9th October 2009, CERT and NIS - a local corporate perspective, on behalf of MCA for the #20 meeting of the European Regulatory Group held in Malta

1. C.E.R.T.
A corporate perspective
ERG meeting #20
Network and Information Security
MALTA
9th October 2009
Donald Tabone B.Sc (Hons)

2. 2

3. Some of our clients
3

4. The idea behind CERT
• Provide for post incident analysis
• Compliance with laws and regulations
governing breaches
• Preservation of company goodwill
The main corporate drivers for IS & CERT
• Compliance – top down strategy
• Minimise company loss of revenue and
customers
• Company reputation

5. The reality corporate IS faces
• 60% of corporate date resides unprotected
on PC desktops and laptops
• Statistically 1-out-of-10 laptops are stolen
with 12 months of purchase
• 66% of USB thumb drive owners report
losing them – over 60% with private
corporate data on them
• Data problem: Users want to access their
data anytime, from anywhere

6. CCBill’s approach to IS ..1..
• Logical level
– Securing all endpoints – AV alone is no longer effective
– Employing dual-factor authentication for sensitive
servers
– Instilling a security mindset throughout our SDLC
– Disallow USB and WiFi devices company-wide
– Automated user account de/provisioning
– HIDS implementations on secured servers
– Effective patch management
– Full-disk encryption for laptops
– End to end encryption (IPSEC, SSH, SSL etc..)
– Inherently redundant network architectures

7. Inherently redundant network
architectures
AMSTERDAM
PHOENIX
OVERALL OBJECTIVES
• MAXIMISE NETWORK UPTIME
ASHBURN • MINIMISE IMPACT TO OUR SYSTEMS AUSTRALIA

8. CCBill’s approach to IS ..2..
• Organisational level
– Business Continuity Planning (BCP)
– Periodic business impact analysis (BIA)
– Service level agreements -> transfer of risk
– Inherent fail-over strategies
– Separation of duties
– Periodic security awareness training
– Acceptable usage policy (AUP)

9. Security Monitoring
• Augments prevention, doesn’t replace it
• Monitoring Incident response cycle
– Feedback from forensics into monitoring
• Policy review team
• Effective change management procedures
• Typical network monitoring tools
– Snort (IDS)
– Ntop
– Rancid CISCO logs
– Splunk SIEM
• Periodic gap analysis by third parties
• Syslog aggregation from all devices and endpoints

10. Syslog network topology

11. IS implementation challenges
• Balancing security with usability
• Minimising human error
• Instilling a security mindset
• Keeping abreast with technology shifts
• Mitigating and reducing risks to an acceptable
level
• Preventing breaches
• Responding to incidents in a timely manner
• Enforcing confidentiality, integrity and availability

12. CERT challenges
• Post incident analysis is expensive and time
consuming
– Companies are sometimes ready to suffer the
brunt
• Time is money
– Release today, get the business and patch
tomorrow
• Often, business strategies win hands down
over security best practices

13. Q&A
THANK YOU!