The document discusses cyber security and presents a framework for an effective cyber security program. It outlines the key elements of a comprehensive security approach, including assessing risks, architecting security controls, applying protections, administering security operations, raising user awareness, ensuring agility, defining the appropriate risk appetite, and aligning security with business needs. The framework emphasizes that security is a continuous process requiring skills in various areas to successfully manage risks.

1. A6 a pragmatic Journey
into Cyber Security
Jorge Sebastiao, CISSP
ICT Expert
Huawei
http://linkedin.com/in/sebastiao/
Twitter: @4jorge

2. Disclaimer & Copyright
• Please note that this presentation is for informational, knowledge sharing and educational purposes only. Any
comments or statements made herein do not necessarily reflect the views of Huawei. The information is intended
for the recipient's use only and should not be cited, reproduced or distributed to any third party without the prior
consent of the authors. Although great care is taken to ensure accuracy of information neither the author, nor
Huawei can be held responsible for any decision made on the basis of the information cited.
• The content of this presentation is based on information gathered in good faith from both primary and
secondary sources and is believed to be correct at the time of publication. The author can however provide no
guarantee regarding the accuracy of this content and therefore accepts no liability whatsoever for any actions
taken that subsequently prove incorrect.
• The practices listed in the document are provided as is and as guidance and the author and Huawei do not claim
that these comprise the only practices to be followed. The readers are urged to make informed decisions in their
usage.
• The information presented in this presentation is not intended to be, and should not be construed as, an offer to
sell any products or services or a solicitation of an offer to buy any products or services . Any such offer or sale will
be made pursuant to, and the information presented at this meeting is qualified in its entirety by, authorized
offering documents and related disclosure schedules or similar disclosure documentation.
• All logos and brand names belong to their respective owners and we do not claim any relationship or association,
implied or otherwise, with them.
• Use of any materials by virtue of relationships and associations, if any, are mentioned explicitly.
• Author has taken care to attribute all sources for external materials used in this presentation, and any oversight is
regretted. If you, as owner, or as viewer, find any reason to dispute the use of these materials kindly communicate
the same to author.
• Any omissions, in terms of attribution, may be due to an error of author and not intentional.

3. Google review of email Phishing

4. Spear Phishing

5. Is That an Office Phone In Your Pocket?

6. The future is here

7. Uncontrolled Connectivity

8. Everything is connected…

9. Apple Pay Exploit

10. M2M and Google Voice?

11. Smart Meters and Nest Hack

12. Healthcare Sensors Exploits

13. Physical Security

14. Hacking IIoT SCADA sensors
Industrial Scale Risks

15. Challenges
Disengagement
from the changing
customer mindset
Lack of
confidence in
return on
investment
Lack of regulatory
certainty on new
market structures
Privacy,
security and
resilience
Poorly
formulated M&A
and strategic
partnerships
Failure to define
new business
metrics
Failure to
capitalize on new
types of
connectivity
Insufficient information to
turn demand into value
Failure to shift
the business model
from minutes
to bytes
Lack of
organizational
flexibility

16. Mobile Malware up
148,778 samples 2013

17. 5th Challenge -Protection against
State Sponsored Attacks
• # 19M89. %6/><345%
• I </>%' X71>%><. %v' ; >0%7?%# /4@q%

18. Is there an elephant in the
room?

19. 0 Day Exploits - Guaranteed

20. Rogue & Clueless Users

21. Our security enemy is?
Security Nightmare

22. Cyberspace
CharacteristicsAsymmetric
Attribution
Problems
No Borders
Complex Interconnected
Systems

23. Outdated Assumptions?

24. Effective Countermeasures

25. Wrong Skills?

26. What is next?

27. Think outside the box
2

28. Effective Security is hidden
deep underneath…
Technology
ProcessPeople

29. Right Risk Appetite?

30. Modeling Risk and Threats
Threats Vulnerabilities
Controls Risks Assets
Security
Requirements
Business
Impact
exploit
exposeincreaseincrease
increase have
protect against
met by indicate
reduce

31. CONSEQUENCE
LIKLIEHOOD
FV
T
Risk Group
1
Risk Group
2
Risk Group
3
HighLow
L
o
w
H
i
g
h
RESPONSE
PROTECTION
Target Risk
Risk Reduction Strategies!

32. 4As A4 of Security
Assess Evaluate, Audit, Check
Architect Plan, Design
Apply Build, Implement, Do
Administer Operate, Act

33. 5As A5 of Security
Assess Evaluate, Audit, Check
Architect Plan, Design
Apply Build, Implement, Do
Administer Operate, Act
Awareness Intelligence, User

34. 6As A6 of Security
Assess Evaluate, Audit, Check
Architect Plan, Design
Apply Build, Implement, Do
Administer Operate, Act
Awareness Intelligence, User
Agility Timeliness of Response

35. A6 - Process
Business Risk
Controls
Maturity

36. Defense in depth

37. The « defence in depth »

38. TBS- Time Based Security
Protection
DetectionResponse
SECURITY
P>D+R
Anti-virus
VPN
Firewall, IPS
Access Control
Grid Time Response
Patch Mgmt
Incidence Response
Disaster Recovery
Vulnerability Testing
SIEM
Log Correlation
CCTV, Access Control

39. Proper Security Metrics

40. Cyber Attack Recovery Agility
Risk
Active
Business
Can you
successfully
recover?

41. Road to Security Metrics
Security Metrics
KPIs, Testing Results
CSA Controls, Compliance, Operational, Financial
CoBIT
SOX
ISMS
ISO27001
PCI
HIPAA
Time Based Security
ISMS
ISO22301
ISMS
ISO20000

42. Final Goal Is
Total Integrated Security
Information
Security
Management
IoT, Device
Security
Management

43. Winning the War
Red Teaming Solve Attribution
Continuous Vulnerability Mgmt Crowd Sourcing/Bug Bounty
Fusing Crisis Management
Vertical CERT Integration Encryption
Exchange Knowledge Data Leak Prevention
Threat Management Reputation Management
Big Data Honeynets
Machine Learning Sandbox
Security Metrics Empower end users
Continuous Training Attack / Take down

44. 10As A10 of Security
Assess Evaluate, Audit, Check
Architect Plan, Design
Apply Build, Implement, Do
Administer Operate, Act, Respond
Awareness Intelligence, User
Agility Timeliness of Response
Appetite How much Risk can you take?
Alignment Business focus
Assumption Something is wrong?
Authorization Right to access, authentication

45. Don’t bring a knife to gun fight

46. “…Security is
a continuous
skilled
process…”…
Jorge Sebastiao
http://linkedin.com/in/sebastiao

47. Questions
Jorge Sebastiao, CISSP
ICT Expert
Huawei
http://linkedin.com/in/sebastiao/
Twitter: @4jorge