This document discusses digital security and the challenges of securing systems in a changing technological landscape. It notes that terminology around information, cyber, and digital security can be confusing, and that security requirements need to be defined on a case-by-case basis. It emphasizes that security risks will continue to increase as digitalization accelerates, and that security professionals must adapt to embrace changes like cloud computing, IoT, and new technologies. The document concludes that data and trust are key currencies, that security enables digitalization when done well, and that effective security requires balancing risks with opportunities through good design principles and lifelong learning.

1. Public
Digital Security
Aalto University
10.4.2018
Jari Pirhonen
Chief Security Officer
Tieto Corporation

2. © Tieto Corporation
Public
JaPi 2018
 Drivers of security
 Terminology soup
 No risk, no glory
 User is the king, code is the law
 Jack of all trades, master of none
Topics

3. © Tieto Corporation
Public
JaPi 2018
Why cars have brakes?

4. © Tieto Corporation
Public
JaPi 2018
Speed is nothing without control

5. © Tieto Corporation
Public
JaPi 2018
WANT
 Enable business, trust, quality, 24/7
MUST
 Regulation, compliance
FEAR
 Risks, sanctions, emergencies, attacks
Security drivers

6. © Tieto Corporation
Public
JaPi 2018
ICT security refers to technical
countermeasures to protect data, IT-systems
and networks. Focus on technical solutions,
technical skills and security products.
Information security is the protection of
information from a wide range of threats in
order to ensure business continuity, minimize
business risk, and maximize return on
investments and business opportunities.
Focus on protecting organization’s people,
information, processes, services and brand.
Cybersecurity concentrates on critical
infrastructure, interconnectivity and citizens.
Focus on assuring the security of whole
networked society.
Digital security emphasize security
implications because of digitalization,
automatisation, connectivity and IoT. Focus
on security’s adaptation on change and new
technology.
Terminology- my view
Sense of security
Resilience
Trustworthiness
Provability
Understandability
Safety
Privacy
Auditability
Denialibility
Traceability
Confidentiality
Integrity
Availability

7. © Tieto Corporation
Public
JaPi 2018
The Standard of Good Practice for
Information Security 2018 Categories
1. Security Governance
2. Information Risk Assessment
3. Security Management
4. People Management
5. Information Management
6. Physical Asset Management
7. System Development
8. Business Application Management
9. System Access
10. System Management
11. Networks and Communications
12. Supply Chain Management
13. Technical Security Management
14. Threat and Incident Management
15. Local Environment Management
16. Business Continuity
17. Security Monitoring and Improvement
17 Categories  34 Areas  131 Topics  Controls

8. © Tieto Corporation
Public
JaPi 2018
• Digitalization means change in people behavior,
business models and market dynamics as enabled
by technology
• Requirements: Speed, experimentation, data,
understanding users, ICT, right skills and security.
• Cloud, mobile, Internet of Things (IoT),
Industrical Control Systems (ICS), Robotic Process
Automation, Artifical Intelligence,
Application Programming Interface (API),
Blockchain, Drones,…
 Security professionals must adapt on agility,
insecurity, risk tolerance, openness, user
oriented approach and continuous change.
Embrace the change!

9. © Tieto Corporation
Public
JaPi 2018
Security risks will increase for a while…

10. © Tieto Corporation
Public
JaPi 2018
Source: http://www.informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks/
2005
2007
2009
2011
2013
2015
2017
2015
2016
2017

11. © Tieto Corporation
Public
JaPi 2018
Source: Motherboard

12. © Tieto Corporation
Public
JaPi 2018
Source: The Verge

13. © Tieto Corporation
Public
JaPi 2018
Physical protection
Security cameras
Trusted employees
Access control
Activity monitoring
Security zones
Incident management
Alarm systems
A bank

14. © Tieto Corporation
Public
JaPi 2018
Physical protection
Security cameras
Trusted employees
Access control
Activity monitoring
Security zones
Incident management
Encryption
DDoS-protection
Firewalls, IDS/IPS
Log management, audit trail
Hardened systems, patching
Secure applications
Strong authentication
Secure datacenter facilities
Incident management
Backups
Secure architecture
Alarm systems
Highly-available systems
System and change management
An online bank

15. © Tieto Corporation
Public
JaPi 2018
Code is Law
• Money  bits
• Wallet  code
• Payment  protocol
• Transaction  data transfer
• Bank account  database
• Bank  application
• Customer service  algorithm
• Bank clerk robot
Software security is a must!

16. © Tieto Corporation
Public
JaPi 2018
Design secure services
Infrastructure
controls
Service controls
Individual controls
Process
controls
User /
Customer
Start
here
Know your assets, good architecture,
State-of-the-art security technology
Update, verify, assure. Test from attackers
perspective. Monitor and response.
Set your baseline. Add an extra layer of
controls to your customer to choose from.
Compensate extra controls usage – that will
motivate to have better security.
Find the weak spots of business processes –
that’s what fraudsters will do. Think
holistically, and do not forget side channels.
Treat your “users” as customers. Step into
service as you would use it. Think what
would enhance confidence.
Source: PWC

17. © Tieto Corporation
Public
JaPi 2018
Digital security expert?
Source: http://www.cyberdegrees.org/
Manage
Design
Implement
Evaluate

18. © Tieto Corporation
Public
JaPi 2018
 Data and trust are the currencies of digital world. Security
is an enabler of digitalization. Don’t be a naysayer.
 Don’t let terminology to confuse you. Define security
requirements for each case.
 Security is risk management. Balance risks
with opportunities.
 Security must be built in to the applications. Design
applications considering human behavior and flaws.
 Security requires lifelong learning.
Theory and principles last, technology changes.
Takeaways