Security training for developers, Training ROI, Business case for security Emerging threats How to build an effective training program?

1. Maximizing Security Training ROI
Kartik Trivedi, Symosis

2. Who am I?
• VP / Co-Founder of Symosis, 10+ years in
information security consulting & Training,
USC, Foundstone, McAfee, Accuvant, C-Level
security, etc
• Invited speaker, author and educator
• MBA, MS Comp Sc, CISM, CISA, CISSP
Symosis Confidential 2

3. Table of Content
• Business case for security
• Emerging threats
• How to build an effective training program?
• Case Studies
Symosis Confidential 3

4. The Business Case for Security
Proper security
enables a company
to meet its business
objective by
providing a safe and
secure environment
Symosis Confidential 4

5. Impact of Security Breach
Loss of Revenue Damage to Reputation
Damage to Investor Loss or Compromise of
Confidence Data
Damage to Customer Interruption of Business
Confidence Processes
Legal Consequences
Symosis Confidential 5

6. Dollar Amount Of Loss
Symosis Confidential 6
* CSI 2006

7. Cost of Security Breach
a
t is
er, i
wev rity
l ; ho secu
ivia ting
t tr iga
y is no f mit
urit ost o ises
sec e c
s t of of th pro
m
The co tion com
frac
Symosis Confidential 7
* Aberdeen Group August 2010

8. Security Breach Example Costs
Cost of Recent Customer Records Breach
• $6.5 Million: DSW Warehouse Costs from Data Theft
• $5.7 Million: BJ’s Wholesale Club from Data Breach
Additional impact/cost due to lost customers
• 20% of customers have ended a relationship with a
company after being notified of a breach (Ponemon
Institute)
• 58% said the breach decreased their sense of trust and
confidence in the organization reporting the incident
Symosis Confidential 8

9. Table of Content
• Business case for security
• Emerging threats
• How to build an effective training program?
• Case Studies
Symosis Confidential 9

10. Emerging Threats
Target and Scope
of Damage
Rapidly Escalating Threat to Businesses
GLOBAL
Infrastructure Seconds
Impact
Next Gen
 Flash
REGIONAL
Networks threats
Minutes
 Massive
MULTIPLE Third Gen “bot”-driven
Networks Days  Distributed DDoS
Second Gen Denial of  Damaging
Weeks Service
INDIVIDUAL  Macro payload
Networks
First Gen viruses  Application worms
 Boot  Denial of threats
INDIVIDUAL
Computer
viruses Service  Malware
1980s 1990s Today Future
Symosis Confidential 10

11. Emerging Threats Drivers
Threats becoming increasingly difficult to detect and mitigate
FINANCIAL
Theft & Damage
FAME
THREAT SEVERITY
Viruses and Malware
TESTING THE WATERS
Basic Intrusions and Viruses
1990 1995 2000 2005 WHAT’S NEXT?
Symosis Confidential 11

12. Emerging Attack Methods
Symosis Confidential 12
* SANS 2010

13. Emerging Application Weaknesses
* SANS 2010 Symosis Confidential 13

14. Table of Content
• Business case for security
• Evolving threats
• How to build an effective training program?
• Case Studies
Symosis Confidential 14

15. Why Security Training – Security
Guy view
•
Build in-depth
knowledge to design,
implement, or
operate security
programs
•
Develop skills for
users can perform
their jobs while using
IT systems more
securely
•
Increase security
awareness
Symosis Confidential 15

16. Why Security Training – CEO view
•
Demonstrating care & due diligence
can help indemnify the institution
against lawsuits
•
Dissemination & enforcement of policy
become easier when training &
awareness programs are in place
•
Reduce accidental security breaches
Symosis Confidential 16

17. Step 1: Define Objectives
• Compliance, Regulations
and Governance
• Client & Partner
requirements
• Increase the general level
of security awareness
• Design, develop and
maintain secure IT
infrastructure and
applications
Symosis Confidential 17

18. How is Information Security (Training)
Justified in Corporations Today?
PWC security survey 2010 Symosis Confidential 18

19. Payment Card Industry (PCI)
PCI DSS mandates security
awareness program that
12.6.1: Educate employees
upon hire and at least
annually
12.6.2: Require employees
to annually acknowledge in
writing that they have read
and understood the
company's security policy
and procedure
Symosis Confidential 19

20. Health Insurance Portability and
Accountability Act (HIPAA)
• Mandated annual
privacy and security
training for
management, agents &
contractors
• Security “Marketing”
Efforts
• Annual System-specific
training
Symosis Confidential 20

21. Gramm–Leach–Bliley Act (GLBA)
• Mandates IT Security
Awareness Training for all
employees of financial
service providers (FSPs)
including
– insurance agencies , tax
preparers, finance
companies, collections
agencies,
– leasing agencies, travel
agencies and financial
advisors
Symosis Confidential 21

22. Federal Information Security
Management Act (FISMA)
• FISMA requires federal agencies
to develop, document, and
implement security training
program that educates
personnel, including contractors
and other users, of their
responsibilities in maintaining
information security, complying
with organizational policies and
procedures, and reducing the
risks associated with their
activities
Symosis Confidential 22

23. ISO 27002
• ISO 27002 recommends
designing and
implementing adequate
level of security education
and training to your
organization’s employees,
contractors and third
party users
Symosis Confidential 23

24. Table of Content
• Business case for security
• Evolving threats
• How to build an effective training program?
– Step 1: Define Objectives
– Step 2: Assess Needs
– Step 3: Key Success Factors
– Step 4: Metrics
• Case Studies
Symosis Confidential 24

25. Step 2: Assess Needs
• Identify training
administrator
• Primary responsibility lies
with Chief Information
Security Officer, top
management and
security team
Symosis Confidential 25

26. Assess Needs
Using wrong training
methods can:
 Hinder transfer of
knowledge
 Lead to
unnecessary expense
& frustrated, poorly
trained employees
Symosis Confidential 26

27. Assess Needs
• Who needs to be trained and on what?
– All stakeholders: Security Awareness Training,
Compliance
– Program Managers – Security principles & Design
– Developers – Threats, coding mistakes, secure
software development
– Testers / QA – Security Test Cases
Symosis Confidential 27

28. Table of Content
• Business case for security
• Evolving threats
• How to build an effective training program?
– Step 1: Define Objectives
– Step 2: Assess Needs
– Step 3: Key Success Factors
– Step 4: Metrics
• Case Studies
Symosis Confidential 28

29. Step 3: Key Success Factors
• Build in-house
• Buy ready made
• Classroom Training
• Web Based Training
• Generic vs. Customized
• Hosting
Symosis Confidential 29

30. Build in-house
• Business needs are
unique
• Internal capability,
time, resources
• Proprietary
information or data
needs to be protected
• Complexity of
interface with
company's LMS
Symosis Confidential 30

31. Buy ready made
• Reduce and control
operating costs
• Free internal
resources
• Gain access to
external expertise
• Share risks
Symosis Confidential 31

32. Classroom Training
• Time set aside dedicated to learning
• Costs include course fees, travel,
accommodation and opportunity costs
• Face to face access to a trainer
• Network with other students
Symosis Confidential 32

33. Web Based Training
• Individuals can study at
their own time and pace
• Cost effective
• Easily Customizable
• Easier to measure
student progress and
justify costs
Symosis Confidential 33

34. Generic vs. Customized
• Generic training is cost
effective and focuses on
core security issues like
OWASP Top 10, etc
• Customization provides
training that matches
specific needs for content,
completion requirements,
quiz, policies, and even
employee responsibility
acknowledgment.
Symosis Confidential 34

35. Hosting
• Internal hosting
provides greater
control but could be
resource and cost
intensive
• SAAS service is often
turn key but may limit
scalability and usage
Symosis Confidential 35

36. Table of Content
• Business case for security
• Evolving threats
• How to build an effective training program?
– Define Objectives
– Assess Needs
– Key Success Factors
• Build vs. Buy
• Classroom vs. Web Based
• Generic vs. Customized
• Hosting
– Metrics
• Case Studies
Symosis Confidential 36

37. Step 4: Metrics
• Quiz and survey results
• Content
• People
Symosis Confidential 37

38. Metrics - Quiz and survey results
• Score Results: How did people score?
• Answer Breakdown: How did people answer?
• Attempt Detail: How did a user answer?
Symosis Confidential 38

39. Metrics - Content
• Activity: What was the activity for a content item?
• Traffic: How often was an item viewed?
• Progress: How many slides did people view?
• Popular Content: Which content was viewed the most?
Symosis Confidential 39

40. Metrics - People
• Group Activity: What content did a group view?
• User Activity: What content did a user view?
• Active Groups: Who were my most active
groups?
• Active Users: Who were my most active users?
Symosis Confidential 40

41. Table of Content
• Business case for security
• Evolving threats
• How to build an effective training program?
• Case Studies
Symosis Confidential 41

42. management and custom software
company
• Challenge:
– Ensure secure coding elements have been taught
– Prevent top 10 threats and mitigation techniques
– Meet a time sensitive requirement under a DoD
contract
Symosis Confidential 42

43. management and custom software
company
• Solution: Framework
– Define Objectives
– Implement best practices
– Assess Needs
software security training – Key Success Factors
for Java • Build vs. Buy
– Provide access to training • Classroom vs. Web Based
on demand from a SaaS • Generic vs. Customized
model • Hosting
– Metrics
Symosis Confidential 43

44. Case Study 2: Large financial & Tax
Software Company
• Challenge
– Improve software
quality by eliminating
common mistakes
– Provide foundation
for everyone to ‘own’
security
Symosis Confidential 44

45. Case Study 2: Large financial & Tax
Software Company
• Solution
– Create custom course based
on previously identified risk
and mitigation
– Integrate security cases into
QA lifecycle
– Measure year over year
declines in security related
CRs
Framework
– Define Objectives
– Assess Needs
– Key Success Factors
• Build vs. Buy
• Classroom vs. Web Based
• Generic vs. Customized
• Hosting
– Metrics
Symosis Confidential 45

46. Case Study 3: Large Fitness Center Chain
• Challenge:
– Meet PCI compliance for
integrating secure coding
practices
– Short timeline, small
budget, looking for
turnkey solution
Symosis Confidential 46

47. Case Study 3: Large Fitness Center Chain
• Solution
– Implement JAVA/.NET
secure coding practices
– Address PCI Cardholder
Data requirements within
application development
Framework
– Define Objectives
– Assess Needs
– Key Success Factors
• Build vs. Buy
• Classroom vs. Web Based
• Generic vs. Customized
• Hosting
– Metrics
Symosis Confidential 47

48. Thanks for listening…
Questions?
To try or evaluate Symosis security training for
FREE, please email me at kartik@symosis.com
Symosis Confidential 48

49. Symosis Training Offerings
• Introductory Tracks
– Security Awareness Training
– Introduction to Application Security (covering OWASP, WASC and MS SDL)
• Advanced Tracks
– Security Training for Managers / Architects
– Security Training for Developers - .NET
– Security Training for Developers – JAVA / J2EE
– Security Training for Developers – C/C++
– Security Training for Developers – Flash / FLEX
– Security QA / Testing for Applications
• Regulations & Compliance
– PCI DSS Awareness Training
– PCI DSS Training for Developer
– Security Training for HIPAA
Symosis Confidential 49