Managing Cyber Security Across the Enterprise

1. @NTXISSA #NTXISSACSC3
Managing Cyber Security Across the Enterprise
Asif Effendi
September 3, 2015
austinssi

2. @NTXISSA #NTXISSACSC3
Slide 2
Managing Cyber Security Across the Enterprise
Oil and Gas Threat Landscape
Challenges in Securing Control Systems
Cyber Security Strategies
Conclusion
Managing Cyber Security Across the Enterprise
Highlights:

3. @NTXISSA #NTXISSACSC3
Slide 3
Managing Cyber Security Across the Enterprise
Threat Landscape

4. @NTXISSA #NTXISSACSC3
Slide 4
Managing Cyber Security Across the Enterprise
Threat Landscape
76%
5%
19%
0%
10%
20%
30%
40%
50%
60%
70%
80%
Yes No Unsure
Increase in Sophistication of Attacks Against
Infrastructure
(2015 Report of Organization of American States)
Yes
No
Unsure
Increase in sophistication of cyber attacks

5. @NTXISSA #NTXISSACSC3
Largest sector of cyber incidents is Energy industry
Slide 5
Managing Cyber Security Across the Enterprise
Energy, 53%
Government, 2%
Info Tech, 4%
Nuclear, 3%
Postal & Shipping, 1%
Transportation, 5%
Water, 4%
Commercial Facilities, 2%
Communications, 5%
Critical Manufacturing, 17%
Distribution of Cyber Incidents (ICS-CERT)
Threat Landscape

6. @NTXISSA #NTXISSACSC3
Difference in security attribute between ICS and Enterprise systems
Slide 6
Managing Cyber Security Across the Enterprise
Challenges in Securing Systems
Courtesy: Kaspersky Lab

7. @NTXISSA #NTXISSACSC3
Differences/similarities in security controls considerations between
ICS and Enterprise systems
Slide 7
Managing Cyber Security Across the Enterprise
Challenges in Securing Systems
Life Span 15 – 20 years 3 – 5 years
COTS Related Vulnerabilities Yes Yes
Third Party Access to Systems Frequent Limited
Security Considerations in Implementation Limited Yes
Wireless Access to Systems Significant Limited

8. @NTXISSA #NTXISSACSC3
Defense in Depth in securing ICS
Slide 8
Managing Cyber Security Across the Enterprise
Cyber Security Strategies

9. @NTXISSA #NTXISSACSC3
Risk Based Approach and Management to Securing ICS
Slide 9
Managing Cyber Security Across the Enterprise
Cyber Security Strategies

10. @NTXISSA #NTXISSACSC3
Network Segmentation
Slide 10
Managing Cyber Security Across the Enterprise
Cyber Security Strategies
(Reference: Defense in Depth Strategies, Idaho National Laboratory, Department of Homeland Security Based on ISA 62443)

11. @NTXISSA #NTXISSACSC3
Summary
Slide 11
Managing Cyber Security Across the Enterprise
Rapid integration of “Commercial Off the Shelf (COTS) in ICS
environment comes with vulnerabilities and risks
Industrial control systems are not easy to secure
Hacker knowledge base is growing rapidly, resulting in more
sophisticated attacks
Risk has to be managed although it can not be eliminated. Risk
based “Defense in Depth” mitigates cyber risks at multiple layers
in an organization
Conclusion

12. @NTXISSA #NTXISSACSC3@NTXISSA #NTXISSACSC3
Slide 12
Thank you
The Collin College Engineering Department
Collin College Student Chapter of the North Texas ISSA
North Texas ISSA (Information Systems Security Association)