Internal Threats in Kazakhstan. Cyber crime. How to defend. Cyber Security

1. How to Defend
against
Internal Threats
Ken Tulegenov, Group Founder
“Information Security Community. Kazakhstan” on LinkedIn
tulegenov@gmail.com
Almaty
November 16
2016

2. Price of Economic Crime

3. Types of Economic Crime

4. Who is a Perpetrator?

5. Risk Map & Methods of Combating

6. Expected future
NOWADAY Situation FUTURE Situation (2 years)

7. Cybercrime Globally

8. Cybercrime in the USA & UK

9. Cybercrime in the USA & UK

10. Cyber Threat Vectors

11. External Attacks aka “Unauthorized Access”

12. Victims

13. Who will be
the next victim?

14. APT Attack Anatomy (Kill-chain)

15. Internal Attacks aka “Insider Threats”

16. Types of Insiders

17. Malicious Insiders

18. Malicious Insider Motivations

19. Insiders by Percentage

20. Cost of Incident (Average USA Stats)

21. Annual cost

22. Incident Timing & Cost

23. What Data is the most convertible to money?

24. Sensitive Data

25. Employee Behaviors

26. Risky Users

27. How to combat effectively?

28. Recommendations

29. Data Source For Monitoring

30. Clear Vision:

31. Attack Anatomy (Kill-chain)

32. Measures for Internal Threats (IMHO) :
Data
Encryption
(FDE, USB,
Backup)
Application
Control
Device Control
HIPS + AV
NGFW
Prevent
(Basic)
DLP
Privilege Rights
Management
Internal NGFW
802.1x
SIEM
Prevent
(Gen)
Database Activity
Monitoring
Users Activity
Monitoring
Database
Encryption
IRM (Information
Rights
Management)
User Behavior
Analysis
Prevent
(Adv)

33. How to manage this ZOO?
 One Security Platform for 1 Security Layer or Products Family
 Easy Administration via Console (User Interface / Configuration / Support)
 Unified Real-time Monitoring for all products

34. What can Intel Security (McAfee) offer?
 SIEM (Security Information Event Management)
 EPP (Endpoint Protection)
 DLP (Data Loss Prevention)
 MDP (Mobile Data Protection / Encryption)

35. Measures for Internal Threats (IMHO) :
Data
Encryption
(FDE, USB,
Backup)
Application
Control
Device Control
HIPS + AV
NGFW
Prevent
(Basic)
DLP
Privilege Rights
Management
Internal NGFW
802.1x
SIEM + Threat
Exchange
Prevent
(Gen)
Database Activity
Monitoring
Users Activity
Monitoring
Database
Encryption
IRM (Information
Rights
Management)
User Behavior
Analysis
Prevent
(Adv)

36. Who uses McAfee (My experience):

37. Reasons for Using:
 Market Presence (Gartner’s “Magic Quadrants”)
 Unified Management (for Different Products)
 Scalability (Branches around the country)
 Integration (with Current / Future Solutions)
 Transparency (for Users)
 Easy to use (for Security Administrators)

38. Thank you for your attention
Any
Questions?