H. Czamai presented on information security at AVL, an automotive engineering company. AVL has implemented an Information Security Management System (ISMS) based on ISO 27001 to ensure information security through organizational and technical measures. This includes an ISO 27001 certification, security awareness training, global policies, audits, and technical controls like firewalls, access management, and encryption. AVL also manages risks through threat detection and vulnerability management processes. The presentation discussed AVL's global operations, top security threats, and cloud security strategy using Microsoft services like Azure and Intune.

1. H. Czamai
AVL List GmbH
(Headquarters)
Public
INFORMATION SECURITY @ AVL

2. H. Czamai | | 20 März 2017 | 2Public
AGENDA
„Aus dem Leben eines IT-Security-Verantwortlichen“
 Introduction AVL
 ISMS @ AVL
 How AVL survives in the Cybersecurity Jungle

3. H. Czamai | | 20 März 2017 | 3Public
 AVL achieves unique results in regards
to the development and improvement of
all types of powertrains as well as in the
field of measurement and test
technology.
 AVL – over 65 years’ experience
 Involved in more than 1,500 engine
development projects
 More than 4,000 engine testbed
installations
OUR EXPERIENCE FOR YOUR SUCCESS

4. 4Public
ENTERPRISE DEVELOPMENT AUTOMOTIVE
5 powertrain
elements
EXPERIENCE
More than 65
years !
GLOBAL FOOTPRINT
30 engineering locations
 >220 test beds
 Global customer support
network
ONE
PARTNER
INNOVATION 1500
granted patents
RESEARCH 10% of
turnover in-house R&D
GROWTH
SALES
 1995:
0.15 billion €
 2015:
1.27 billion €
 prev. 2016:
1.41 billion €
STAFF
 8,050 employees
 65% engineers &
scientists
0
100
200
300
400
500
600
700
800
900
1.000
1.100
1.200
1.300
1.400
1.500
Mio. €

5. H. Czamai | | 20 März 2017 | 5Public
SOLUTIONS FOR ALL CUSTOMER SEGMENTS
Passenger
Cars
Racing2-Wheelers
Construction Commercial
Vehicle
Agriculture
Locomotive Power PlantsMarine
Powertrain Engineering
Simulation & Testing
Development Platform

6. H. Czamai | | 20 März 2017 | 6Public
AVL – A GLOBAL PARTNER
*Headquarters in Graz
Austria*
Croatia
Czech Republic
France
Germany
Great Britain
Romania
Russia
Slovenia
Spain
Sweden
Turkey
Hungary
Italy
Poland
South America
Argentina
Brazil
Asia
China
India
Indonesia
Japan
Korea
Malaysia
Taiwan
Thailand
Vietnam
Australia
North America
Mexico
USA
Europe

7. H. Czamai | | 20 März 2017 | 7Public
AVL POWERTRAIN – A NETWORK OF
TECHNICAL CENTERS
*Headquarters in Graz
Austria*
France
Germany
Great Britain
Hungary
Sweden
Turkey
South America
Brazil
Asia
China
India
Japan
Korea
Australia
North America
USA
Europe
Ann Arbor, USA
Plymouth, USA
Paris, FRA
Lake Forest, USA
Sao Paulo, BRA Sydney, AUS
Gotenborg, SWEBudapest, HUN
Istanbul, TUR
Basildon, UK
Shanghai, CHN
Remscheid, GER Munich, GER
Stuttgart, GER
Regensburg, GERNeuenstadt, GER
Ingolstadt, GERCoventry, UK
Tianjin, CHN
Steyr, AUT
Haninge, SWE
Södertälje,SWEHQ Graz, AUT
+ another
9 Engineering
Offices
Delhi-Gurgaon, IND
Tokyo, JPNSeoul, KOR

8. H. Czamai | | 20 März 2017 | 8Public
ORIENTATION FOR AN INNOVATIVE FUTURE
AFFORDABLE
CO2
REDUCTION
AVL PROVIDES INNOVATIVE SOLUTIONS - SUPPORTING OUR CUSTOMERS
TO MEET THESE MAJOR CHALLENGES
MASTERING
SPEED &
COMPLEXITY
TO MARKET
STRATEGIC
GLOBAL
PARTNER

9. H. Czamai | | 20 März 2017 | 9Public
CHALLENGES FOR INFORMATION SECURITY
A STRUCTURED APPROACH (E.G. ISO27001 ISMS) ALLOWS US TO ENSURE
THE NECESSARY LEVEL OF INFORMATION SECURITY
MASTERING
SPEED &
COMPLEXITY
TECHNOLOGY
THREATS
GLOBAL SETUP
CULTURES
AWARENESS

10. H. Czamai | | 20 März 2017 | 10Public
Internal
Hannes Czamai
Global IT Security Officer
hannes.czamai@avl.com
Phone: +43 316 787 744, Fax: +43 316 787 1473
Mobile: +43 664 4225512, Office: +43 316 787 1768
AVL LIST GMBH
A-8020 Graz, Hans-List-Platz 1
www.avl.com
http://www.xing.com/profile/Hannes_Czamai/xc
www.linkedin.com/in/hannes-czamai
10

11. H. Czamai | | 20 März 2017 | 11Public
ISO 27001: THE INFORMATION SECURITY
MANAGEMENT SYSTEM (ISMS)
INORMATION SECURITY
is more than
IT SECURITY

12. H. Czamai | | 20 März 2017 | 12Public
Internal
ISMS: INFORMATION SECURITY APPROACH
12
Organizational Measures
ISO 27001 Certification, Awareness trainings, IT processes, HR processes,
Contract management, Global policies, Audits, Affiliate assessments, Background checks,
Security clearance, Comprehensive backup & disaster concepts, Phy. zone concept, …
Technical Measures
Port security, LAN / WAN / Firewall management
Access- and identity management (FIM) + AD + Policies
Server / Storage / Datacenter (Server room) standards,
Client COE / CAx Hardware + Software standards,
Patch-, Antivirus-, Antimalware- Management,
Access control system, Video surveillance, Fences,
and many more …
technical : organizational = 30% : 70%

13. H. Czamai | | 20 März 2017 | 13Public
ORGANIZATION: FROM ACTING TO REACTING
Reacting IT
IT IT
Business
Acting IT
User
User SECURITY
Reacting Security
Acting Security

14. H. Czamai | | 20 März 2017 | 14Public
AVL PROCESS LANDSCAPE –
SECURITY & PROCESSES
Information Security Processes
IT / Operational Processes
Business Processes

15. H. Czamai | | 20 März 2017 | 15Public
AVL ISMS – IT RISK MANAGEMENT
Information
Objects
IT System
Business
Process
Estimate
Damage
Model
IT Service
Rate
C I A
GAP
Analysis
Measures
Problem Mgmt.
Sensitivity =
Priority
RATING
BBB

16. H. Czamai | | 20 März 2017 | 16Public

17. H. Czamai | | 20 März 2017 | 17Public
TOP THREATS
 Lack of awareness
 Industrial espionage
 Data loss or theft
 Social engineering
 Travelling user
 Vulnerabilities in Apps
 CEO/Fake President Fraud Attack
 Crypto Locker + Ransomware
 DDOS blackmail
 APTs

18. H. Czamai | | 20 März 2017 | 18Public
VULNERABILITY / THREAT MANAGEMENT
Permanent detection of
malicious activities

19. H. Czamai | | 20 März 2017 | 19Public
ATA – THE SWISS KNIFE AGAINST DC ATTACKS
Detects with help of machine learning:
 Brute force
 Sensitive account exposed in plain text auth.
 Service exposing accounts in plain text auth.
 Honey Token account suspicious activities.
 Unusual protocol implementation.
 Malicious Data Protection Private Information Request.
 Abnormal Behavior (pass the hash, pass the ticket).

20. H. Czamai | | 20 März 2017 | 20Public
CLOUD STRATEGY
Customer Requirements
Legal Requirements
Identity / Access Management
Technical Measures (crypt)
Audit- Log Management
Risk Analysis
Contract Management

21. H. Czamai | | 20 März 2017 | 21Public
CLOUD PROJECTS WITH MICROSOFT
AD Federation Service
AVL Streaming
AVL Software Repository
Azure Information Protection
Cloud encryption
MS Intune MDM

22. H. Czamai | | 20 März 2017 | 22Public
ARE WE SECURE ENOUGH?
YES … BUT IT IS NOT ONLY A MATTER OF TECHNOLOGY
Photo: Tobias Hellsten

23. H. Czamai | | 20 März 2017 | 23Public
TECHNOLOGY

24. www.avl.com
THANK YOU