Jisc cyber security posture survey
•Download as PPTX, PDF•
1 like•4,714 views
Part of the 'Swimming with sharks - don't be phish food' session at Digifest 2019.
Recommended
Recommended
More Related Content
What's hot
What's hot (7)
Similar to Jisc cyber security posture survey
Similar to Jisc cyber security posture survey (20)
More from Jisc
More from Jisc (20)
Recently uploaded
Recently uploaded (20)
Jisc cyber security posture survey
- 1. © 2018 Khipu Networks Limited. All Rights Reserved. JISC CYBER SECURITY POSTURE SURVEY 2018 Next-Generation Networking and Advanced Cyber Security GOAL: ZERO VULNERABILITY INFRASTRUCTURE
- 2. www.khipu-networks.com © 2017 Khipu Networks Limited. All Rights Reserved. • Founded in 2005 & privately owned • Identified the need for secure network access “BYOD” • UK/I, SA & international coverage INTERNATIONAL CYBER SECURITY COMPANY • Round the clock network & security operation services • Pro-active support “KARMA” & managed services • Project, service delivery & account management teams OUTSTANDING CUSTOMER SATISFACTION • Customer references across all sectors • Year on year growth • Over 500 customers globally PROVEN BUSINESS • Quality assured: ISO9001, 27001, 14011 & OHSA 18001 • Highest partner, support & technical accreditations • Extensive investment in training & development CERTIFIED TO DELIVER Who We Are? Next-Generation Networking and Cyber Security
- 3. www.khipu-networks.com © 2017 Khipu Networks Limited. All Rights Reserved. Real-life statistics Cyber Attacks - Reduce Your Risk 60% 21% 85% 66% 25% Increase in phishing attacks Emails get through spam filters Have suffered a phishing attack Have suffered a spear-phishing attack Have been successfully phished Q4 2017 Q3 2018 240%increase 300,000 150,000 0 New phishing websites The number one vehicle for ransomware attacks & malware Phishing attacks The most effective way to deliver malware Email attachments The 3rd most effective way to deliver malware Email web-links OPENED 30%
- 4. www.khipu-networks.com © 2017 Khipu Networks Limited. All Rights Reserved. Endpoints PC’s, Laptops, Mobile & BYOD Applications Email, CRM, office, SaaS & specific apps Infrastructure Network, security & systems User Staff, Visitors & Contractors Typical Environment Cyber Attacks - Reduce Your Risk Financial Loss Confidential Data leakage (personal & business) Crippled IT systems & operations Damage to reputation - blacklisting, bad press Fines from ICO COMPLETE DISRUPTION TO YOUR ORGANISATION Accountability, stress & frustration
- 5. www.khipu-networks.com © 2017 Khipu Networks Limited. All Rights Reserved. In the press Cyber Attacks - Reduce Your Risk SPEAR PHISHING ATTACK
- 6. www.khipu-networks.com © 2017 Khipu Networks Limited. All Rights Reserved. Phishing Vulnerability Risk Assessment Cyber Attacks - Reduce Your Risk USERS • Do they open phishing emails, how many? • Do they share confidential information via a website, how many? IDENTIFY YOUR VULNERABILITIES TO PHISHING ATTACKS - “RISK FACTOR” INFRASTRUCTURE • Are email systems, spam, firewalls identifying & blocking phishing attacks? • Are they capable of or been configured properly to protect your organisation? PROCESSES • How does the organisation (users, IT helpdesk teams etc) react? • Are your processes including awareness inductions effective? DEVICES • What operating systems and web browsers (incl. plug-ins) are being used? • Are they sanctioned by your organisation, are they up to date, are they vulnerable? LAYER OF DEFENCE FIRST LAST USERS
- 7. www.khipu-networks.com © 2017 Khipu Networks Limited. All Rights Reserved. Simulated Phishing Services Cyber Attacks - Reduce Your Risk EMAILS • Customised to meet customer requirements & scenarios • Link to phishing website • Download an attachment (PDF, .doc, .xl etc) WEBSITE • Customised web pages incl. domain, intranet, website • Capture different types of information to test users • Drive-by attack (BEEF) OPTIONS • SMS (smishing) attack: Personal or business details • USB malware attack • Ransomware simulation • Vishing (social engineering)* DEDICATED SERVICE DELIVERY TEAM Project management Cyber security specialists Account managers
- 8. www.khipu-networks.com © 2017 Khipu Networks Limited. All Rights Reserved. Awareness Training Services Cyber Attacks - Reduce Your Risk EMAILS • The simulation; why, the risks, what to do (customisable) • Link to education awareness landing page WEBSITE & CONTENT • Customisable education page to raise awareness • What is phishing, what to do, top tips, video, quizzes (recorded) • Facts, statistics, glossaries, Infographics, how to protect • Video awareness library (incl. customised video) TRAINING “CYBER SECURITY 101” • Classroom-based: Work & home life phishing & CS awareness • Onsite (no limitation to attendees), offsite or virtual* • Cyber security best practise workshops (onsite) DEDICATED SERVICE DELIVERY TEAM Project management Cyber security specialists Account managers
- 9. www.khipu-networks.com © 2017 Khipu Networks Limited. All Rights Reserved. Awareness Training Services Cyber Attacks - Reduce Your Risk DEDICATED SERVICE DELIVERY TEAM Project management Cyber security specialists Account managers EMAILS • The simulation; why, the risks, what to do etc (customisable) • Link to education awareness landing page WEBSITE & CONTENT • Customisable education page to raise awareness • What is phishing, what to do, top tips, video, quizzes (recorded) • Facts, statistics, glossaries, Infographics, how to protect • Video awareness library (incl. customised video) TRAINING “CYBER SECURITY 101” • Classroom-based: Work & home life phishing & CS awareness • Onsite (no limitation to attendees), offsite or virtual* • Cyber security best practise workshops (onsite)
- 10. www.khipu-networks.com © 2017 Khipu Networks Limited. All Rights Reserved. Reporting Services Stats Cyber Attacks - Reduce Your Risk
- 11. © 2018 Khipu Networks Limited. All Rights Reserved. Some of what you’ll learn in the Classroom Training: 3 Key Take Aways Cyber Attacks - Reduce Your Risk • How Do You Know It’s a Scam? • Social Media – Friend or Foe? • Building a Better Password
- 12. © 2018 Khipu Networks Limited. All Rights Reserved. Sophisticated Real-life Phishing Attacks Cyber Attacks - Reduce Your Risk
- 13. © 2018 Khipu Networks Limited. All Rights Reserved. If it’s too good to be true… Cyber Attacks - Reduce Your Risk
- 14. © 2018 Khipu Networks Limited. All Rights Reserved. A whole country could be a target Cyber Attacks - Reduce Your Risk
- 15. © 2018 Khipu Networks Limited. All Rights Reserved. They’re not just target email accounts… Cyber Attacks - Reduce Your Risk
- 16. © 2018 Khipu Networks Limited. All Rights Reserved. So, How do you know? Cyber Attacks - Reduce Your Risk •Check the To: & From: Fields •Attachments: Always suspicious •Grammer and Speling not quiet right •Aggressive or threatening in nature Grammar and Spelling not quite right
- 17. © 2018 Khipu Networks Limited. All Rights Reserved. Would You Click on This? Cyber Attacks - Reduce Your Risk Who is it From:? Who is it To:? Suspicious Attachment? Grammar, Spelling, Threatening
- 18. © 2018 Khipu Networks Limited. All Rights Reserved. Social Media – Friend or Foe? Cyber Attacks - Reduce Your Risk Social Media = Think Before you Post Does it reveal personal data? Will it hurt you or your family? Will it hurt your career? Will it trigger a negative reaction?
- 19. © 2018 Khipu Networks Limited. All Rights Reserved. Social Media – Friend or Foe? Cyber Attacks - Reduce Your Risk Staying Safe Guidelines Don't reveal too much Be careful of those self revealing games / quizzes Review your Privacy Settings (Especially after updates) Be careful what you click on. (Do a search instead)
- 20. © 2018 Khipu Networks Limited. All Rights Reserved. Building a Better Password Cyber Attacks - Reduce Your Risk BIGGER is better!
- 21. © 2018 Khipu Networks Limited. All Rights Reserved. Building a Better Password Cyber Attacks - Reduce Your Risk Create a complex password from a phase: • String TWO or THREE words together (sleepingbeautyisgreat) (S133p!ngB34uTy1sGr3at) Use a favourite phrase, quote or line from a song (e.g. “My very eager mother just served us nine pizzas!!”) My=Mercury, Very=Venus, Eager=Earth, Mother=Mars, Just=Jupiter, Served=Saturn Us=Uranus, Nine=Neptune, Pizzas=Pluto MyV3mjsu9P!!
- 22. © 2018 Khipu Networks Limited. All Rights Reserved. Building a Better Password Cyber Attacks - Reduce Your Risk CRACKING PASSWORDS: (123456) (MyV3mjsu9P!!) (sleepingbeautyisgreat) (S133p!ngB34uTy1sGr3at)
- 23. © 2018 Khipu Networks Limited. All Rights Reserved. Final Thoughts on Passwords Cyber Attacks - Reduce Your Risk
- 24. www.khipu-networks.com © 2017 Khipu Networks Limited. All Rights Reserved. KHIPU are competent trainers, who kept the audience attentive and interested. The content was pitched at a relevant level and had more than enough ‘food for thought’. The feedback that I had from the attendees was very positive and all felt the course worthwhile. As an employer, I also feel that this education will really help reduce the risk of an employee inadvertently compromising our network and they can no longer say that no-one told us. Very highly recommended. Chris Adcock Chief Finance Officer - Duchy of Lancaster TESTINOMIAL
- 25. www.khipu-networks.com © 2017 Khipu Networks Limited. All Rights Reserved. THANKS FOR LISTENING HAPPY TO TAKE YOUR QUESTIONS imai@khipu-networks.com @KhipuNetworks Khipu Networks www.khipu-networks.com
Editor's Notes
- Cyber Risk Service: Network visibility Goal: To understand your cyber security posture by identifying all applications including malware, their usage and risk, and ways hackers are attempting to breach your network Focus: Analyse network traffic to identify all activity, its risk and what cyber-attacks your current perimeter security systems are missing Outcome: Security Lifecycle Review that provides a complete picture of all applications and attacks on your network with key focus areas to help increase security. Recommendations for: Next-Gen Security - Visibility and control users, content and threats Perimeter security ‘Best Practice Assessment’ services Cyber Risk Service: Prevention Posture Assessment Goal: To have a consultative discussion about Risk/Threat Prevention across your entire architecture and define a direction toward achieving an expected result Focus: An interactive questionnaire that assesses the capabilities currently enabled in each area of your network in relation to the cyberattack lifecycle Outcome: Findings and Recommendation report across entire infrastructure, with a strategic alignment and shared vision between your organisation and KHIPU
- Then along comes an email with an attachment or link to a website The most simple attack method - just one-click and… Someone opens the attachment - malware / ransomware is injected into the network Or, the user goes to the URL, entering information which an attacker can then use to access the network - compromising your business. - financial loss, data leakage, reputational damage and even fines from the ICO. ARROWS / CROSSES destroying the network etc all businesses must implement pro-active prevention measures to protect against cyber-attacks that can result in financial loss,
- what the services does (as below) - what we can offer: Simulations, awareness and onsite training plus Value add + reporting service does: User Vulnerability Risk Assessment & Awareness Training – Identify your risk to phishing attacks The service identifies the ‘risk factor’ and how vulnerable the organisation is to phishing attacks: Users: Do they open phishing emails and how many could be compromised by providing information. Infrastructure: Are email systems, spam filters, firewalls etc configured correctly or capable of protecting against a phishing attack? Processes: How do users / IT helpdesk departments etc react to phishing emails? Devices: What operating systems, web browsers and plug-ins are being used, are they vulnerable? Prevention report: Highlighting “what is the risk” with best practice recommendations including training plans, solutions and services for on-going prevention and to reduce the risk of being compromised. Cyber Security Awareness Training: To educate the users on phishing; the risks, impact, how to identify and what to do (see below CSAT). KHIPU’s vulnerability assessment services enable organisations to understand their risks to cyber-attacks by highlighting the critical areas where they are vulnerable and could be compromised. Once the vulnerabilities are known, a best-practice approach to cyber security with recommendations for both on-going protection and future prevention can then be provided to reduce the exposure of a cyber-attack, mitigate the risk and simplify your cyber security strategy.
- • Assign a dedicated delivery team which includes; Project co-ordinator: To liaise with the customer on the SoW process, resources (for testing and approvals) and scheduling / logistics for the phishing campaigns and awareness training services. Cyber security team: For the design, testing and implementation of the simulated phishing campaign and awareness training service including: • Type of simulated phishing attack • Type of awareness training • Phishing email with a link to a website to capture information • Phishing website to capture information • Phishing email attachment document • Awareness emails • Awareness Training Landing page • “Cyber Security 101” classroom training (if purchased) They are also responsible for providing: • Best practise recommendations to the customers cyber security environment post the campaign. If required, assist with the implementation of the recommendations should the customer request this. • Plans for on-going phishing campaigns and training services based upon the results from previous campaigns. • Customer report detailing the entire campaign, results and the above points. •“Cyber Security 101” classroom training: This has been most effective in improving user’s awareness of phishing emails and is constantly being adapted to improve results. The 1.5 hour sessions, that can be hosted onsite, at our training centre and soon to be virtually / remotely (launch date Q2 2017), have the following agenda to support the simulated phishing campaigns based around work and home life. As customers have different requirements for classroom training as well as the logistics involved (e.g. co-ordinating attendees, availability etc) this service is quoted separately as an option. - Cybersecurity 101 – Video - Responsibility for Information - What is Phishing? - Phishing Facts; Real life attacks and threats to your personal and work life - Detecting and Avoiding; Phishing examples - Phishing DO’s & DON’Ts - Questions & Answers - Short Break - Cybersecurity Awareness Quiz service does: User Vulnerability Risk Assessment & Awareness Training – Identify your risk to phishing attacks The service identifies the ‘risk factor’ and how vulnerable the organisation is to phishing attacks: Users: Do they open phishing emails and how many could be compromised by providing information. Infrastructure: Are email systems, spam filters, firewalls etc configured correctly or capable of protecting against a phishing attack? Processes: How do users / IT helpdesk departments etc react to phishing emails? Devices: What operating systems, web browsers and plug-ins are being used, are they vulnerable? Prevention report: Highlighting “what is the risk” with best practice recommendations including training plans, solutions and services for on-going prevention and to reduce the risk of being compromised. Cyber Security Awareness Training: To educate the users on phishing; the risks, impact, how to identify and what to do (see below CSAT). KHIPU’s vulnerability assessment services enable organisations to understand their risks to cyber-attacks by highlighting the critical areas where they are vulnerable and could be compromised. Once the vulnerabilities are known, a best-practice approach to cyber security with recommendations for both on-going protection and future prevention can then be provided to reduce the exposure of a cyber-attack, mitigate the risk and simplify your cyber security strategy.
- • Assign a dedicated delivery team which includes; Project co-ordinator: To liaise with the customer on the SoW process, resources (for testing and approvals) and scheduling / logistics for the phishing campaigns and awareness training services. Cyber security team: For the design, testing and implementation of the simulated phishing campaign and awareness training service including: • Type of simulated phishing attack • Type of awareness training • Phishing email with a link to a website to capture information • Phishing website to capture information • Phishing email attachment document • Awareness emails • Awareness Training Landing page • “Cyber Security 101” classroom training (if purchased) They are also responsible for providing: • Best practise recommendations to the customers cyber security environment post the campaign. If required, assist with the implementation of the recommendations should the customer request this. • Plans for on-going phishing campaigns and training services based upon the results from previous campaigns. • Customer report detailing the entire campaign, results and the above points. •“Cyber Security 101” classroom training: This has been most effective in improving user’s awareness of phishing emails and is constantly being adapted to improve results. The 1.5 hour sessions, that can be hosted onsite, at our training centre and soon to be virtually / remotely (launch date Q2 2017), have the following agenda to support the simulated phishing campaigns based around work and home life. As customers have different requirements for classroom training as well as the logistics involved (e.g. co-ordinating attendees, availability etc) this service is quoted separately as an option. - Cybersecurity 101 – Video - Responsibility for Information - What is Phishing? - Phishing Facts; Real life attacks and threats to your personal and work life - Detecting and Avoiding; Phishing examples - Phishing DO’s & DON’Ts - Questions & Answers - Short Break - Cybersecurity Awareness Quiz service does: User Vulnerability Risk Assessment & Awareness Training – Identify your risk to phishing attacks The service identifies the ‘risk factor’ and how vulnerable the organisation is to phishing attacks: Users: Do they open phishing emails and how many could be compromised by providing information. Infrastructure: Are email systems, spam filters, firewalls etc configured correctly or capable of protecting against a phishing attack? Processes: How do users / IT helpdesk departments etc react to phishing emails? Devices: What operating systems, web browsers and plug-ins are being used, are they vulnerable? Prevention report: Highlighting “what is the risk” with best practice recommendations including training plans, solutions and services for on-going prevention and to reduce the risk of being compromised. Cyber Security Awareness Training: To educate the users on phishing; the risks, impact, how to identify and what to do (see below CSAT). KHIPU’s vulnerability assessment services enable organisations to understand their risks to cyber-attacks by highlighting the critical areas where they are vulnerable and could be compromised. Once the vulnerabilities are known, a best-practice approach to cyber security with recommendations for both on-going protection and future prevention can then be provided to reduce the exposure of a cyber-attack, mitigate the risk and simplify your cyber security strategy.
- • Assign a dedicated delivery team which includes; Project co-ordinator: To liaise with the customer on the SoW process, resources (for testing and approvals) and scheduling / logistics for the phishing campaigns and awareness training services. Cyber security team: For the design, testing and implementation of the simulated phishing campaign and awareness training service including: • Type of simulated phishing attack • Type of awareness training • Phishing email with a link to a website to capture information • Phishing website to capture information • Phishing email attachment document • Awareness emails • Awareness Training Landing page • “Cyber Security 101” classroom training (if purchased) They are also responsible for providing: • Best practise recommendations to the customers cyber security environment post the campaign. If required, assist with the implementation of the recommendations should the customer request this. • Plans for on-going phishing campaigns and training services based upon the results from previous campaigns. • Customer report detailing the entire campaign, results and the above points. •“Cyber Security 101” classroom training: This has been most effective in improving user’s awareness of phishing emails and is constantly being adapted to improve results. The 1.5 hour sessions, that can be hosted onsite, at our training centre and soon to be virtually / remotely (launch date Q2 2017), have the following agenda to support the simulated phishing campaigns based around work and home life. As customers have different requirements for classroom training as well as the logistics involved (e.g. co-ordinating attendees, availability etc) this service is quoted separately as an option. - Cybersecurity 101 – Video - Responsibility for Information - What is Phishing? - Phishing Facts; Real life attacks and threats to your personal and work life - Detecting and Avoiding; Phishing examples - Phishing DO’s & DON’Ts - Questions & Answers - Short Break - Cybersecurity Awareness Quiz service does: User Vulnerability Risk Assessment & Awareness Training – Identify your risk to phishing attacks The service identifies the ‘risk factor’ and how vulnerable the organisation is to phishing attacks: Users: Do they open phishing emails and how many could be compromised by providing information. Infrastructure: Are email systems, spam filters, firewalls etc configured correctly or capable of protecting against a phishing attack? Processes: How do users / IT helpdesk departments etc react to phishing emails? Devices: What operating systems, web browsers and plug-ins are being used, are they vulnerable? Prevention report: Highlighting “what is the risk” with best practice recommendations including training plans, solutions and services for on-going prevention and to reduce the risk of being compromised. Cyber Security Awareness Training: To educate the users on phishing; the risks, impact, how to identify and what to do (see below CSAT). KHIPU’s vulnerability assessment services enable organisations to understand their risks to cyber-attacks by highlighting the critical areas where they are vulnerable and could be compromised. Once the vulnerabilities are known, a best-practice approach to cyber security with recommendations for both on-going protection and future prevention can then be provided to reduce the exposure of a cyber-attack, mitigate the risk and simplify your cyber security strategy.
- Conclusion This section provides a detailed conclusion of the simulated campaign conducted including: • Explanation and interpretation of the results including ‘risk-factor’ • Observations from the phishing campaign and awareness training • Best practise recommendations: - Password management - Further (targeted) campaigns and supporting awareness training components - Awareness training plan - Perimeter security: Optimised configuration of the customers’ existing environment to protect against phishing attacks with options for replacement and complementary technologies. - Next stages; a plan for the short and long term simulated phishing campaigns (including targeted) and awareness training. - A best-practise cyber security workshop review (optional)
- In an ideal world… Your extensive investment into your environment should identify and protect against such cyber attacks Infrastructure: Should Identify and block emails and malware coming in, see unknown applications running on the network Endpoint: AV should identify and block malware at the device level and finally your Users: Should be trained to not open suspicious emails “don’t worry about it - we are protected” In an ideal world… but we do not live in one unfortunately all businesses must implement pro-active prevention measures to protect against cyber-attacks that can result in financial loss,
- In an ideal world… Your extensive investment into your environment should identify and protect against such cyber attacks Infrastructure: Should Identify and block emails and malware coming in, see unknown applications running on the network Endpoint: AV should identify and block malware at the device level and finally your Users: Should be trained to not open suspicious emails “don’t worry about it - we are protected” In an ideal world… but we do not live in one unfortunately all businesses must implement pro-active prevention measures to protect against cyber-attacks that can result in financial loss,
- In an ideal world… Your extensive investment into your environment should identify and protect against such cyber attacks Infrastructure: Should Identify and block emails and malware coming in, see unknown applications running on the network Endpoint: AV should identify and block malware at the device level and finally your Users: Should be trained to not open suspicious emails “don’t worry about it - we are protected” In an ideal world… but we do not live in one unfortunately all businesses must implement pro-active prevention measures to protect against cyber-attacks that can result in financial loss,
- In an ideal world… Your extensive investment into your environment should identify and protect against such cyber attacks Infrastructure: Should Identify and block emails and malware coming in, see unknown applications running on the network Endpoint: AV should identify and block malware at the device level and finally your Users: Should be trained to not open suspicious emails “don’t worry about it - we are protected” In an ideal world… but we do not live in one unfortunately all businesses must implement pro-active prevention measures to protect against cyber-attacks that can result in financial loss,
- Users – your last form of defence” “Student and staff education is vital in the defence against ransomware” “We often look but seldom see”