Leveraging Compliance to “Help” Prevent a Future Breach

IOActive, Inc. Copyright ©2018. All Rights Reserved.
Leveraging Compliance to “Help”
Prevent a Future Breach
Kevin J. Murphy, CISSP, CISM, CGEIT
Vice President Cyber Governance
Kevin.murphy@ioactive.com
February 20, 2018, ISACA Monthly Meeting

Agenda
A very interactive discussion – We learn from each other!
• Who is in the room?
• The role of Compliance?
• Lessons from 2017
• Responsive GRC in 2018
• Corporate Risk Score Card

Who is in the room?
• Healthcare
• Energy
• Telecom
• Financial
• Manufacturing
• Government & Utilities
• Retail
• Technology
• Transportation
• Services
• Law Enforcement

Job Roles in the room?
• Audit
• Risk Mgmt
• Governance
• Compliance
• Attorney
• Consulting
• Security
• Executive Leadership
• IT Engineering
• New to the Industry
• New to the ISACA

What is the Purpose of the Compliance Mgmt?
• Confirm adherence to a standard or regulatory
requirement: e.g. ISO, NIST, PCI-DSS, GDPR
• Verification: Audit
• Transfer Risk
So how are we doing?

2017 Compliance Mgmt.
• The problem with standards and regulations is
it takes ~3 years for a standard to be
implemented
• That is not responsive enough to protect you
from “new” attacks
• It “may” protect you from known attacks of the
past.
So what do we do?

Why would I attack your industry?
• What am I after?
– Your IP (Intellectual Property)
– Client PII (Personally identifiable information)
– “Your Employee” PII
– I can sell this info for credit fraud
– To extort money from you (Ransomware)
– To punish your government in a geopolitical
disagreement
– Cyberwar – Economic Disruption

Lets look at the big attacks from 2017
• Ransomware : Wannacry, etc.
• Equifax: Breach
• How many of you have incorporated lessons learned from these attacks?
• What did you change in your governance program as a result?

Ransomware?
• Ransomware - Ransomware is a type of malicious
software that threatens to publish the victim's data
or perpetually block access to it unless a ransom is
paid.
• Recovering your files without the decryption key is
unlikely
• Digital currencies such as Bitcoin are used for the
ransoms, making tracing and prosecuting difficult.

Who is attacking?
On October 24th, Bad Rabbit targets
Windows machines, impersonating as an
Adobe Flash update. The cyber attack has
seen computers go down in Russia, Ukraine,
Germany and Turkey.

Ransomware?
• WannaCry worm traveled between unpatched
computers without user interaction.
• March 14, 2017 - Microsoft issued critical security
bulletin MS17-010
• May 12, 2017 - WannaCry launched
“The answer is to patch your systems earlier!”
What is your patching policy for a critical
patch?

The real threat from Ransomware
• The bad guys are on your network!
• Your IP or data is at risk of compromise,
publication or deletion
• They can make your network unusable
which puts your business viability at risk
Anything new here?

Game Changing Attack Inflection Points
• APT – Nation State espionage
• Stuxnet – Embedded and SCADA systems
attack Nation State targeted attacks
• Heartbleed – 3rd party software and network
appliances
• Ransomware – WannaCry, Petya, notPetya,
BadRabit, .etc. Nation State cyber attacks
“Can GRC help?”

Cyber breach at Equifax affect 143M U.S.
consumers
• Occurred from mid-May through July 2017 and
primarily: names, social security numbers, birth dates,
addresses and some driver's license numbers
• Credit card numbers for roughly 209,000 consumers
• Equifax Canada said 100,000 Canadians affected.
– Names, addresses, social insurance numbers (SIN) and,
in limited cases, credit card numbers.
– Equifax Canada has been unable to provide clarity on
who was impacted

Summary
• Both breaches could have been prevented by existing
compliance controls.
– Patch Mgmt: Ask detailed questions about IT Inventory
and applying patches within guidelines. Note exceptions
and track remediation plans
– Monitoring: Equifax was not monitoring outbound traffic.
A comprehensive governance of their monitoring plans
would have perhaps detected this massive breach.

Responsive GRC for 2018
1. Traditional regulatory and standards compliance
2. NIST Cybersecurity Framework
3. Proactive Threat Management
4. GRC Reporting as part of the overall Corporate
Risk Scorecard to the Board of Directors

Cybersecurity Framework: Identify
• Identify your Critical Business Information: IP,
Strategic Plans, Financial Data, Customer Data,
Employee Data, etc. Protect it with a defense in
depth strategy
• IT Inventory Mgmt: Know your IT inventory better
than your attacker. They will find the one server or
appliance you didn’t patch.
• Don’t store your Risk Assessments in clear view of
your attacker. Secure those SharePoints!

Proactive Threat Management
• When a new attack occurs in the news, activate your
incident response team. Ask:
– “Can this happen here?”
– “How are we protected and where are we vulnerable?”
– “How can you help your IT Engineering teams?”

Proactive Threat Management
• Threat Models: Use them – IoT devices to applications
and your supply chain.
• Update Threat Models and your KPIs after a reported
threat. Learn from the attacks on other companies
• Incorporte best practices

Do you have a
mobile app
policy?
Biometrics
App
Store
Cloud
ArchitectureSystem
on chipOS
Device
Network

Cyber Security Framework Scorecard KPIs
Top 5 Risks

Your Board of Directors

• Cyberprotection is no longer a technical issue; it is a business
issue requiring board attention.
• Does the board get direct feedback from the CISO who can
explain in “business and strategic terms” the cyber risk and
controls approach?

• Is sufficient attention given to the ability to defend against
intrusions as well as the ability to recover and restore essential
functions and services?
• Is the board routinely informed about the potential material
operational risk and risk mitigation strategies as well as
incidents that could impact the brand?
• To what extent have essential services and functions been
identified and programs implemented to provide for their
resilience in the event of a disruption or cyber incident?

Good Reading

Call to Action
• Evaluate your GRC program effectiveness
– Does it allow you to meet your regulatory
requirements?
– Does it truly measure your enterprise risk profile?
– Is it agile and adaptable to new threats?
– Using a scorecard to track your progress?
– Is it more than “checkbox?”

Call to Action
• Learn from other industries as they might get hit before
yours.
• Use the NIST Cybersecurity framework
• Evaluate your threat models with the latest attack vectors.
Ask, “Can that happen here?”
• Know your IT Inventory and patch status
• Cybersecurity Risks need to be reported to your BoD
• Test your BCM plans with a cyber attack scenario

Thank You

GDPR
(General Data Protection Regulation) EU
• The US and Canada will have something similar in the
future so plan for it now.
• Heads up: GDPR includes penalties
• https://en.wikipedia.org/wiki/General_Data_Protection_
Regulation#Sanctions

Leveraging Compliance to “Help” Prevent a Future Breach

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Leveraging Compliance to “Help” Prevent a Future Breach

Similar to Leveraging Compliance to “Help” Prevent a Future Breach (20)

Recently uploaded

Recently uploaded (20)

Leveraging Compliance to “Help” Prevent a Future Breach

Editor's Notes