Download to read offline
Uploaded byErnest Staats
Privacies are Coming
The document outlines key strategies and best practices for cybersecurity, emphasizing the importance of data privacy and accountability within organizations. It stresses the necessity of utilizing established frameworks, such as NIST and CIS, for effective risk management and the need for continuous training and communication regarding data security. It also highlights the significance of a robust data protection culture, regular assessments, and proactive incident response planning.
More Related Content
Similar to Privacies are Coming
![Getting Started with Apache Spark: Big Data Made Simple [Free Meetup]](https://cdn.slidesharecdn.com/ss_thumbnails/apachesparkgettingstarted-260203175547-8361bcc3-thumbnail.jpg?width=640&height=640&fit=bounds)
Privacies are Coming
- 1. THE PRIVACIES ARECOMING! THE PRIVACIES ARE COMING! Ernest Staats MSIA, CISSP, CEH… estaats@Networkpaladin.org https://networkpaladin.org
- 2. LEGAL DISCLAIMER: Nothing inthis handout or presentation constitutes legal advice. The information in this presentation was compiled from sources believed to be reliable for informational purposes only. Any and all information contained herein is not intended to constitute legal advice. You should consult with your own attorneys when developing programs and policies. We do not guarantee the accuracy of this information or any results and further assume no liability in connection with this publication including any information, methods or safety suggestions contained herein.
- 3. RETHINK CYBERSECURITY • CheckList Compliance & Security Doesn't Work • Attacks are cross departmental • Can not protect what you do no know • (DATA MAP- Where is personal data?) • Without Active Ownership and Management Cyber Security is a joke • If not Culture -- it inculcates company to true Cyber Risk CIS /SANS first 5 controls will give you 85% reduction in risk
- 4. “LIVING OFF THE LAND” •“Living off the land” • Windows 10 PowerShell, WMI, the Windows Scripting Host • Microsoft Office “macros”
- 5. IOT HACKED DEVICESAND PORTS
- 6. 1. Non businessimpact when determining courses of action 2. Lack cross-organizational considerations and buy-in 3. Limited data classification 4. Ill-defined processes (aka “pre-thought use cases”) 5. Lack of defined checklists or step-by-step procedures, 6. Ill-defined event and incident taxonomy between responders 7. No defined thresholds between events and incidents 8. No pre-determined (aka “pre-canned”) external communications Top Cyber Incident Pain Points
- 7. Efficiently and Effectively manage our cyber risks? UnacceptableRisk Level Acceptable Risk Level CYBERSECURITY RISK MANAGEMENT
- 8. THE ANSWER Leverage IndustryBest Practices National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework, NIST Risk Management Framework http://www.nist.gov/ 1 Center for Internet Security (CIS) CIS Critical Security Controls http://www.cisecurity.org/ 2 International Organization for Standardization (ISO) ISO 27000-series publications http://www.iso.org/ 3 CySAFE Combines NIST, CIS, and ISO taking best of each without duplication Edits: https://drive.google.com/drive/folders/12UWZiE2JGLeM86t_4ddvXmxz5U810q07?usp=sharin g 4
- 9. RISK MANAGEMENT SHOULD: •Support the strategic objectives • Enhance institutional decision-making • Create a “risk-aware” culture • Reduce operational surprises and losses • Assure greater business continuity • Improve use of funding by aligning resources with objectives • Bridge departmental silos Observe: Identify Risk Orient: Categorize & Prioritize Decide: Select & Implement Controls Act: Manage, Assess, & Monitor
- 10. MY TYPICAL RECOMMENDATIONS •Know what is being leaked IoT Shadow IT • Train Users • Monitor and Log Everything • Pick a frame work (NIST OR CIS OR CySAFE) • Check Firewall ports (Outgoing) • Assess & Document your world https://drive.google.com/file/d/1_irHSd7pgY_ciP8Sjg51YOcd1S8mjciZ/view?usp=shar ing
- 11. MORE EFFECTIVE IT •Empower IT through conversations • Use partner and leader terminology • Define contribution metrics • Find Root (Toyota “5-Whys”) • Technology is a tool, not a purpose • Create a wall of pride • Try device-free meetings • Control interruptions • Find time to daydream
- 12. SELF ASSESSMENT: “CYSAFE”OR CIS TOP 20 CySafe: https://drive.google.com/drive/folders/12UWZiE2JGLeM86t_4ddvXmxz5U810q07?usp=s haring CIS Top 20: https://drive.google.com/drive/folders/1QSU4WyBrpg4DFzGhwUS4eIPjFckzv3Nh?usp=sh aring
- 13. DESIGN: DATA PRIVACY(1/2) •Impact of GDPR on financial services – •PCI FAQ – •Reading level calculator – (also MS Office tools) Additional resourcesWhere should I go to understand critical regulation? How can I check whether my disclosures work? •Industry •Local •Multinational •Ask them •Reading level calculator
- 14. DATA PRIVACY (2/2) Whatdoes “good” look like when it comes to data privacy? Overall Best Practices Capture Usage Retention & Erasure Be extremely transparent People don’t typically read disclosures • Always obtain consent to access and use personal data • When obtaining consent, think of the people – easy to read, jargon- free, mobile friendly • Share how providing data helps the them – • High-level and detailed versions • Tell customers what data will be retained, for how long, and in what form: - De-identified vs. identified - Single data pull vs. ongoing feed - Physical vs. electronic Keep all data confidential Especially with personal data, maintaining confidentiality preserves trust • Check personal disclosures of data acquired from partners • Highlight confidentiality when acquiring data • Be particularly careful with identity • Proactively notify people when sharing their data with 3rd parties • Only use the data for its intended purpose – • Upon erasure, ensure data is completely deleted across where it’s stored – incl. with partners, redundant servers, etc. Let customers “own” their data Whether or not this is legally the case. To maintain their trust, act as if their data is their own • Where possible, allow people to opt-out of specific data access • Where possible, allow people to opt-out of specific data uses – • Have a process for people to request updates to, correction of, or erasure of their information • Have a process to withdraw consent Take, keep, and use only what’s valuable All data carries risk, • Don’t collect all data for all people – identify the pieces which drive the most value, and don’t collect the rest • Be particularly conscious of regulation when using sensitive classifications • “Sunshine test” • Set a retention policy for customer data – • Have a “what data should we keep” process
- 15. SOFTWARE SECURITY •OWASP Top10 2017 •Balancing speed & security •Security 101 for startups •Security testing types •Security fatigue Additional resources How do I balance speed and security? What types of security testing should I be using? •Focus on the right level of technical security for your stage •See “Balancing Speed & Security” article •Automated – before you deploy •Black box 2x/year •White box every 2years What are the most common & dangerous software security risks? •See OWASP Top 10 article
- 16. INFRASTRUCTURE SECURITY (1/2) •FullInfrastructure Checklist •AWS security features and AWS security best practices whitepaper •Azure security features •Cisco Checklist •OWASP Top 10 2017 Additional resourcesIs outsourcing infrastructure or insourcing more secure? If I do outsource how can I ensure I’m protected? •Often, outsourcing will be best •Specific situations may change this •Cloud providers offer: -Logging and monitoring with controls -Identity & access management -Encryption of data at-rest •See the “AWS Security features”
- 17. INFRASTRUCTURE SECURITY (2/2) Whatare some general best-practices for infrastructure security? General infrastructu re • Enable cloud infrastructure default security options • Back up data at minimum daily, but limit redundancies • Encrypt data while at rest and while in-transit • Periodically purge data • Have a BC/DR technology solution and plan • Implement patches for known vulnerabilities as soon as possible Passwords & network access • Use a password manager • Password reset • Tiered access levels • Require a secure VPN Scanning & monitoring • Implement a simple logging function • Include relevant data • Create lockout thresholds
- 18. PARTNER MANAGEMENT •Best practicesto reduce third-party cybersecurity risk •Approaching data security in a fintech- friendly world •Steps to mitigate 3rd party cybersecurity threats Additional resourcesSteps for partner vetting •Pre-contract checks -What are their encryption practice? -Have they ever had a breach? -Service-level agreements (SLAs) -SLAs should be included in data policy -Ability to audit & request specific security standardsHow do I ensure my partner management is successful? •Learn from partners’ suggestions •Continuous monitoring & review Vendor Industry Templates: https://drive.google.com/drive/folders/1MOe15AjF_WRN9IZ10yQefpXDOYfvd8VK?usp =sharing
- 19. CULTURE What does abest in class data protection culture look like? Key beliefs Practices to reinforce All of users need to be aware and careful of Security issues • Data protection newsletter – - Current events – share one article and how it relates to the company - Employee highlight – public recognition for those who surface issues • Accountable executive for data protection is not just responsible for technology - Have non-technical (i.e. not IT) people train employees on data protection Be open and transparent • Celebrate employees who surface issues – publicly recognize people • Don’t punish people Data protection is an ongoing effort • Blame-free post-mortems • Ongoing “security tracker” More sharing = more risk • Limit partner integrations
- 20. DATA MANAGEMENT •Security 101for startups •What is social engineering? Additional resources What are some best practice processes for data protection? Development • Regular penetration testing (3-6mo black box, 12mo white box) • Security review as part of SDLC Hiring and firing • Do reference checks on developers and employees • Ensure digital “locks changed” when employees leave Reviews • Hold regular data protection reviews (quarterly) Miscellaneous • Do not use USB drives • Encourage auto-lock of laptops (after 5 minutes) • Have automatic locks on your office doors and server rooms • Train employees to not use risky websites
- 21. TRAINING What content shouldI include in my data protection trainings? All staff • Our data security culture - Why it’s important - Key processes to prevent + report issues - Key components of the data policy - Role-based guidelines - Initial data privacy training • Types of threats and how we mitigate • Key data elements • To be conducted on a regular basis • Regular trainings: • After a breach: - Cover post-mortem of breach's - Opportunity for Q&A Engineerin g, IT, Data science In addition to the above: • Legislative & regulatory environment • Communication & feedback loops • Where security sits in all processes • Roles & responsibilities • Monitoring and maintenance • Updates to data architecture and procedures • Changing Data security procedures • Legislative or regulatory changes ONBOARDING ONGOING
- 22. Identification & Risk Assessment Containment& Resolution Evaluation & Improvement BREACH RESPONSE (1/3) •Data breaches 101 •Detailed guide for cybersecurity event recovery Additional resourcesWhat is a data security breach? What should be included in a security breach response plan? • Understand extent of breach • Assess risks from breach • Form team to lead resolution • Contain breach, limit damage • Review causes of breach • Understand consequences • Make process, tech changes Communication • Plan and execute communication to employees and external parties 21 4 3 •What is a Breach? •Can be done locally or remotely
- 23. Identification & Risk Assessment Containment& Resolution Evaluation & Improvement BREACH RESPONSE (2/3) • Understand extent of breach - What personal data - What was the cause - How many people • Assess risks from breach - What potential for harm - Strategic & financial risks? - Legal or compliance risks? - Reputational risks? - Financial risks? • Form team to lead resolution - Who will be accountable - Employees needed? - How often will the team meet? • Contain breach, limit damage - Are we still vulnerable? - What systems changes? - What process changes - How to recover data? • Review causes of breach – “post- mortem” - Vulnerabilities enabled the breach - What other similar vulnerabilities? • Understand consequences - What consequences occurred • Make process, tech changes - Tech solutions or process changes - Need to modify our data policy - What training is needed? - What is the cost to make these changes • Initial identification of severity may be incomplete, so be thorough • Key people to include on team: - Executive - Legal counsel • Don’t limit evaluation and improvements • Blame-free post-mortems • Include people from across the What are best practices in each phase of a breach response? Best practices 21 3 Keyquesitons
- 24. BREACH RESPONSE (3/3) Whatcommunication is appropriate at each stage of breach response? External Intern al 4 Identification & Risk Assessment Containment & Resolution Evaluation & Improvement • Understand extent of breach • Assess risks from breach • Form team to lead resolution • Contain breach, limit damage • Review causes of breach • Understand consequences • Make process, tech changes • Notify groups who interact with external parties; • Include critical teams - C-Suite, Legal, Technology, PR (if applicable) - Board of directors • Communicate to employees • Provide regular updates to leadership, legal until issues are resolved • Post-mortem is non- punitive • Include description of what happened • Communicate about process and technology changes • Be careful about what you communicate • Speak to all relevant external parties • Always review with legal • When you communicate, include all key information - Data involved - Action taken - Specific and clear advice • Provide ongoing
- 25. FACTORS THAT CANCAUSE FAILURE Complexity (Overlapping Solutions) Focus on Technology (Bright Shiny Object Disease) Lack of Understanding of Risk (Fear vs Reality) Lack of Cyber Security Staff
- 26. DELIVERABLES Firewall & Networksetups https://drive.google.com/drive/folders/1FDKjOi8MPxXTuBZ4MtJZQMf9tcfPkz44?usp= sharing Cloud security https://drive.google.com/drive/folders/1MOe15AjF_WRN9IZ10yQefpXDOYfvd8VK?usp =sharing Protocols and ports that need attention https://drive.google.com/file/d/1_irHSd7pgY_ciP8Sjg51YOcd1S8mjciZ/view?usp=shar ing Authentication best practices: https://drive.google.com/file/d/1TyMTbghiOSqtuZv7c- CqmurPiqcPdRpV/view?usp=sharing Server and network rights https://drive.google.com/file/d/130tcLpGBPE2Q4aYjknG7xaiIkK0CJPsq/view?usp=sha ring Servers: https://drive.google.com/file/d/197jsrcHo4Izx9pWw7nv3dj01BIf0LiNl/view?usp=shari
- 27. TOOL TIME: Root Folderon G-Drive https://drive.google.com/drive/folders/1t4zZbe3bZb7yuZFNRZnSYOpfru_uzHpP?usp=s haring Throughput Testing https://drive.google.com/drive/folders/1qcGAwBGfRB8-BV34kZjY6uPE- _gK9qL6?usp=sharing Network Mapping resources https://drive.google.com/drive/folders/1FDKjOi8MPxXTuBZ4MtJZQMf9tcfPkz44?usp=s haring CySafe: https://drive.google.com/drive/folders/12UWZiE2JGLeM86t_4ddvXmxz5U810q07?usp= sharing CIS top 20 https://drive.google.com/drive/folders/1QSU4WyBrpg4DFzGhwUS4eIPjFckzv3Nh?usp=s haring 3rd Party Vendor Vetting:
- 28. MORE EFFECTIVE IT •Empower IT through conversations • Use partner and leader terminology • Define contribution metrics • Find Root (Toyota “5-Whys”) • Technology is a tool, not a purpose • Create a wall of pride • Try device-free meetings • Control interruptions • Find time to daydream
- 29. MY TYPICAL RECOMMENDATIONS •Know what is being leaked IoT Shadow IT • Train Users • Monitor and Log Everything • Pick a frame work (NIST OR CIS OR CySAFE) • Check Firewall ports (Outgoing) • Assess & Document your world https://drive.google.com/file/d/1_irHSd7pgY_ciP8Sjg51YOcd1S8mjciZ/view?usp=shar ing