Details

Usage Rights

Statistics

Effective Cyber Security: Successful Approaches and Experiences Presentation Transcript