Cyber Attack Survival

•Download as PPTX, PDF•

0 likes•247 views

This document discusses cyber attack survival and data security. It begins with discussing the threat landscape, understanding risks, and implementing a data security program. It then discusses observed data breach threats like malware infections and hacking, how breaches are typically discovered, and assessing security risks. The document recommends following frameworks like NIST and ISO, validating controls through audits and testing, and prioritizing "quick win" controls that address 40% of data breaches. The overall document provides an overview of understanding security risks, implementing controls, and testing a data security program to survive cyber attacks.

Business

Cyber Attack Survival
Joseph Compton, CISSP, CISA, QSA
Paul Winkeler
May 16, 2017

2
• Threat landscape: Ransomware and beyond
• Understanding your risks
• Implementing a data security program
• Testing and maintaining your data security program
AGENDA

12
• 75% say their organizations are as or more vulnerable to
malicious code attacks and security breaches compared with a
year ago. And in the face of a crushing skills shortage, 40%
subsist on no more than 5% of the IT budget.
• "Managing the complexity of security" reclaimed the No. 1 spot
among 10 challenges facing the respondents to our security
survey, all from organizations with 100 or more employees
PERCEIVED THREATS
Source: InformationWeek 2014 Strategic Security Survey

13
• 58% see an infected personal device connecting to the
corporate network as a top endpoint security concern, making
it the No. 1 response, ahead of phishing and lost devices
• 56% say cyber-criminals pose the greatest threat to their
organizations this year, the top answer, ahead of authorized
users and employees at 49%
• 23% have experienced a security breach or espionage in the
past year
PERCEIVED THREATS
Source: InformationWeek 2014 Strategic Security Survey

14
Source: Verizon 2015 Data Breach Investigation Report
OBSERVED THREATS

15
OBSERVED THREAT SOURCES
Source: Verizon 2015 Data Breach Investigation Report

16
BREACH DISCOVERY
Source: Verizon 2015 Data Breach Investigation Report

18
Understand organizational
risks
Key risk prioritization Identify high-risk areas
• Gain an understanding of the high-risk
areas and underlying rationales by
conducting interviews with members of
senior management, Legal and your
Trust Advisors.
• Identify key risks based on the threats
and vulnerabilities relevant to the
organization and ranked these items
based on on their overall impact
(environment, system and technical
analysis) and expected likelihood of
occurrence.
• Identified the top risks to the company
based on inherent risk ranking.
Threat Categories A B C D E
External Attack 2 3
Internal Misuse and abuse 6 2
Theft 2
System Malfunction 2 1
Service Interruption 1 5
Customer 4
Information Risk Ratings: A-Verify High, B-High, C-Medium, D-Low, E-Very Low
DATA SECURITY
RISK ASSESSMENT

21
CONTROL FRAMEWORKS
• CSA Star – Cloud Security Alliance
• COBIT – Control Objectives for Information and Related Technology
• FEDRAMP – Federal Risk and Authorization Management Program
• FISMA – Federal Information Security Management Act
• HIPAA – Health Insurance Portability and Accountability Act
• ISO – International Organization for Standardization
• ITIL – Information Technology Infrastructure Library
• PCI DSS – Payment Card Industry Data Security Standard
• NIST – National Institute of Standards and Technology
• SOC 2 (AT 101) – Service Organization Control Reports

VALIDATE
• Independent auditor assessments and attestations
 Review of policies and administrative procedures
 Inspection of configurations and settings
 Testing of manual procedures
 Observation of control activities

• Security Testing
 Vulnerability Assessments
− Internal and external testing
 Internal and External Penetration Testing
− Network penetration testing
− Web application testing
− Social engineering
VALIDATE

24
WHAT CAN I DO FIRST?
• 40% of the
controls
determined to
be most
effective
against data
breaches fall
into the “Quick
Win" category
Source: Verizon 2015 Data Breach Investigation Report

25
CONTACT
Joseph Compton CISSP, CISA, QSA
(440) 605-7252
jcompton@skodaminotti.com
Paul Winkeler
(440) 899-3822
pwinkeler@dataservtech.com
Dave MacDonald
(440) 899-3816
dmacdonald@dataservtech.com

Securing aging outdated infrastructure from external and insider threats is difficult at best. But, wherever you are today on the path to modernization, there are impactful steps you can take to further mitigate risk. In this presentation from his webinar, BeyondTrust’s Senior Federal Engineer, Shunta Sanders, explores: - The kinds of risk legacy Federal IT solutions pose to security - Tactics Federal IT professionals are using to combat cyber risk - 4 best practices to secure environments today, and post-modernization You can watch the full, on-demand webinar here: https://www.beyondtrust.com/resources/webinar/mitigating-risk-aging-federal-systems/

Reporte de Seguridad de Cisco 2016

Oscar Romano

Synack cirtical infrasructure webinar

Synack

Reorganizing Federal IT to Address Today's Threats

Lumension

New reports show U.S. government servers are faced with 1.8 billion cyber attacks every month. View this technical presentation on ‘Reorganizing Federal IT to Address Today’s Threats’ by Richard Stiennon, analyst with IT Harvest and author of Surviving Cyber War, and Paul Zimski, VP of Solution Strategy with Lumension, as they examine: *Today’s threats targeting government IT systems *How federal IT departments can be reorganized to improve security and operations *What key endpoint security capabilities should be implemented Get expert insight and recommendations on improving your approach to securing IT systems from today’s sophisticated threats.

5 Steps to an Effective Vulnerability Management Program

Tripwire

Revelations about recent breaches have certainly put the question to security professionals across the world, “What can I do to prevent an attack from happening?” Current threats are complicated and driven by highly motivated adversaries. You can’t defend what you don’t know. This can be a big challenge when it comes to network visibility. Many organizations don’t have a true sense of all that is on their network. Network situational awareness represents the foundation of comprehensive vulnerability management. In this informative webcast, Tripwire and Lumeta provide insight on how to: -Identify and fingerprint more assets in your environment -Ensure greater coverage for scanning devices on your network, including BYOD -Compile a proper and complete inventory of assets, even those that are unused -Intelligently prioritize vulnerabilities -Effectively reduce risk on critical systems

2015 Global Threat Intelligence Report - an analysis of global security trends

DImension Data

7 cyber security questions for boards

Paul McGillicuddy

The cyber security job is everyone's business including the Board of Directors, even without a cyber security degree. Recent cyber security news proves that. According to several studies, Boards are getting it wrong and are leaving cyber awareness and risk management in the hands of the CEO, CISO, CTOs and cyber security companies. In a sense they are abdicating their responsibility to the shareholders. This slideshare proposes 7 questions every board should be asking their company executives abour IT security. They're not necessarily all encompassing and don't take the place of real cybersecurity training, but will drive the discussion to better and more complete understanding of strategic risk. Questions cover the basics of cyber security training, cyber policies, who briefs and when at board meetings. Thanks.

5 Key Findings on Advanced Threats

Hannah Jenney

This document discusses the growing threat of advanced attacks and the limitations of current security prevention and detection methods. It finds that advanced threats and data breaches are increasing significantly year-over-year. Traditional security defenses are failing to detect many of these threats in a timely manner, allowing breaches to persist for months or years without discovery. The document advocates for a unified advanced threat protection solution that can better detect threats across networks, endpoints, and email through improved visibility, intelligence, and faster incident response capabilities. Such a solution aims to ease resource burdens on IT teams and help organizations more efficiently protect their businesses from advanced threats.

The document summarizes the findings of a survey conducted by Ponemon Institute on the state of cyber incident response programs. Some key findings from the survey include: organizations are ill-prepared to respond to cyber threats, cybersecurity budgets dedicate a low percentage to incident response preparedness, and network audit trails are seen as the most effective tool for detecting security breaches. The document recommends that organizations build dedicated incident response teams, assess team readiness, use metrics to measure effectiveness, and foster information sharing.

Mitigating Risk from Cyber Security Attacks

Tripwire

This document discusses strategies for mitigating risks from cyber security attacks. Traditional security controls like firewalls and antivirus software are ineffective against targeted attacks. To combat cyber threats, organizations must define a security baseline and monitor for any changes, detect abnormalities as early as possible to minimize damage, and implement automated solutions along with security processes and expertise, as manual auditing alone is not scalable for most organizations. Continuous monitoring that identifies and correlates changes can help quickly detect breaches and threats while providing intelligence to security teams.

New Developments in Cybersecurity and Technology for RDOs: Howland

nado-web

Sample Incident Response Plan

Matthew J McMahon

The document outlines Kevin Mitnick Memorial Hospital's Incident Response Plan with 4 phases: 1) Preparation establishes roles for a Computer Security Incident Response Team and employee training. 2) Detection details identifying and analyzing incidents through automated/manual scans and employee reports. 3) Response includes preserving evidence, containing/removing threats, and recovering from incidents. 4) Post-incident activities are conducting an after action report and notifying authorities/public of critical breaches. The plan provides guidance for different incident severity levels and protecting patient health information.

Risk Management Approach to Cyber Security

Ernest Staats

The document discusses implementing a risk management approach to cyber security. It emphasizes that security can no longer be outsourced and instead the security team should help others become more self-sufficient. It then discusses various cyber risks like the growing attack surface and risks to health care as a target. Finally, it discusses strategies to implement an enterprise risk management approach like determining how information flows and conducting risk analysis interviews.

Impacts cloud remote_workforce

Rodrigo Varas

This document summarizes the key findings of a SANS 2021 survey on vulnerability management. The percentage of organizations with a formal vulnerability management program increased to 75% from 63% in 2020. While identifying vulnerabilities is not difficult, fixing them remains challenging due to lack of budget, resources, and prioritization. The survey assessed organizations' maturity across various phases of the vulnerability management lifecycle. It found that maturity is lower for managing vulnerabilities in cloud, containers, and custom software compared to traditional infrastructure. Responsibility for vulnerability management is increasingly shared between security and IT teams.

Information risk management

Akash Saraswat

Role of The Board In IT Governance & Cyber Security-Steve Howse

CGTI

This document discusses I.T. strategy, risk management, and governance. It begins with an introduction of Steve Howse, the president of Millington & Associates, and his background. The document then discusses what I.T. strategy and governance entail and why they are important. It introduces the "20 questions" framework as a tool to assess I.T. strategy, risk, and governance. The questions are categorized into strategic issues, internal control issues, and risk issues. The document dives deeper into examples of risks and what organizations can do to address risks such as dedicating board members to I.T. committees and ensuring business continuity plans are tested.

Challenges of Vulnerability Management

Rahul Neel Mani

This document discusses Atos India's vulnerability management process. It outlines that vulnerability management is the process of identifying security weaknesses, evaluating risks, and remediating issues. Atos manages over 13,000 IT systems and 2,200 critical assets. Their vulnerability management cycle involves scanning for vulnerabilities, evaluating and prioritizing them, developing remediation plans, patching systems, and confirming issues are resolved. In 8 months using this process, Atos reduced vulnerabilities by 78%, outdated systems by 36%, and improved their compliance and customer confidence. They continue improving by monitoring new threats and evaluating team performance.

Nonprofit Cybersecurity Readiness - Community IT Innovators Webinar

Community IT Innovators

Integrated cyber defense

kajal kumari

This document provides an overview of cyber threats and ransomware prevention. It defines a cyber threat as an activity intended to compromise the security of an information system by altering the availability, integrity, or confidentiality of the system. It notes that in today's connected world, new risks emerge daily and connecting to the internet opens the possibility of hacker attacks. The document outlines different types of attacks like phishing, man-in-the-middle attacks, and ransomware. Ransomware is defined as malicious software that restricts access to a device and demands ransom payment, usually in cryptocurrency. The document recommends defensive steps to prevent ransomware like using malware detection, backup solutions, forensic analysis with machine learning, and not paying

Cyber(in)security: systemic risks and responses

blogzilla

Demonstrating Information Security Program Effectiveness

Doug Copley

Measuring the effectiveness of an information security program is important for governance, continuous improvement, and providing assurance. Key things to measure include compliance with frameworks, control effectiveness, and progress towards goals. Metrics should be tailored to different audiences like executives, managers, and security staff. Example metrics include vulnerability remediation timelines, audit findings closure rates, and security event trends over time. Visual dashboards with indicators like colors and arrows help concisely communicate security program status and areas needing attention to stakeholders.

六合彩香港-六合彩

baoyin

王峰人在排队，眼睛不停地越过子允的肩膀扫向那边的周晨晨，几乎是看一眼香港六合彩应付下子允的话，发酸的心很是羡慕子允这只童子(又鸟)，特别奇怪身边的香港六合彩怎开窍了，而且一开窍就迷住了周晨晨的美窍。子允不明其中奥秘，因自己正暗笑着王秀，以为王峰与自己笑的一件事，于是乎笑得更爽。王峰见心情极佳的子允这么配合，自知有愧，不再看，又忍不住，相对减少了频率。周晨晨的侧轮廓可谓中西合璧的精彩，在窗玻璃里和窗玻璃外的两堆人中很是醒目。王峰心不在焉地和子允搭话，心思飘扬，目光也飘扬。周晨晨看那老太太并不是在感伤自己也会变得那般模样，以香港六合彩现在的豆蔻年华绝不会产生三四十岁女人的惆怅。香港六合彩现在只是现在的心思，一种常被青春女孩放大的心思，而这种心思即使香港六合彩到了老太太时期也未必会说出来，所以女人的心思一直是心理学家攻克不破的难题。香港六合彩终于把脸转到室内，想看子允的，却撞见王峰不知冲着谁的笑容。香港六合彩看看东张西望的王秀，知道是对自己，礼貌地回了个笑容。这个笑容好像一炉炼钢水，王峰好像是温度计，那根赤色的水银柱像猫爬树似的从脚底直窜头顶。子允不知王峰为何如此，抱怨麦当劳态度太热情，空调也开得太足。两人端着托盘向座位走时，子允忽然犯难。和王秀一起洗手的周晨晨先回座位坐下，子允犹豫，是不是该跟周晨晨坐一排，这可是千载难逢的好机会，香港六合彩王秀回来看见也不好叫自己离开。子允下定决心，稍微调整脚的角度朝周晨晨旁边的位子走去。香港六合彩站在周晨晨旁边，只觉得心速比麦当劳还辛劳，眼神却固执地问香港六合彩可以坐这吗？周晨晨清澈的眸子闪了一下，嘴角月牙般一翘，看得子允是心花怒放，正要落下屁股，却见身后的王秀正甩着没烘干的手瞪着。子允背脊发冷，悻悻地回到王峰身边，香港六合彩简直悔青了肠子，万分懊悔为什么要回头，为什么要自觉地让开。香港六合彩发誓以后绝不回头，狼就是这样躲在身后咬人脖子的。周晨晨也是失望的模样，碍于女孩的面子没说。香港六合彩希望子允大胆说出来，这样才好顺水推舟让王秀离开。子允没考虑那么多，只在心里骂王秀讨嫌。王峰一改到哪都是中心人物的派头，拘谨得只顾埋头吃汉堡，子允找香港六合彩搭腔，也只象征性点点头，并不进行深层次探究。王峰，你平时不是很活跃吗？现在怎么蔫了？是因为今天的特殊情况有点自卑吧？又是王秀，说时，用下巴指了一下子允。子允赶忙咽下嘴里的可乐，不等王峰继续发愣，王秀，你名字中这个秀字特别好。王秀更来精神，这秀字怎么说都是好的意思，于是丢开王峰等着子允继续。《Y滋味》脱口秀主持人知道吗？你适合去当脱口秀主持人。说着用腿撞王峰的腿，示意香港六合彩一起反戈。王秀不知话里玄机，臭美起来，你这么一说，我倒觉得自己真有这方面天赋呢。所以今天有你在，我都觉得自卑。不过听我外国朋友说，一个三流的女脱口秀主持人，只要会讲话就可以，至于还靠……什么吸引人，就看香港六合彩敢不敢真的作秀了。子允打顿时明显省略了脱的意思，有意思的东西往住会因为含蓄地说出来而更有意思。你……王秀不笨，气红了香港六合彩那按物理学来说很不容易红起来的肥脸。平时很少有谁敢惹香港六合彩

Think Your Network Is Safe? Check Your Printers

scoopnewsgroup

1) Printers are vulnerable endpoints that can be used as an initial entry point for attacks due to weaknesses like default passwords and lack of security configurations. Hackers have successfully used printers to access corporate networks. 2) Most companies have underaddressed printer security, with 61% at an "ad-hoc" or "opportunistic" stage of security maturity. Proper security requires a comprehensive, layered approach across devices, data, documents, and network access. 3) A secure managed print service applies layers of defense including secure devices, device hardening, data encryption, monitoring for threats, and controls over data access. Regular security assessments and password management are also recommended actions.

Alien vault sans cyber threat intelligence

AlienVault

Over the last several years, we have seen that attackers are innovating much faster than defenders are. This trend is steering many companies to look towards cyber threat intelligence (CTI) to help them navigate today’s threatening landscape. SANS conducted a survey this year to explore who is using cyber threat intelligence and how they are using it. The survey collected responses from 326 IT professionals working in a variety of industries, in all sizes and from many different regions. 69% of the respondents reported implementing CTI to some extent, with only 16% planning not to pursue CTI in their environments. Which side of this percentage do you fall into? The infographic below provides some of the key questions to ask when getting started with threat intelligence, along with data from the SANS survey to show you how others are using threat intelligence.

FireHost Webinar: Protect Your Application With Intelligent Security

Armor

Leveraging Change Control for Security

Tripwire

Implementing IT changes is imperative to the infrastructure of a business, but it can also open the door to breaches, viruses and malware, such as ransomware. So, how can organizations manage change effectively, maintain compliance and still reduce security risk? One answer lies in change management across your IT systems. Jeff Lawson, Sr. Director, Product Management at Tripwire, and Geoff Hancock, Principal at Advanced Cybersecurity Group, cover: -How IT operations and security teams can cooperate to improve IT stability and reduce security risk. -How to reduce risks associated with poor configuration management. -How leveraging Tripwire Enterprise for change detection enhances your change control process and keeps your systems, and organization, operating effectively and securely.

Incident Response: How To Prepare

Resilient Systems

Boxing legend Joe Louis famously said, "Everyone has a plan... until they get hit." While grizzled incident response veterans can relate to this sentiment, they all know that thorough preparation is crucial to success. Response procedures that are so thoroughly ingrained that executing them is like muscle memory have a chance, even in the fog of battle. Have you thoroughly prepared your organization to respond when the inevitable happens? How confident are you that it will work in a real-world situation? Proper incident response preparation is key to answering these questions and is frankly the foundation of any incident response capability. This webinar will review critical components of IR preparation including: - IR Underpinnings - Flexible Frameworks - Leadership Challenges Our featured speakers for this webinar will be: - Ted Julian, Chief Marketing Officer, Co3 Systems - Sean Mason, Global Incident Response Leader, CSC

How to implement NIST cybersecurity standards in my organization

Exigent Technologies LLC

The document discusses how to implement standards from the National Institute of Standards and Technology (NIST) Cybersecurity Framework in an organization. It covers the origins and goals of the NIST CSF, how it applies to organizations, the five pillars of the framework (Identify, Protect, Detect, Respond, Recover), common mistakes to avoid when implementing it, and leaves time for questions. The overall purpose of the NIST CSF is to help organizations manage cybersecurity risks through a common language and comprehensive programs.

IT Security Essentials

Cyber Attack Survival

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Cyber Attack Survival

Similar to Cyber Attack Survival (20)

More from Skoda Minotti

More from Skoda Minotti (20)

Recently uploaded

Recently uploaded (20)

Cyber Attack Survival

Editor's Notes