This presentation was delivered to Minnesota manufacturing CEOs who attended the April 2019 Enterprise Minnesota event. Manufacturing companies face real information security threats that they need to prepare for.

1. INFORMATIONSECURITY &
MANUFACTURING
EvanFrancen–CEO& Founder, FRSecure
February 19, 2019
-----------

2. • Introduction
• Questions Everyone Should Be Able to Answer
• What Is Information Security?
• How Is Manufacturing Different from Other Industries?
• Is Your Company a Target?
• What’s Your Role?
• Questions You Have for Me
INFORMATION SECURITY & MANUFACTURING
INTRODUCTION
Topics/Agenda
1

3. Speaker: EvanFrancen,CEO& Founder ofFRSecure andSecurityStudio
• Co-inventor of SecurityStudio®, FISA™, FISASCORE® and Vendefense™
• 25+ years of “practical” information security experience (started as a Cisco
Engineer in the early 90s)
• Have worked with 100s of companies; big (Wells Fargo, US Bank, UHG, etc.)
and small
• Have written more than 750 articles about information security
• Developed the FRSecure Mentor Program; six students in 2010/360+ in 2018
• Dozens of television and radio appearances; numerous topics
• Advised legal counsel in very public breaches (Target, Blue Cross/Blue Shield,
etc.)
INTRODUCTION
2
INFORMATION SECURITY & MANUFACTURING
AKA: The “Truth”

4. Authorof UNSECURITY
INTRODUCTION
3
INFORMATION SECURITY & MANUFACTURING

5. • Information Security Consulting and Management company. It’s all we do.
• Our core services include:
• Security Risk Analysis – using FISASCORE®
• Social Engineering Services
• Penetration Testing Services
• PCI QSA Services
• Incident Management Services
• HITRUST Services
• Information Security Training & Awareness
• vServices (vCISO, vISO, and vISA)
• Methodology fanatics, mentoring champions, and product agnostic.
INFORMATION SECURITY & MANUFACTURING
INTRODUCTION
FRSecure
4

6. INFORMATION SECURITY & MANUFACTURING
INTRODUCTION
Let’s get started, but first a joke.
5
What do you call
fake spaghetti?

7. INFORMATION SECURITY & MANUFACTURING
INTRODUCTION
Let’s get started, but first a joke.
6
What do you call
fake spaghetti?
An impasta.

8. • Ask 10 “experts” the same question.
• 10 different answers
• We’ve got egos, so we all think ours is better. UGH!
• Simplify! – Complexity is the enemy of information security – Remember this.
• Our (my tribe’s) definition…
INFORMATION SECURITY & MANUFACTURING
QUESTIONS EVERYONE SHOULD BE ABLE TO ANSWER
Back to work…What is “information security?”
7

9. • Information security is managing risk to information…
• Confidentiality
• Integrity
• Availability
• Using…
• Administrative,
• Physical, and
• Technical controls.
INFORMATION SECURITY & MANUFACTURING
QUESTIONS EVERYONE SHOULD BE ABLE TO ANSWER
What is “information security?”
8

10. • Confidentiality
• Integrity
• Availability
• Using…
• Administrative,
• Physical, and
• Technical Controls.
Information security is managing risk to information…
9
• TRUTH: Information security is about MANAGING risk,
NOT ELIMINATING risk. Much, much different.
• Risk is an overused word, but the meaning is the
likelihood of something bad happening and the impact if it did.
• You manage risk every day. Most of this risk management is
automatic and even subconscious.
• TRUTH: Security incidents and breaches are not completely
preventable and should be expected.
• No matter what you do, you cannot prevent all bad things.
• What you can’t prevent, you should be able to detect and
respond to.
INFORMATION SECURITY & MANUFACTURING
QUESTIONS EVERYONE SHOULD BE ABLE TO ANSWER

11. • Confidentiality
• Integrity
• Availability
• Using…
• Administrative,
• Physical, and
• Technical Controls.
INFORMATION SECURITY & MANUFACTURING
QUESTIONS EVERYONE SHOULD BE ABLE TO ANSWER
Information security is managing risk to information…
10
• Confidentiality is about keeping things secret.
• Only the people/programs who are authorized to access
information are permitted to access information.
• Most people think that this is the purpose of security,
but as you can see, it’s only one purpose.
• TRUTH: Everybody’s got secrets. Everybody.
• Personal – Social Security Number, passwords, things that
go on in their homes, etc.
• Business – Intellectual property, customer information, etc.
• This is where privacy lives…

12. • Confidentiality
• Integrity
• Availability
• Using…
• Administrative,
• Physical, and
• Technical Controls.
INFORMATION SECURITY & MANUFACTURING
QUESTIONS EVERYONE SHOULD BE ABLE TO ANSWER
Information security is managing risk to information…
11
• Integrity is about making sure the information is accurate.
• This is an oft-overlooked part of the definition.
• You make decisions every day based on the information you
receive and consume.
• TRUTH: Poor information = poor decisions.
• Wouldn’t it be nice (sort of) to:
• Change the balance of your bank account (to the positive)?
• Change your grades at school?
• Influence (or manipulate) others with false information?

13. • Confidentiality
• Integrity
• Availability
• Using…
• Administrative,
• Physical, and
• Technical Controls.
INFORMATION SECURITY & MANUFACTURING
QUESTIONS EVERYONE SHOULD BE ABLE TO ANSWER
Information security is managing risk to information…
12
• Information must be made available to (authorized) people when
they need it.
• TRUTH: A business is in business to make money. If we make it harder to
make money, we’ve done something wrong.
• Common attacks against availability include things like ransomware,
denial of service, etc.

14. • Confidentiality
• Integrity
• Availability
• Using…
• Administrative,
• Physical, and
• Technical Controls.
INFORMATION SECURITY & MANUFACTURING
QUESTIONS EVERYONE SHOULD BE ABLE TO ANSWER
Information security is managing risk to information…
13
• How do we protect confidentiality, integrity, and availability?
• We use different types of controls.

15. • Confidentiality
• Integrity
• Availability
• Using…
• Administrative,
• Physical, and
• Technical Controls.
INFORMATION SECURITY & MANUFACTURING
QUESTIONS EVERYONE SHOULD BE ABLE TO ANSWER
Information security is managing risk to information…
14
• Administrative controls apply to the “people part” of security.
• Policies, procedures, training, awareness, etc. are all
administrative controls.
• People are always the greatest risk.
• It’s easier to go through your secretary than it is your firewall.
• TRUTH: Information security is NOT an IT issue. It’s a business issue.
• Policies get a bad rap because people stink at using them.
• They’re the rules, think a board game.
• They’re not supposed to be read by everyone.
• They’re reference documents.
• They’re supposed to reflect you (your rules).

16. • Confidentiality
• Integrity
• Availability
• Using…
• Administrative,
• Physical, and
• Technical Controls.
INFORMATION SECURITY & MANUFACTURING
QUESTIONS EVERYONE SHOULD BE ABLE TO ANSWER
Information security is managing risk to information…
15
• Physical controls are used to protect and detect physical access to the
things you want to protect.
• Physical controls are also used to respond to unauthorized access.
• It doesn’t matter how well your firewall works if someone can steal your
server.
• TRUTH: Information security is NOT an IT issue. It’s a business issue.

17. • Confidentiality
• Integrity
• Availability
• Using…
• Administrative,
• Physical, and
• Technical Controls.
INFORMATION SECURITY & MANUFACTURING
QUESTIONS EVERYONE SHOULD BE ABLE TO ANSWER
Information security is managing risk to information…
16
• This is the IT part of information security.
• This is also what many people think is “information security,” but
they do so at their own peril.
• Technical controls include things like passwords, firewalls, anti-virus
software, etc.
• TRUTH: Information security is NOT an IT issue. It’s a business issue.

18. • Confidentiality
• Integrity
• Availability
• Using…
• Administrative,
• Physical, and
• Technical controls.
INFORMATION SECURITY & MANUFACTURING
QUESTIONS EVERYONE SHOULD BE ABLE TO ANSWER
Informationsecurity is managingrisk toinformation…
17
• So, there you have it.
• What does this mean for you?
• Let’s recap the truths quickly:
• TRUTH: Information security is about MANAGING risk,
NOT ELIMINATING risk.
• TRUTH: Security incidents and breaches are not completely
preventable and should be expected.
• TRUTH: Everybody’s got secrets. Everybody.
• TRUTH: Poor information = poor decisions.
• TRUTH: A business is in business to make money.
• TRUTH: Information security is NOT an IT issue. It’s a business issue.

19. • In one respect, it’s not. The definition we just covered applies in all industries.
• Manufacturing is lagging behind other industries.
• In terms of understanding security.
• In terms of managing risk. Most manufacturing companies have never done
an information security risk assessment, thus management does not know
their current status or where there most significant risk is.
• The average FISASCORE® for manufacturing is 608.74.
INFORMATION SECURITY & MANUFACTURING
HOW MANUFACTURING IS DIFFERENT FROM OTHER INDUSTRIES
How Is ManufacturingDifferent fromOtherIndustries?
18

20. • Manufacturing is one of the most heavily targeted industries.
• Targeted by nation-state actors and money-motivated “hackers”
• Reasons:
• Ease of compromise.
• Easy access to vast amounts of intellectual property.
• Ransomware has a great impact – more likely to pay.
• Successful financial attacks are more likely; against executives and
accounting personnel.
INFORMATION SECURITY & MANUFACTURING
HOW MANUFACTURING IS DIFFERENT FROM OTHER INDUSTRIES
How Is ManufacturingDifferent fromOtherIndustries?
19

21. • Most likely, the answer is yes.
• It’s reality. We’re all targets.
• False logic tells you that you have nothing that anyone would
want.
• This instills fear in some people, but that’s OK.
• Fear can be healthy.
• Fear motivates people.
• Fear dictates what actions you take.
• The more real the threat, the more heroic your actions.
INFORMATION SECURITY & MANUFACTURING
IS YOUR COMPANY ATARGET?
IsYourCompany a Target?
20

22. • You can’t possibly manage something that you don’t
understand.
• An information security risk assessment is absolutely the
place to start.
• Depends on your role within the company.
• Your failure to manage security well doesn’t only affect
you.
INFORMATION SECURITY & MANUFACTURING
WHAT’S YOUR ROLE?
If information securityis about managing risk…
21

23. • Executive Management – ultimately security is your responsibility (NOT IT’s).
• You must understand
1) current state,
2) future/planned state,
3) when you’re going to get there, and
4) how much it will cost.
• You set the rules and control the culture.
• Information Security Personnel – Provide accurate risk data to Executive Management, assist in
risk decision-making, and manage risk to the best of your ability within the context of
management’s direction.
• Everybody else – Play by the rules.
INFORMATION SECURITY & MANUFACTURING
WHAT’S YOUR ROLE?
Some examples…
22

24. 1. Current state – what’s your current FISASCORE®?
2. Future/planned state – what’s your target FISASCORE®?
1. Taking the results of the original assessment, decisions are made.
2. The decisions are: what are we going to do, when are we going to do it, and who’s
going to do it? –This is called the roadmap (or strategic plan). – The planned state
should not be a shot in the dark.
3. When you’re going to get there (the planned state).
4. How much it will cost (your budget).
INFORMATION SECURITY & MANUFACTURING
WHAT’S YOUR ROLE?
How we do it…
23

25. • Defensibility is critical.
• Assumed breach mentality.
• What would a reasonable person do in the same situation?
• When a bad thing happens, what do you have to defend yourself from:
• Customers.
• The press.
• Opposing counsel.
INFORMATION SECURITY & MANUFACTURING
WHAT’S YOUR ROLE?
How we do it…
24

26. Questions?
Hopefully about security.
Thank you!
For a copy of this presentation,
text ENTMN19 to 555888
Evan Francen – https://evanfrancen.com
• FRSecure – https://frsecure.com
• evan@frsecure.com
• @evanfrancen
INFORMATION SECURITY & MANUFACTURING
QUESTIONS?
25
Now you know the basics.
...and the basics are what’s most important.