Download as PDF, PPTX
![Human Triggers/Motivation
• “Just get it done…”
– Project Management -> …as planned
– Business -> … to get functionality. [What details?]
– Technical -> .. and move to next task. [What impact?]
– Security -> … so it doesn’t expose us. [What impact?]
– Vendors -> … to keep business going.
• Beware Underlying Economics
• Externalities:
– security imposing controls
– business underscoping actual risks
• Moral hazard:
– Undue assumptions about risk model
Cybersecurity & Project Management - PMI-SOC
Sep 26th, 2015](https://image.slidesharecdn.com/cybersecurityandprojectmanagement-151108041744-lva1-app6892/75/Cybersecurity-Project-Management-7-2048.jpg)
![Project Phase: Execution(1)
Building
• Dealing with Externals
– Sharing Information
– User and Access Management
• Security configurations
– Hardening
– Defaults!
• Security [unit] tests
– Other security testing?
• Temporary files
Cybersecurity & Project Management - PMI-SOC
Sep 26th, 2015](https://image.slidesharecdn.com/cybersecurityandprojectmanagement-151108041744-lva1-app6892/75/Cybersecurity-Project-Management-11-2048.jpg)
Uploaded byFernando Montenegro
Cybersecurity & Project Management
The document discusses the integration of cybersecurity within project management, emphasizing the importance of addressing security early in the project phases to reduce costs and risks. It outlines various project phases including initiation, planning, execution, and closing, highlighting the need for security assessments and compliance considerations. Furthermore, it emphasizes the importance of understanding security constraints affecting scope, time, quality, and cost while advocating for a proactive approach to security practices in project management methodology.
More Related Content
Similar to Cybersecurity & Project Management
![Vibe Coding vs. Spec-Driven Development [Free Meetup]](https://cdn.slidesharecdn.com/ss_thumbnails/vibecodingvsspecdrivendevelopment-251209105622-43f455e7-thumbnail.jpg?width=640&height=640&fit=bounds)
Cybersecurity & Project Management
- 1. Cybersecurity & Project Management FernandoMontenegro, CISSP @fsmontenegro
- 2. Why Are WeHere? • Security is the new black • Security is an issue of technical debt • Challenges – How to Deliver "Secure" – How to Deliver "Securely" – How to Deliver "Security" Cybersecurity & Project Management - PMI-SOC Sep 26th, 2015
- 3. About me @fsmontenegro • SalesEngineer at Vendor • PS Delivery (SME Network Security) – 12+ yrs • CompSci ’94 • Greying hair • Curious – Finance (DIY) – Economics (EMH, Behaviour) – Data Science (Coursera) Cybersecurity & Project Management - PMI-SOC Sep 26th, 2015
- 4. About this talk •Take a look at where things can go wrong – Put things into context… • Please “do” security early! – Cheaper (maybe) – More predictable – But beware externalities… • SDLC Security != Project Security • Slides will be up at http://www.slideshare.net/fsmontenegro Cybersecurity & Project Management - PMI-SOC Sep 26th, 2015
- 5. Project Management Phases Cybersecurity& Project Management - PMI-SOC Sep 26th, 2015
- 6. Project Manager objectives AchieveObjectives Respect Constraints • Scope • Time • Quality • Cost Optimize Allocations Cybersecurity & Project Management - PMI-SOC Sep 26th, 2015
- 7. Human Triggers/Motivation • “Justget it done…” – Project Management -> …as planned – Business -> … to get functionality. [What details?] – Technical -> .. and move to next task. [What impact?] – Security -> … so it doesn’t expose us. [What impact?] – Vendors -> … to keep business going. • Beware Underlying Economics • Externalities: – security imposing controls – business underscoping actual risks • Moral hazard: – Undue assumptions about risk model Cybersecurity & Project Management - PMI-SOC Sep 26th, 2015
- 8. Security Concepts • Confidentiality,Integrity, Availability, … • Terminology – Vulnerabilities – Threats – Risk • Compliance != Security Cybersecurity & Project Management - PMI-SOC Sep 26th, 2015 Nov 2015!
- 9. Project Phase: Initiation •Identify security needs early! – Deliverable needs – Own project needs • Early involvement from Security • Key areas: – Internal/External – Regulatory Needs? – Participants Cybersecurity & Project Management - PMI-SOC Sep 26th, 2015
- 10. Project Phase: Planning •Detailed security requirements – Specific regulatory needs, C-I-A, platforms, … • Security resources assigned – SMEs – Advocates • Assess risk, choose controls Cybersecurity & Project Management - PMI-SOC Sep 26th, 2015
- 11. Project Phase: Execution(1) Building •Dealing with Externals – Sharing Information – User and Access Management • Security configurations – Hardening – Defaults! • Security [unit] tests – Other security testing? • Temporary files Cybersecurity & Project Management - PMI-SOC Sep 26th, 2015
- 12. Project Phase: Execution(2) Delivering •Ongoing team access • Change Window red flags! • Preparation for Ops – Training – Incident Plans Cybersecurity & Project Management - PMI-SOC Sep 26th, 2015 Network – firewalls, VPNs “allow ip any any” allow “all” network ports weak preshared keys Windows or UNIX systems “Everyone R/W”, “chmod 777”, admin/root processes, … Identity & Access Management copy user profiles use local passwords
- 13. Project Phase: Monitoring •Sharing Info with Externals – Email threads – “Fog of War” • Secure Communications • Storage Considerations Cybersecurity & Project Management - PMI-SOC Sep 26th, 2015
- 14. Project Phase: Closing •Decommission – Lost Data – Information Wipe • Cancel Accounts, change PWs • Transition to Operations – Security Operations Cybersecurity & Project Management - PMI-SOC Sep 26th, 2015
- 15. Security Impact onConstraints - Scope • Need to understand security across deliverable • Fixing vulnerabilities adds to scope • Compliance mandates affect scope – PCI DSS Cybersecurity & Project Management - PMI-SOC Sep 26th, 2015
- 16. Security Impact onConstraints - Time • Extra time to review/fix security findings • Extra time to find out how things work • Time pressure to share info – Externals Cybersecurity & Project Management - PMI-SOC Sep 26th, 2015
- 17. Security Impact onConstraints - Quality • Security is a “latent construct” – Can’t be observed directly, only inferred • QA != Security – But can really help… • Measuring Security is Expensive/Uncertain – Vulnerability Assessment – Penetration Test Cybersecurity & Project Management - PMI-SOC Sep 26th, 2015
- 18. Security Impact onConstraints - Cost • Specialized resources cost $$$ • Opportunity costs of fixing, troubleshooting • Flipside – Security Cost – “Oversecure” Cybersecurity & Project Management - PMI-SOC Sep 26th, 2015
- 19. Biggest Issues forPM • Information Leakage during Project • Insufficiently Secure Design • Improperly Configured Systems Cybersecurity & Project Management - PMI-SOC Sep 26th, 2015
- 20. WRAP UP Cybersecurity &Project Management - PMI-SOC Sep 26th, 2015
- 21. Things to keepin mind… • local user databases • git/cvs folders, temporary files • something wide open “for testing only" • Defaults! Cybersecurity & Project Management - PMI-SOC Sep 26th, 2015
- 22. Things to keepin mind… • Leaked (and shared) credentials – AWS keys • Get Security Testing done right – Unit Tests, Vuln. Assessment, Pen Tests, Audits • Remediation impact on schedule! • Must understand end-to-end Cybersecurity & Project Management - PMI-SOC Sep 26th, 2015
- 23. PM Cybersecurity Success •Build Security Practices in PM Methodology • Understand your security needs ASAP – Security starts at Project Initiation – Security Architect & Privacy Officer • Build security on your team – Security SME & Security Advocates • Build Time (&$) for remediation • Beware "change window" blues • Don’t ignore economics. • Change defaults! Cybersecurity & Project Management - PMI-SOC Sep 26th, 2015
- 24. Resources • SANS SecurityBest Practices for IT Project Managers – https://www.sans.org/reading-room/whitepapers/bestprac/security-practices-project-managers- 34257 • Information Security & Privacy as part of Project Management – http://www.axenic.co.nz/2015/03/information-security-privacy-as-part-of-project-management/ • Software Security for PMs – http://www.slideshare.net/denimgroup/software-security-for-project-managers-what-do-you- need-to-know • Security Efforts into Agile SDLC – http://dadario.com.br/slides/SecureBrasil2014_Anderson_Dadario__EN.pdf • OWASP - http://www.owasp.org • Brian Krebs - https://krebsonsecurity.com/ Cybersecurity & Project Management - PMI-SOC Sep 26th, 2015