The document outlines current and emerging cyber security threats. It discusses threat actors, primary threats like poor software design and lack of network security, and common attack vectors. Current threats include accidental data loss, deliberate exfiltration, and targeted attacks. Emerging threats involve issues from bring your own device (BYOD) use, large data volumes, fast-paced technology evolution, and increased consumer coding and internet of things devices. The document emphasizes that perimeter security is not enough and that cyber risk responsibility cannot be outsourced.

1. Current & Emerging Cyber Security Threats

2. Agenda
• The threat actors
• Primary threats
• Common vectors
• Some realities
• Current threats
• Emerging threats

3. Before we begin.. Security is emotive

4. Before we begin.. Some stats
https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/261674/bis-13-1293-ftse-350-cyber-governance-health-check-tracker-report.pdf

5. Before we begin.. Some more stats
https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/261674/bis-13-1293-ftse-350-cyber-governance-health-check-tracker-report.pdf

6. The threat actors

7. Primary threats

8. Vectors

9. Causes
• Poorly designed and developed software and systems
• Lack of network segregation, access control & monitoring
• Level of user education and risk understanding / sense of
ownership & responsibility
• Security solutions / practices leading to poor UX
• Regulatory tick boxing / audit burden

10. Vendor hype leading to the wrong focus

11. Some realities
• Perimeter security alone has never been sufficient
• The definition of a perimeter has changed
• Asking people not to click on things is not sustainable
• Limiting the use of mobile does not work
• Security doesn’t come from free!

12. Current threats
// Internal
• Accidental data or device loss
• Deliberate data exfiltration
• Poor internal security practices
// External
• Collateral damage compromises
• Drive by compromise
• Targeted attacks

13. Emerging threats – BYOD

14. Emerging threats – data volumes
• How to tag data efficiently and effectively
• How to control access
• How to protectively monitor
• How to detect anomalous behaviour
• Aggregation of data

15. Emerging threats – tech evolution pace
• Evolution rate increasing
• Shorter product life spans
• Quicker time to market
• Sustaining older products from a security perspective
• Agile security engineering

16. Emerging threats – everyone’s a coder!
• A world where everyone is a developer
• Traditional security expertise in
development / engineering teams diluted
• We need better frameworks and platforms

17. Emerging threats – Internet of things
• Traditional patching goes away
• Exploitability doesn’t diminish
• Machine to machine interactions
• Compounded hidden I.T.

18. Final thoughts
• Cyber risk ownership can not be
outsourced
• Cyber security is just one element of
modern good business governance
• Investment should be always be proportional
• Events will occur! It shouldn’t be a drama..

19. Thanks? Questions?
UK Offices
North American Offices
Australian Offices
Manchester - Head Office
San Francisco
Sydney
Cheltenham
Atlanta
Edinburgh
New York
Leatherhead
Seattle
London
Austin
Milton Keynes
European Offices
Amsterdam - Netherlands
Munich – Germany
Zurich - Switzerland
Ollie Whitehouse
ollie.whitehouse@nccgroup.com