this introduces strategies to cyber defense

1. Cyber Defence Strategies
Attention Attendees:
Remember to type your messages to all panellists and attendees

2. Welcome!
• Module 1 – Introduction & Identifying Cyber Risk
• Module 2 – Administrative & Technical Controls
• Module 3 – Administrative & Technical Controls (continued)
• Module 4 – Implementation, Budgets, Funding, and ROI
• Assessment

3. Agenda – Week 1
• Current cyber threat landscape
• Taking a risk-based approach to cyber defence
• Building a cyber defence strategy

4. Current Cyber Threat Landscape

5. Overview
• Data breaches rising year by year
• Continued increased requirements in legislation and regulations around
the globe related to information/cyber security and privacy
OAIC (2023). Notifiable Data Breaches Report Jul-Dec 2022

6. Overview (continued)
• Organised crime
• State sponsored
• Hacktivists
• Terrorists
• Individual hackers
• Malicious insiders
• Accidental insiders
Verizon (2022). Data Breach Incident Report
82%
Human Element

7. Overview (continued)
Mandiant (2023). M-Trends
Global Average Dwell Time

8. Taking a risk-based approach to cyber defence

9. What is risk?
Risk is:
• (the) “effect of uncertainty on objectives”. – ISO 31000
• “The possibility that the occurrence of an event will adversely affect
the achievement of the organization's objectives.” – Stanford University
• “The possibility of something bad happening” - Cambridge

10. Risk can be positive too!
Positive versus Negative risk.
• A positive risk has a positive impact on your objectives.

11. Positive versus Negative Risk
• A data breach occurs, which results in reputational damage
• Outsourcing a critical service, which results in improved uptime

12. Assessing & Calculating Risk
• Qualitative vs quantitative risk
• High, Medium, Low, etc.
• ALE = SLE * ARO
• SLE = AV * EF

13. Risk Appetite, Risk Tolerance, Risk Threshold
• Risk Appetite – used to describe the level of risk taking that is
acceptable
• Risk Tolerance – set of boundaries and variation
• Risk Threshold – limit where risk will not be accepted if exceeded

14. Risk Frameworks (Examples)
• ISO 31000
• ISO 27005
• NIST 800-37

15. ISO 31000:2018
• Risk management - guidelines
• Broad and can be used to manage applied across any organisation
• Provides both framework and guidance on processes to manage risk

16. ISO 27005:2022
• Information security, cybersecurity and privacy protection —
Guidance on managing information security risks
• Follow the same structure as other ISO standards/documents
• Provides guidance on managing risk in the context of information
security

17. NIST 800-37 r2
• Risk management framework for Information systems and
organisations
• Describes the NIST risk management framework (RMF)
• Used to manage security and privacy risk
• Free!

18. Building a cyber defence strategy

19. Treating risk…
• You’ve done the risk assessment – now what?

20. Scope…
• Identify the scope of the cyber defence program
• What are the high value assets? (the risk assessment should help with
that and the one below!)
• What is likely to be exploited?

21. Key Elements of a Cyber Defence Strategy
• Gap Analysis
• Security Controls
• Awareness & Culture
• Data Management
• Monitoring & Measurement
• Continual Improvement

22. Security Controls
• Technical & Administrative controls
• Designed to mitigate (and reduce) identified risk
• Can be costly, so it’s important to ensure that the most appropriate
controls have been selected that provide the greatest benefit

23. Awareness & Culture
• 82% of data breaches involved a human element (Verizon, 2022)
• Security controls can only go so far, people are the last line of defence

24. Data Management
• Do you know where your data is?
• Do you know what your data is?
• Is it subject to any legal, regulatory, or contractual obligations?
• How is it currently protected?

25. Monitoring & Measurement
• Are you monitoring your environment?
• Is your monitoring centralised and adequately protected?
• Are you monitoring your security posture?
• What measures are needed to demonstrate effectiveness and ROI?

26. Continual Improvement
• It’s not over…

27. About Me
• 20+ years industry experience
• DInfoTech, MMgmt(InfoTech), BInfoTech(SysAdmin)
• CCISO, CDPSE, CISM, CISSP, GRCA, GRCP, ISO27001
Lead Auditor/ Implementer, MACS Snr. CP (Cyber
Security)
• ACS Profession Advisory Board Member
linkedin.com/in/georgthomas
scholar.google.com/citations?user=z72s_9MAAAAJ

28. Questions?

29. References
• Cambridge Dictionary (2023). Risk. Retrieved from:
https://dictionary.cambridge.org/dictionary/english/risk
• Mandiant (2023). M-Trends 2023 – Cyber Security Insights from the Frontlines.
Retrieved from: https://www.mandiant.com/resources/blog/m-trends-2023
• OAIC (2023). Notifiable Data Breaches Report Jul-Dec 2022. Retrieved from:
https://www.oaic.gov.au/privacy/notifiable-data-breaches/notifiable-data-
breaches-publications/notifiable-data-breaches-report-july-to-december-2022
• Stanford University (n.d.). Definition of Risk. Retrieved from:
https://ocro.stanford.edu/erm/key-definitions/definition-risk
• Verizon (2022). Data Breach Incident Report. Retrieved from:
https://www.verizon.com/business/resources/reports/dbir/