1) Cybersecurity health checks provide a new approach to assessing cybersecurity that is more affordable and manageable than traditional information security standards. They aim to evaluate an organization's basic security posture and operational defenses through checkups, health tests, and examinations.
2) Cyber Essentials is a certification program that focuses on baseline security and acts as a type of cybersecurity health check. It evaluates security controls like boundary protection, secure configuration, user access control, malware protection, and patching to prevent common technical attacks.
3) The Australian Securities and Investments Commission's Report 429 also adopted aspects of a cybersecurity health check approach. It includes 26 prompts across governance and the five areas of the US Cybersecurity Framework to
2. 2
Quick Facts about Lynda.com
Government
• Major government agencies
• Branches of military
Corporations
• More than half of the Fortune 50 across
all key industry sectors
Education
• 60% of all US colleges and universities
40% of Australian universities
4M+
Members
…with 350k paying
out of pocket
20
Years
Lynda.com was founded
in 1995
12,000+
Enterprise Clients
…located across
52 countries
6,000+
Courses
…available in
5 languages (German, Spanish,
French, Japanese)
The Global Leader in Online Skills Instruction
INTRODUCTION
4. 4
• 1983 - US DoD rainbow series
• 1993 – UK PD0003
• 1998 – BS 7799……ISO 27000
• 2005 – NIST Special Publication 800-53
• … but too difficult and costly
Information Security Standards
BACKGROUND
Cybersecurity Health Checks
5. 5
• From Bulletin Boards to the Web
• Ubiquitous connectivity across the globe
• Clouds aren’t just in the sky…
• From email to social media…
• From telephone to smartphone
• Cyber kill chain … the world has changed
Information Security Standards
BACKGROUND
Cybersecurity Health Checks
6. 6
• Evolution of information security standards lagging
• Information security policies ineffective*
New Approach
BACKGROUND
Cybersecurity Health Checks
*Doherty, NF and Fulford H. Do Information Security Policies Reduce the Incidence of Security Breaches? 2005
7. 7
• UK Cybersecurity Strategy
• Cyber Governance Health Check
• top 350 listed companies
• only15% of Boards manage cyber risk
• only 30% use threat intelligence
• Majority of attacks exploit basic weaknesses
Information Security Policies
BACKGROUND
Cybersecurity Health Checks
8. 8
• Term used in audit community
• Now used in cybersecurity consulting
• Various interpretations
… is simply cyber fitness
Cybersecurity Health Check
DEFINITION
Cybersecurity Health Checks
9. 9
• Check-up – unauthorised users, malware
• Health test - check network traffic for infections
• Full examination - rules, patches, access and privileges
- operational defences
• Fitness test - external penetration exercise
• Cyber insurance
Cybersecurity Health Check
DEFINITION
Cybersecurity Health Checks
21. 21
• Issues:
• legacy access
• excess privileges
User Access Control
CYBER ESSENTIALS
Cybersecurity health Checks
22. 22
User Access Control
CYBER ESSENTIALS
Cybersecurity health Checks
• minimum privileges
• userid and strong passwords
• ensure privileged accounts are not used for internet activity
• disable or remove accounts when no longer required
24. 24
• Install anti-virus software
• up to date signatures
• Use real-time protection
• Scan the filebase
• Blacklisting known malicious sites
Malware Protection
CYBER ESSENTIALS
Cybersecurity Health Checks
25. 25
• Flaws found by developers, researchers, hackers
• Often exploited within 24 hours
• Timely patching
• Licenced software
Patching
CYBER ESSENTIALS
Cybersecurity Health Checks
26. 26
• Good routine check-up and examination
• Does not propose a full cyber fitness test
Cyber Essentials – Health Check?
CYBER ESSENTIALS
Cybersecurity Health Checks
27. 27
• Published March 2015
• Improve cyber resilience
• Cyber defence posture
• Incident management
ASIC Report 429
ASIC REPORT 429
Cybersecurity Health Checks
28. 28
• Adopted in ASIC Report 429
• 26 prompts
• 2 governance
• 24 across the five Framework areas
US Cybersecurity Framework
ASIC REPORT 429
Cybersecurity Health Checks
29. 29
• Board and Executive awareness of cyber risk
• Assessment against the Cybersecurity Framework
Governance
ASIC REPORT 429
Cybersecurity Health Checks
30. 30
• What are the essential information and assets?
• What are the cyber risks?
• Are third party risks considered?
• Does enterprise risk management include cyber risks?
• Are staff aware of cyber risks?
Identify
ASIC REPORT 429
Cybersecurity Health Checks
31. 31
• Are security policies and standards up to date?
• Have IT systems and processes been tested?
• Are there sufficient resources in place?
Protect
ASIC REPORT 429
Cybersecurity Health Checks
32. 32
• Monitoring for cyber attacks
• External engagement
Detect
ASIC REPORT 429
Cybersecurity Health Checks
33. 33
• Is response planning adequate?
• Notifying law enforcement of an attack
• Notifying customers of a breach
Respond
ASIC REPORT 429
Cybersecurity Health Checks
34. 34
• Does the organisation have a recovery plan?
Recover
ASIC REPORT 429
Cybersecurity Health Checks
35. 35
• Full set of controls
• Cyber health checks lost in the noise
• A through life fitness programme
ASIC Report 429 – Cyber Health Check?
ASIC REPORT 429
Cybersecurity Health Checks
36. 36
• Security standards are evolving
• Traditional approach is having limited success
• Cyber health checks are a more manageable approach
• Cyber Essentials provides a health check
Conclusion
CONCLUSION
Cybersecurity Health Checks