Recommended
Recommended
More Related Content
What's hot
What's hot (19)
Similar to Jessica Hebenstreit - Don't Try This At Home! (Things Not To Do When Securing An Organization)
Similar to Jessica Hebenstreit - Don't Try This At Home! (Things Not To Do When Securing An Organization) (20)
More from centralohioissa
More from centralohioissa (20)
Recently uploaded
Recently uploaded (20)
Jessica Hebenstreit - Don't Try This At Home! (Things Not To Do When Securing An Organization)
- 1. Don’t Try This at Home!!! RECURRING THEMES FROM TRYING TO SECURING AN ORGANIZATION
- 2. Jessica Hebenstreit CISSP | CRISC | GCIH | GNFA @secitup |Jessica@Dehnert.us | www.linkedin.com/in/jessicahebenstreit
- 3. A Little About Me 16 years in security Multiple verticals Lover of memes What more do you need to know? I Love Memes More Than Kanye Loves Kanye
- 4. Topics But First! WHY? Recurring Themes TIL: Today I Learned And now….a fun video! Q & A
- 5. But First! Why? Those who don’t learn from history are doomed to repeat it Common themes in shared war stories Common themes across verticals
- 6. Recurring Themes The Right / Wrong game Secure at All Costs Tools “Save us Tool-wan Kenobi” Policy Won’t Save You Either Eating Our Young Skipping The Basics
- 7. The Right / Wrong game The “wrong” game to play It’s like arguing on the Internet Not about winning or being right Know when to back down Remember it’s about informing about risk and options You don’t have to like it (It’s not a Facebook post)
- 8. Secure at All Costs Old School Security Mentality Relates to Right/Wrong game It goes back to Risk and business tolerance
- 9. Save Us Tool-wan Kenobi You must PAY ATTENTION to the tools It’s called logging AND MONITORING You must invest in your people Continuously You must have proper procedures in place You must have policies to back you up
- 10. Policy Won’t Save You Either Must be enforceable Must be enforced Must have teeth Must be supported by and from Leadership A “policy” that does not meet the above is not a policy
- 11. Eating Our Young It’s getting better, buuuuuuut… We should be encouraging and welcoming Critical shortage of info sec professionals Women…
- 12. Skipping the Basics Innovation and pushing the envelope is great but… It doesn’t matter if you don’t have basics* in place Software and Hardware Inventory Secure Configurations (Hardening standards and guidelines) Vulnerability Management process Controlled use of Administrative Access * The first 5 SANS Critical Controls
- 13. This and That Assuming compliance is enough Losing sight of the big picture Proper Risk Classification Not everything is highest risk or most critical Properly remediating systems Just reimage it already More on this in a moment
- 14. TIL: Today I Learned It’s not about being right or wrong Do the right thing for the business Balance Risk and Security Tools won’t save you but neither will policy Start with the basics and go from there Support and grow fledgling security professionals
- 15. And now… TIME FOR A FUN VIDEO
- 16. REMOVED DUE TO SIZE – CONTACT JESSICA IF YOU ARE INTERESTED IN SEEING IT
- 17. One Last Thing… Equal Respect Initiative Executive Women’s Forum
- 18. THANK YOU!
- 19. QUESTIONS?
Editor's Notes
- It’s about informing the appropriate business leaders to the risks and the options. Rely on the DREAMR framework letters E and A to reinforce. Our jobs are to explain risk, offer options and opinions and ultimately execute the business decision (even if we don’t agree or like it)
- It doesn’t work Negatively impacts the business Controls will be circumvented
- 1st – apologize for crossing the meme theme streams