Recommended
More Related Content
What's hot
What's hot (20)
Similar to iuvo Technologies Business & IT Leadership Symposium 2019 - Michael Joseph
Similar to iuvo Technologies Business & IT Leadership Symposium 2019 - Michael Joseph (20)
Recently uploaded
Recently uploaded (20)
iuvo Technologies Business & IT Leadership Symposium 2019 - Michael Joseph
- 1. PRESENTS THE 2N D ANNUAL #2019iuvoSymposium
- 3. By: Michael Joseph Co-Founder & President Published: October 2, 2019 Your Security Story
- 5. The Fiction of Security 1. Security is simple 4. It won’t happen to you 3. You paid for security tools and products, so you’re protected 2. You have an “IT guy”, so you’re secure
- 6. The Reality of a Breach Security & IT Team Firewalls in Place Shiny Tools Audits & Compliance How could this happen? • New initiative to move services to the cloud • Misconfiguration in the firewall • Did not expand the security scope to meet business-critical projects • Allowed attacker to enter and extract data
- 7. The Reality of a Breach Cutting-Edge Tools Incident Response PCI Compliant Security Vendors Verified How could this happen? • Problems were in architecture and process • Attacker entered in through HVAC vendor’s systems • HVAC systems gave access to the credit card systems
- 8. The Reality of a Breach Security Tools PCI Compliant IT Security Organization How could this happen? • Customer service became a priority • Wi-Fi was not properly secured • Hacker was in a parking lot on a laptop, and accessed data from the cash registers
- 9. The Aftermath of a Breach 1. Security incidents exacerbate existing problems in B2C relationships 2. Costs associated with remediation, business shutdown, and lawsuits 3. IT and Security Departments get overloaded (again) 4. Security Program needs to be assessed
- 11. How to Start Your Story 1. Change the attitude your organization takes toward security 2. You have to be prepared 3. Understand the current maturity level of your security 4. Develop, strengthen, and deploy your Security Program
- 12. Parts of Security Program 1. Structure and Definition • What are the goals? • What is being protected? • How will this be done? 2. Implementation and Operations • Deployment and management of the above 3. Monitoring and Response • Watching for risks • Addressing potential and actual risks • Getting business back to normal operations
- 13. Security Program Maturity 1. Block and Tackle • Ad hoc IT function • Reactive • Simple technologies and configurations 2. Compliance Driven • Adoption of new tools for detection and analytics • Coordinated within IT • Processes still manual • Security is being integrated into business 3. Risk-Based Approach • Proactive and scalable • Part of the organization as a whole • Formal processes with automation
- 14. A Strong Security Program Firewalls Identity Management Anti-Malware Policies SIEM Disaster Recovery Monitoring Incident Response Vulnerability Management Training Risk Management Audit & Compliance Secure Architecture Review Documentation Framework Business Process Definition GovernanceAsset Inventory Classify Critical Data Post-Mortems Review & Guidance Metrics Continuous Improvement Strategy Behavioral Analysis System Hardening
- 15. A Mature Security Program Firewalls Identity Management Anti-Malware Policies SIEM Disaster Recovery Monitoring Incident Response Vulnerability Management Training Risk Management Audit & Compliance Secure Architecture Review Documentation Framework Business Process Definition GovernanceAsset Inventory Classify Critical Data Post-Mortems Review & Guidance Metrics Continuous Improvement Strategy Behavioral Analysis System Hardening Level 1: Block and Tackle Level 2: Compliance Driven Level 3: Risk-Based Approach 2 111 1 2 2 2 22 2 2 2 2 2 2 333 33 333 33
- 16. Solve Your Security Mystery 1. How mature is our Security Program? 2. What bricks do we currently have in place? 3. What bricks do we need in place and when? 4. What resources do we need to be successful?
- 17. About the Author • 20 years of securing networks and protecting customers • 24x7x365 Network & Security Operations Center • An extension of our customers’ teams • Ecosystem of security partners