According to the Association of Certified Fraud Examiners, fraud costs organizations an average of 5% of annual revenue, and a single incident costs $150,000 on average. But compliance penalties are often much more costly, running in the millions, and that doesn’t count secondary costs like lost business, lawsuits, bad publicity and professional censure. During this webinar we’ll discuss the best practices and services you should expect from your cloud hosting provider, and how cyber security, application security and regulatory compliance are integrated practices that must come together to support a comprehensive corporate security posture.

1. Confidential
3 Things You Need to Know
About Compliant Cloud Hosting
Presented by Symmetry & Alchemy Security
©2016 Symmetry

2. Confidential
Introducing Our Presenters
©2016 Symmetry
§ Alchemy Security
§ Holistic security solutions built upon SIEM & Security Operations
§ Business-centric approach to information security and risk management
§ Managed & Monitored SIEM through virtual SOC
§ Nationwide experience and reach
§ Complete end-to-end Services
§ Symmetry
§ Leading applications management and hybrid cloud hosting solution provider
§ Deep expertise in SAP application management
§ SAP Certified in Hosting Services, Cloud Services, SAP HANA® Operations Services
§ We operate as a true extension of your IT team
§ Highly flexible, tailored solutions to meet the unique business needs of enterprise clientsScott Goolik
VP of Compliance & Security
Joe Bonnell
Founder & CEO

3. Confidential
Agenda
©2016 Symmetry
§ Why Invest In Security & Compliance Programs
§ Compliance Frameworks & Risk Management
§ Three Pillars of Risk Management
§ Key Requirements for Compliant Hosting

4. Confidential
Data Breach Cost Analysis
©2016 Symmetry
§ $2.1T – Global Cybercrime Economic Costs Forecasted by 2019, Juniper Research
§ United States Breach Loss Statistics*
§ $7M - Average Total Cost of Data Breach
§ $221 – Average Cost Per Record Lost or Stolen (Direct & Indirect Costs)
§ 10,000 records lost ~ $2.21M or 100,000 records lost ~ $22.1M
§ Investments in Security Monitoring and Encryption can vastly reduce cost of data breach
§ Examples of stolen data:
§ Personally Identifiable Information
§ Credit Card Data
§ Electronic Patient Information
§ Intellectual Property
§ $$$ - Fraud
*IBM – 2016 Cost of Data Breach Study: United States

5. Confidential
Attacker Motivations
©2016 Symmetry
*2016 Verizon Business Data Breach Investigations Report
Type of Account Stolen
(US)
Black Market Value
(Per Record)
Banking $40 - $500
Credit Card $7 - $40
Corporate Email $500
Personal Identity
Details
$15 - $65
Airline Points $60 - $450
Hotel Points $20 - $200
Intellectual Property ??

6. Confidential
Breach Analysis
©2016 Symmetry
*2016 Verizon Business Data Breach Investigations Report

7. Confidential
Cost of PCI Compliance Failures
©2016 Symmetry
VISA Fines: Storing “Prohibited” Data*
Merchant Level 1-3 Months 3-6 Months 7+ Months
Level 1 $10,000 p/m $50,000 p/m $100,000 p/m
Level 2 $5,000 p/m $25,000 p/m $50,000 p/m
Visa Fines: PCI Non-Compliance Fee Schedule*
1st violation of specific compliance failure $1,000 fine
2nd violation of same compliance failure $5,000 fine
3rd violation of same compliance failure $10,000 fine
4th violation of same compliance failure $25,000 fine
5th+ violation of same compliance failure Up to Visa – inability to process credit cards
Note: There are 250+ unique compliance requirements
*Interlink Network Inc. Operating Regulations

8. Confidential
Cost of HIPAA Compliance Failures
©2016 Symmetry
HIPAA Violation Minimum Penalty Maximum Penalty
Category 1 - Individual did not know (and by
exercising reasonable diligence would not
have known) that he/she violated HIPAA
$100 per violation, with an annual maximum of
$25,000 for repeat violations
$50,000 per violation, with an
annual maximum of $1.5 million
Category 2 - HIPAA violation due to
reasonable cause and not due to willful
neglect
$1,000 per violation, with an annual maximum
of $100,000 for repeat violations
$50,000 per violation, with an
annual maximum of $1.5 million
Category 3 - HIPAA violation due to willful
neglect but violation is corrected within the
required time period
$10,000 per violation, with an annual maximum
of $250,000 for repeat violations
50,000 per violation, with an
annual maximum of $1.5 million
Category 4 - HIPAA violation is due to willful
neglect and is not corrected
$50,000 per violation, with an annual maximum
of $1.5 million
$50,000 per violation, with an
annual maximum of $1.5 million
Criminal Penalties Covered entities and specified individuals
whom "knowingly" obtain or disclose
individually identifiable health information,
offenses committed under false pretenses, or
offenses with intent to sell, transfer, or use
ePHI for personal gain or malicious harm.
$50,000 to $250,000 fines, and up
to one to ten years imprisonment

9. Confidential
Effective Risk Management = Compliance Success
©2016 Symmetry

10. Confidential
Risk/Compliance Management
©2016 Symmetry
§ Risk = Threat * Vulnerability * Impact
§ ergo – any zero value results in zero risk
§ Impact Examples
§ Crown Jewel Information Assets > Low Value Systems
§ Threat Examples
§ Hacking, Malware, Malicious Employees, Fraudsters, etc.
§ Vulnerability Examples
§ Unpatched Operating Systems (buffer overflow), Web Application
Vulnerabilities (sql injection), Poorly implemented application access
controls, etc

11. Confidential
Impact Management
©2016 Symmetry
§ Robust Asset Management Program
§ Properly identifies & classifies systems with respect to the CIA Triad:
§ Confidentiality
▫ Is information stored, process or transmitted through the system considered to be confidential in nature?
§ Integrity
▫ What would be the organizational impact if data was compromised?
§ Availability
▫ If system is offline, what is the impact to the business?
§ Any system that characterizes any portion of the CIA triad as “critical” results in a critical rating
for the system
§ Migrate Critical systems into highly protected and monitored security enclaves
§ Be able to define “normal” system behavior
§ Recognizing High Risk Systems Require Stringent Security Measures

12. Confidential
Vulnerability Management
©2016 Symmetry
§ Identifying
§ Periodic Vulnerability Scanning
§ Priodic Penetration Testing
§ Network/OS Layer & Application Layer
§ Social Engineering (Phishing campaigns, etc)
§ SAP Risk Analysis with ControlPanelGRC
§ Segregation of Duties (SoD), Critical Transactions, Sensitive Authorizations
§ Protecting
§ Compliant Provisioning with
§ Stay clean by checking for SoD risks as part of the request process
§ Operations Governed by a Quality Program
§ Managed training ensures employees understand processes
§ Installation Qualifications (IQs) verify systems are built to specifications
§ Managed Patching

13. Confidential
Threat Management
©2016 Symmetry
§ Identifying & Detecting:
§ Network and Endpoint Security Monitoring
§ NGFWs, Anti-malware, File Integrity Monitoring, HIDS, etc
§ Security Information Event Management (SIEM)
§ Threat Analysis
§ Protecting
§ Palo Alto NGFW
§ Firewall, 2-factor authorization, IDS/IPS, Web filtering, malware detonation, etc.
§ Robust Security Architecture - Network Segmentation
§ Anti-malware solutions
§ Data Encryption (in transit and at rest)

14. Confidential
Key Requirements for Compliant Hosting
©2016 Symmetry
§ Robust Security Controls = Strong Compliance Programs
§ Most compliance requirements are well defined, but organizations often fail
audits due to poor implementation of ongoing processes & procedures,
competing resources, internal politics, and other factors
§ Compliant hosting solutions must include a holistic approach to Compliance
requirements that:
§ Provides ability to migrate critical systems to highly protected security enclaves
§ Identifies areas of risk and vulnerability
§ Provides solutions that mitigate risks and vulnerabilities
§ Provides the heavy lifting for more complex security problems such as Network and
Endpoint Security Monitoring, Penetration Testing, Next Generation Firewall Management,
Vulnerability Scanning, SAP Security Controls, etc
§ Supports Internal process & procedures through robust reporting

15. Confidential
EXPERT Q&A
©2016 Symmetry

16. Confidential
THANK YOU
©2016 Symmetry
Follow Us on @Symmetry_Corp & @AlchemySec
to Keep in Touch & Learn Even More