SlideShare a Scribd company logo

PTX12_Presentation_George Delikouras AIA

•
•
G
George Delikouras

The document outlines a framework for developing an information security strategy and proposal for an organization. It recommends taking a top-down approach by first identifying the key sectors of people, processes, and technology and then drilling down to specific domains and technologies within each sector. It provides examples of domains such as identity and access management or network security. The framework is meant to help information security officers understand needs, prioritize investments, and develop a proposal to present to top management to obtain approval and funding for security initiatives.

1 of 21
Download to read offline
George D. Delikouras Head Information Security Athens International Airport Greece
Contents  A tough question: How secure are we?  What are the corporate information security needs?A top- down approach  How can we prioritize our needs? A risk-based approach  How can we persuade top management to invest in information security?  How can we present analysis results to the top management?  From strategy to implementation: Project phases
Introduction  Many Information Security Officers desire a strategic approach on the information security issue for the organization.  In most cases executives lack time or the necessary tools to map the organization’s needs and priorities in order to schedule tasks or prepare an investment plan.  A well documented proposal based on a plan that can be easily understood is the first step. A successful presentation to the top management is the most important step towards the objective.
The top-down approach  Information security applies to people, processes and technology.  These are the 3 sectors that we initially choose and then we can split them in more specific domains.  Many executives understand better these specific domains in which we are going to propose investments. i.e. “we have security issues in our databases infrastructure”  The top-down approach offers a structured presentation of the sectors and domains on which we are willing to invest.
Overall framework: Sectors Security program People Process Technology Enforcement Policydefinition Monitoring&response Measurement&reporting Enforcement Policydefinition Monitoring&response Measurement&reporting Enforcement Policydefinition Monitoring&response Measurement&reporting
Overall framework: Domains Process Technology Enforcement Policydefinition Monitoring&response Measurement&reporting Enforcement Policydefinition Monitoring&response Measurement&reporting People Enforcement Policydefinition Monitoring&response Measurement&reporting Identity & access management Information security mgmt. Training, awareness, & personnel Information risk management Policy & compliance framework Business continuity & DR Incident & threat management Information asset management Physical and environment sec. Systems dev. & ops mgmt. Network Database Systems Endpoints Application infrastructure Messaging & content Data Security program
The next step  Even if we stay at this level of analysis it is sufficient for a CEO or a CIO to assess and understand the sectors and domains where investments will be needed.  The next step is to proceed to an even lower level for the domains that we have already define. This way we specify the technologies necessary to be deployed in the organization and the way these technologies can be used in order first of all to protect information and systems but also to create measurable results required for their justification.
Monitoring, metrics, reporting  Our investments’ effectiveness will be revealed from the systematic measurement and reporting. This must be an objective and its prerequisite is the correct framework for data collection.  We define 4 horizontal actions for the organization: 1. Information security policies with applicable and achievable rules. 2. Obligatory enforcement of policies and rules 3. Monitoring of the policies compliance and enforcement 4. Metrics and reporting that show policies effectiveness
People Policy definition Enforcement Monitoring & response Measurement Information security organization Training, awareness, & personnel Identity and access management
People Policy definition Enforcement Monitoring & response Measurement Information security organization Training, awareness, & personnel Identity and access management ITgovernancestructure Business outreach program IT operations security Security advocacy & marketing Auditframework Personnel identity & eligibility checking Security steering committee Information risk management team Business-level security Corporate-level security Security awareness & education Performancemanagement Role definition Performance management integration Privilege definition Awareness testing Access control implementation Activity monitoring Privacy, compliance, & ethics training Business controls monitoring
Process Systems dev. and operations management Physical and environmental security Incident & threat management Information asset management Policy and compliance framework Information risk management Business continuity & disaster recovery Policy definition Monitoring & response Enforcement Measurement
Contents Systems dev. and operations management Physical and environmental security Incident & threat management Information asset management Policy and compliance framework Information risk management Business continuity & disaster recovery Policy definition Monitoring & response Enforcement Measurement Requirementsmanagement QA & system security review Sourcingstrategy ITacquisition Event analysis App access control Change management System access controls Log retention Auditframework Architecturalreview Threat research Response planning Post- incident review Forensics Incident response Security testing Facilities access control Riskassessment Contract management Businessimpact analysis Asset life-cycle management Asset ownership Continuity planning Redundancy management BCP testing Plan maintenance Information asset tracking Records retention Information risk tracking Information risk classification Policy creation Policy maintenance Compliance research Policy distribution Information risk handling BCP training
Technology Data Network Databases Systems Endpoints Messaging & content Application infrastructure Policy definition Enforcement Monitoring & response Measurement
Technology Data Network Databases Systems Endpoints Messaging & content Application infrastructure Policy definition Enforcement Monitoring & response Measurement Network access control NBAD Wireless gateway WLAN monitoring Audit&riskmanagementframework IPS Firewall SSL VPN Database encryption Vulnerabilitymanagement Database monitoring Antivirus Configuration mgmt. Storage security Firewall/Host IPS Directory Application assessment Antivirus Antispam Email encryption & filtering Web filtering Enterprise SSO Antivirus/Antispyware Endpoint control Firewall/Host IPS Client encryption XML gatewayWeb SSO IM filtering Digitalinvestigation&forensics SIM App encryption Information leak protection Enterprise encryption & key management Digital rights management Identity&accessmanagement Strongauthentication Database config. mgmt. Application FW
From theory to practice  Very nice theory so far. What can I do in my company?  How can Checkpoint technologies really help me;  The answer in 3 steps: 1. Draw a map of the sectors and domains that we have described so far noting which technologies add value to the eterprise. 2. Draw the same map depicting the exisiting situation in the organization. 3. Prioritize the needs and draw them on paper. Discuss with Checkpoint technology experts how the organization benefit in each sector and every domain.
Step 1: Value map Data Network Databases Systems Endpoints Messaging & content Application infrastructure Policy definition Enforcement Monitoring & response Measurement Network access control NBAD Wireless gateway WLAN monitoring Audit&riskmanagementframework IPS Firewall SSL VPN Database encryption Vulnerabilitymanagement Database monitoring Antivirus Configuration management Storage security Firewall/Host IPS Directory Application assessment Email encryption & filtering Web filtering Enterprise SSO Antivirus/Antispyware Endpoint control Firewall/host IPS Client encryption Application firewall XML gatewayWeb SSO IM filtering Digitalinvestigation&forensics SIM Information leak protection App encryption Enterprise encryption & key management Digital rights management Identity&accessmanagement Strongauthentication Database config. mgmt. High Medium Low Antispam Antivirus
Step 2: Existing situation Data Network Databases Systems Endpoints Messaging & content Application infrastructure Policy definition Enforcement Monitoring & response Measurement Network access control NBAD Wireless gateway WLAN monitoring Audit&riskmanagementframework IPS Firewall SSL VPN Database encryption Vulnerabilitymanagement Database monitoring Antivirus Configuration mgmt. Storage security Firewall/Host IPS Directory Application assessment Email encryption & filtering Web filtering Enterprise SSO Antivirus/Antispyware Endpoint control Firewall/Host IPS Client encryption Application firewall XML gatewayWeb SSO IM filtering Digitalinvestigation&forensics SIM Information leak protection App encryption Enterprise encryption & key management Digital rights management Identity&accessmanagement Strongauthentication Database config. mgmt. Not implemented Needs attention Satisfactorily implemented Antivirus Antispam
Step 3: Prioritization Network Databases Systems Endpoints Applications infrastructure Messaging & content Data Policy & risk management Immediate attention Short-term review Long-term review SIM Audit framework Strong authenticati on IA M Forensics Vulnerability management NA C IPS WLAN gateway WLAN monitoring NBAD Firewa ll VPN Directory App assess Application firewall Application encryption XML gateway Web SSO Configuration mgmt.Server AV FW/IPS FW/IPS Antispyware Client encryption Endpoint control Enterprise SSO Storage security Database encryption Database Monitoring Database config. mgmt. ILP IM filtering Antivirus Antispam Email encryption Web filtering Enterprise encryption & key management DRM Not implemented Needs attention Satisfactorily implemented
…some advice  This framework might seem too generic but it is a solid start as it gives a security x-ray image of the organization.Αυτό πλαίσιο είναι πολύ γενικό αλλά αποτελεί μια καλή αρχή καθώς μας δίνει μια ακτινογραφία του οργανισμού.  It must be clear that each enterprise and each sector of the economy or industry has its own special needs.  For best results: 1. Modify the plan to best suit your needs 2. Repeat the exercise every 2 years 3. Build your strategy with annual intervals  A comparative analysis between your company and its peers will persuade even the most demanding CEO or Board.
Comparative presentation Information risk mgmt. Policy and compliance framework Information asset mgmt. BC/DR Incident and threat mgmt. Physical and environmental security Systems dev. and ops mgmt. Process Poor Average Good Exceptional Company = 3-year target Company = Current Peer average
Athens International Airport Thank you for your attention! George D. Delikouras Athens International Airport S.A. Head Information security IT&T Business Unit george.delikouras@aia.gr

Recommended

Hands on IT risk assessment
Hands on IT risk assessmentHands on IT risk assessment
Hands on IT risk assessment
George Delikouras
 
Practical approach to security risk management
Practical approach to security risk managementPractical approach to security risk management
Practical approach to security risk management
G3 intelligence Ltd
 
IT Security and Risk Management - Visionet Systems
IT Security and Risk Management - Visionet SystemsIT Security and Risk Management - Visionet Systems
IT Security and Risk Management - Visionet Systems
Visionet Systems, Inc.
 
Chapter 12 iso 27001 awareness
Chapter 12 iso 27001 awarenessChapter 12 iso 27001 awareness
Chapter 12 iso 27001 awareness
newbie2019
 
IT Risk Management
IT Risk ManagementIT Risk Management
IT Risk Management
Tudor Damian
 
Information Security Assessment Offering
Information Security Assessment OfferingInformation Security Assessment Offering
Information Security Assessment Offering
eeaches
 
Business Continuity & Disaster Recovery Planning 02 - 04 December 2013 Kuala ...
Business Continuity & Disaster Recovery Planning 02 - 04 December 2013 Kuala ...Business Continuity & Disaster Recovery Planning 02 - 04 December 2013 Kuala ...
Business Continuity & Disaster Recovery Planning 02 - 04 December 2013 Kuala ...
360 BSI
 
IT Risk Management & Leadership 23 - 26 June 2013 Dubai
IT Risk Management & Leadership 23 - 26 June 2013 DubaiIT Risk Management & Leadership 23 - 26 June 2013 Dubai
IT Risk Management & Leadership 23 - 26 June 2013 Dubai
360 BSI
 

Recommended

Hands on IT risk assessment
Hands on IT risk assessmentHands on IT risk assessment
Hands on IT risk assessment
George Delikouras
 
Practical approach to security risk management
Practical approach to security risk managementPractical approach to security risk management
Practical approach to security risk management
G3 intelligence Ltd
 
IT Security and Risk Management - Visionet Systems
IT Security and Risk Management - Visionet SystemsIT Security and Risk Management - Visionet Systems
IT Security and Risk Management - Visionet Systems
Visionet Systems, Inc.
 
Chapter 12 iso 27001 awareness
Chapter 12 iso 27001 awarenessChapter 12 iso 27001 awareness
Chapter 12 iso 27001 awareness
newbie2019
 
IT Risk Management
IT Risk ManagementIT Risk Management
IT Risk Management
Tudor Damian
 
Information Security Assessment Offering
Information Security Assessment OfferingInformation Security Assessment Offering
Information Security Assessment Offering
eeaches
 
Business Continuity & Disaster Recovery Planning 02 - 04 December 2013 Kuala ...
Business Continuity & Disaster Recovery Planning 02 - 04 December 2013 Kuala ...Business Continuity & Disaster Recovery Planning 02 - 04 December 2013 Kuala ...
Business Continuity & Disaster Recovery Planning 02 - 04 December 2013 Kuala ...
360 BSI
 
IT Risk Management & Leadership 23 - 26 June 2013 Dubai
IT Risk Management & Leadership 23 - 26 June 2013 DubaiIT Risk Management & Leadership 23 - 26 June 2013 Dubai
IT Risk Management & Leadership 23 - 26 June 2013 Dubai
360 BSI
 
Generic_Sample_INFOSECPolicy_and_Procedures
Generic_Sample_INFOSECPolicy_and_ProceduresGeneric_Sample_INFOSECPolicy_and_Procedures
Generic_Sample_INFOSECPolicy_and_Procedures
Samuel Loomis
 
Planning for security and security audit process
Planning for security and security audit processPlanning for security and security audit process
Planning for security and security audit process
Divya Tiwari
 
Security Organization/ Infrastructure
Security Organization/ InfrastructureSecurity Organization/ Infrastructure
Security Organization/ Infrastructure
Priyank Hada
 
Information Security Risk Management
Information Security Risk Management Information Security Risk Management
Information Security Risk Management
Ersoy AKSOY
 
Information Security Risk Management
Information Security Risk ManagementInformation Security Risk Management
Information Security Risk Management
Nikhil Soni
 
Risk Management Approach to Cyber Security
Risk Management Approach to Cyber Security Risk Management Approach to Cyber Security
Risk Management Approach to Cyber Security
Ernest Staats
 
Designing NextGen Threat Identification Solutions
Designing NextGen Threat Identification SolutionsDesigning NextGen Threat Identification Solutions
Designing NextGen Threat Identification Solutions
Arun Prabhakar
 
Security & Risk Management
Security & Risk ManagementSecurity & Risk Management
Security & Risk Management
Ahmed Sayed-
 
Strategy Insights - How to Quantify IT Risks
Strategy Insights - How to Quantify IT Risks Strategy Insights - How to Quantify IT Risks
Strategy Insights - How to Quantify IT Risks
Hernan Huwyler, MBA CPA
 
CISSP Chapter 1 Risk Management
CISSP Chapter 1 Risk ManagementCISSP Chapter 1 Risk Management
CISSP Chapter 1 Risk Management
Karthikeyan Dhayalan
 
Business case for information security program
Business case for information security programBusiness case for information security program
Business case for information security program
William Godwin
 
Mastering Information Technology Risk Management
Mastering Information Technology Risk ManagementMastering Information Technology Risk Management
Mastering Information Technology Risk Management
Goutama Bachtiar
 
security_assessment_slides
security_assessment_slidessecurity_assessment_slides
security_assessment_slides
Steve Arnold
 
Security Maturity Models.
Security Maturity Models.Security Maturity Models.
Security Maturity Models.
Priyanka Aash
 
Build an Information Security Strategy
Build an Information Security StrategyBuild an Information Security Strategy
Build an Information Security Strategy
Andrew Byers
 
Security assessment isaca sv presentation jan 2016
Security assessment isaca sv presentation jan 2016Security assessment isaca sv presentation jan 2016
Security assessment isaca sv presentation jan 2016
EnterpriseGRC Solutions, Inc.
 
Implementing Business Aligned Security Strategy Dane Warren Li
Implementing Business Aligned Security Strategy Dane Warren LiImplementing Business Aligned Security Strategy Dane Warren Li
Implementing Business Aligned Security Strategy Dane Warren Li
DaneWarren
 
Building an effective Information Security Roadmap
Building an effective Information Security RoadmapBuilding an effective Information Security Roadmap
Building an effective Information Security Roadmap
Elliott Franklin
 
Security Maturity Assessment
Security Maturity AssessmentSecurity Maturity Assessment
Security Maturity Assessment
Claude Baudoin
 
Information Technology Vendor Risk Management
Information Technology Vendor Risk ManagementInformation Technology Vendor Risk Management
Information Technology Vendor Risk Management
Deepak Bansal, CPA CISSP
 
Cyber-Security-Whitepaper.pdf
Cyber-Security-Whitepaper.pdfCyber-Security-Whitepaper.pdf
Cyber-Security-Whitepaper.pdf
Anil
 
Cyber-Security-Whitepaper.pdf
Cyber-Security-Whitepaper.pdfCyber-Security-Whitepaper.pdf
Cyber-Security-Whitepaper.pdf
Anil
 

More Related Content

What's hot

Generic_Sample_INFOSECPolicy_and_Procedures
Generic_Sample_INFOSECPolicy_and_ProceduresGeneric_Sample_INFOSECPolicy_and_Procedures
Generic_Sample_INFOSECPolicy_and_Procedures
Samuel Loomis
 
Planning for security and security audit process
Planning for security and security audit processPlanning for security and security audit process
Planning for security and security audit process
Divya Tiwari
 
Security Organization/ Infrastructure
Security Organization/ InfrastructureSecurity Organization/ Infrastructure
Security Organization/ Infrastructure
Priyank Hada
 
Information Security Risk Management
Information Security Risk Management Information Security Risk Management
Information Security Risk Management
Ersoy AKSOY
 
Information Security Risk Management
Information Security Risk ManagementInformation Security Risk Management
Information Security Risk Management
Nikhil Soni
 
Risk Management Approach to Cyber Security
Risk Management Approach to Cyber Security Risk Management Approach to Cyber Security
Risk Management Approach to Cyber Security
Ernest Staats
 
Designing NextGen Threat Identification Solutions
Designing NextGen Threat Identification SolutionsDesigning NextGen Threat Identification Solutions
Designing NextGen Threat Identification Solutions
Arun Prabhakar
 
Security & Risk Management
Security & Risk ManagementSecurity & Risk Management
Security & Risk Management
Ahmed Sayed-
 
Strategy Insights - How to Quantify IT Risks
Strategy Insights - How to Quantify IT Risks Strategy Insights - How to Quantify IT Risks
Strategy Insights - How to Quantify IT Risks
Hernan Huwyler, MBA CPA
 
CISSP Chapter 1 Risk Management
CISSP Chapter 1 Risk ManagementCISSP Chapter 1 Risk Management
CISSP Chapter 1 Risk Management
Karthikeyan Dhayalan
 
Business case for information security program
Business case for information security programBusiness case for information security program
Business case for information security program
William Godwin
 
Mastering Information Technology Risk Management
Mastering Information Technology Risk ManagementMastering Information Technology Risk Management
Mastering Information Technology Risk Management
Goutama Bachtiar
 
security_assessment_slides
security_assessment_slidessecurity_assessment_slides
security_assessment_slides
Steve Arnold
 
Security Maturity Models.
Security Maturity Models.Security Maturity Models.
Security Maturity Models.
Priyanka Aash
 
Build an Information Security Strategy
Build an Information Security StrategyBuild an Information Security Strategy
Build an Information Security Strategy
Andrew Byers
 
Security assessment isaca sv presentation jan 2016
Security assessment isaca sv presentation jan 2016Security assessment isaca sv presentation jan 2016
Security assessment isaca sv presentation jan 2016
EnterpriseGRC Solutions, Inc.
 
Implementing Business Aligned Security Strategy Dane Warren Li
Implementing Business Aligned Security Strategy Dane Warren LiImplementing Business Aligned Security Strategy Dane Warren Li
Implementing Business Aligned Security Strategy Dane Warren Li
DaneWarren
 
Building an effective Information Security Roadmap
Building an effective Information Security RoadmapBuilding an effective Information Security Roadmap
Building an effective Information Security Roadmap
Elliott Franklin
 
Security Maturity Assessment
Security Maturity AssessmentSecurity Maturity Assessment
Security Maturity Assessment
Claude Baudoin
 
Information Technology Vendor Risk Management
Information Technology Vendor Risk ManagementInformation Technology Vendor Risk Management
Information Technology Vendor Risk Management
Deepak Bansal, CPA CISSP
 

What's hot (20)

Generic_Sample_INFOSECPolicy_and_Procedures
Generic_Sample_INFOSECPolicy_and_ProceduresGeneric_Sample_INFOSECPolicy_and_Procedures
Generic_Sample_INFOSECPolicy_and_Procedures
 
Planning for security and security audit process
Planning for security and security audit processPlanning for security and security audit process
Planning for security and security audit process
 
Security Organization/ Infrastructure
Security Organization/ InfrastructureSecurity Organization/ Infrastructure
Security Organization/ Infrastructure
 
Information Security Risk Management
Information Security Risk Management Information Security Risk Management
Information Security Risk Management
 
Information Security Risk Management
Information Security Risk ManagementInformation Security Risk Management
Information Security Risk Management
 
Risk Management Approach to Cyber Security
Risk Management Approach to Cyber Security Risk Management Approach to Cyber Security
Risk Management Approach to Cyber Security
 
Designing NextGen Threat Identification Solutions
Designing NextGen Threat Identification SolutionsDesigning NextGen Threat Identification Solutions
Designing NextGen Threat Identification Solutions
 
Security & Risk Management
Security & Risk ManagementSecurity & Risk Management
Security & Risk Management
 
Strategy Insights - How to Quantify IT Risks
Strategy Insights - How to Quantify IT Risks Strategy Insights - How to Quantify IT Risks
Strategy Insights - How to Quantify IT Risks
 
CISSP Chapter 1 Risk Management
CISSP Chapter 1 Risk ManagementCISSP Chapter 1 Risk Management
CISSP Chapter 1 Risk Management
 
Business case for information security program
Business case for information security programBusiness case for information security program
Business case for information security program
 
Mastering Information Technology Risk Management
Mastering Information Technology Risk ManagementMastering Information Technology Risk Management
Mastering Information Technology Risk Management
 
security_assessment_slides
security_assessment_slidessecurity_assessment_slides
security_assessment_slides
 
Security Maturity Models.
Security Maturity Models.Security Maturity Models.
Security Maturity Models.
 
Build an Information Security Strategy
Build an Information Security StrategyBuild an Information Security Strategy
Build an Information Security Strategy
 
Security assessment isaca sv presentation jan 2016
Security assessment isaca sv presentation jan 2016Security assessment isaca sv presentation jan 2016
Security assessment isaca sv presentation jan 2016
 
Implementing Business Aligned Security Strategy Dane Warren Li
Implementing Business Aligned Security Strategy Dane Warren LiImplementing Business Aligned Security Strategy Dane Warren Li
Implementing Business Aligned Security Strategy Dane Warren Li
 
Building an effective Information Security Roadmap
Building an effective Information Security RoadmapBuilding an effective Information Security Roadmap
Building an effective Information Security Roadmap
 
Security Maturity Assessment
Security Maturity AssessmentSecurity Maturity Assessment
Security Maturity Assessment
 
Information Technology Vendor Risk Management
Information Technology Vendor Risk ManagementInformation Technology Vendor Risk Management
Information Technology Vendor Risk Management
 

Similar to PTX12_Presentation_George Delikouras AIA

Cyber-Security-Whitepaper.pdf
Cyber-Security-Whitepaper.pdfCyber-Security-Whitepaper.pdf
Cyber-Security-Whitepaper.pdf
Anil
 
Cyber-Security-Whitepaper.pdf
Cyber-Security-Whitepaper.pdfCyber-Security-Whitepaper.pdf
Cyber-Security-Whitepaper.pdf
Anil
 
CompTIA CySA Domain 3 Security Operations and Monitoring.pptx
CompTIA CySA Domain 3 Security Operations and Monitoring.pptxCompTIA CySA Domain 3 Security Operations and Monitoring.pptx
CompTIA CySA Domain 3 Security Operations and Monitoring.pptx
Infosectrain3
 
Safeguarding the Enterprise
Safeguarding the EnterpriseSafeguarding the Enterprise
Safeguarding the Enterprise
ADGP, Public Grivences, Bangalore
 
Information Security
Information SecurityInformation Security
Information Security
We Learn - A Continuous Learning Forum from Welingkar's Distance Learning Program.
 
Information security[277]
Information security[277]Information security[277]
Information security[277]
Timothy Warren
 
How to Secure your Fintech Solution - A Whitepaper by RapidValue
How to Secure your Fintech Solution - A Whitepaper by RapidValueHow to Secure your Fintech Solution - A Whitepaper by RapidValue
How to Secure your Fintech Solution - A Whitepaper by RapidValue
RapidValue
 
Eng Solutions - Capability Statement-Latest
Eng Solutions - Capability Statement-LatestEng Solutions - Capability Statement-Latest
Eng Solutions - Capability Statement-Latest
Hank Eng, CISSP, CISA, CISM
 
How to Become a Cyber Security Analyst in 2021..
How to Become a Cyber Security Analyst in 2021..How to Become a Cyber Security Analyst in 2021..
How to Become a Cyber Security Analyst in 2021..
Sprintzeal
 
CCA study group
CCA study groupCCA study group
CCA study group
IIBA UK Chapter
 
Information Security - I.T Project Management
Information Security - I.T Project ManagementInformation Security - I.T Project Management
Information Security - I.T Project Management
We Learn - A Continuous Learning Forum from Welingkar's Distance Learning Program.
 
Tft2 Task3 Essay
Tft2 Task3 EssayTft2 Task3 Essay
Tft2 Task3 Essay
Michelle Bojorquez
 
SOC Service in India.pdf
SOC Service in India.pdfSOC Service in India.pdf
SOC Service in India.pdf
ACS Networks & Technologies
 
Security and personnel bp11521
Security and personnel bp11521Security and personnel bp11521
Security and personnel bp11521
Merlin Florrence
 
Rothke rsa 2012 building a security operations center (soc)
Rothke rsa 2012 building a security operations center (soc)Rothke rsa 2012 building a security operations center (soc)
Rothke rsa 2012 building a security operations center (soc)
Ben Rothke
 
ZSAH Security - Web
ZSAH Security - WebZSAH Security - Web
ZSAH Security - Web
Fahd Khan
 
Module 02 Performance Risk-based Analytics With all the advancem
Module 02 Performance Risk-based Analytics With all the advancemModule 02 Performance Risk-based Analytics With all the advancem
Module 02 Performance Risk-based Analytics With all the advancem
IlonaThornburg83
 
IT SECURITY ASSESSMENT PROPOSAL
IT SECURITY ASSESSMENT PROPOSALIT SECURITY ASSESSMENT PROPOSAL
IT SECURITY ASSESSMENT PROPOSAL
CYBER SENSE
 
Infopercept_Technology_Risk_Review
Infopercept_Technology_Risk_ReviewInfopercept_Technology_Risk_Review
Infopercept_Technology_Risk_Review
anjali bhalgama
 
INFORMATION AND COMMUNICATIONS TECHNOLOGY PROGRAM
INFORMATION AND COMMUNICATIONS TECHNOLOGY PROGRAMINFORMATION AND COMMUNICATIONS TECHNOLOGY PROGRAM
INFORMATION AND COMMUNICATIONS TECHNOLOGY PROGRAM
Christopher Nanchengwa
 

Similar to PTX12_Presentation_George Delikouras AIA (20)

Cyber-Security-Whitepaper.pdf
Cyber-Security-Whitepaper.pdfCyber-Security-Whitepaper.pdf
Cyber-Security-Whitepaper.pdf
 
Cyber-Security-Whitepaper.pdf
Cyber-Security-Whitepaper.pdfCyber-Security-Whitepaper.pdf
Cyber-Security-Whitepaper.pdf
 
CompTIA CySA Domain 3 Security Operations and Monitoring.pptx
CompTIA CySA Domain 3 Security Operations and Monitoring.pptxCompTIA CySA Domain 3 Security Operations and Monitoring.pptx
CompTIA CySA Domain 3 Security Operations and Monitoring.pptx
 
Safeguarding the Enterprise
Safeguarding the EnterpriseSafeguarding the Enterprise
Safeguarding the Enterprise
 
Information Security
Information SecurityInformation Security
Information Security
 
Information security[277]
Information security[277]Information security[277]
Information security[277]
 
How to Secure your Fintech Solution - A Whitepaper by RapidValue
How to Secure your Fintech Solution - A Whitepaper by RapidValueHow to Secure your Fintech Solution - A Whitepaper by RapidValue
How to Secure your Fintech Solution - A Whitepaper by RapidValue
 
Eng Solutions - Capability Statement-Latest
Eng Solutions - Capability Statement-LatestEng Solutions - Capability Statement-Latest
Eng Solutions - Capability Statement-Latest
 
How to Become a Cyber Security Analyst in 2021..
How to Become a Cyber Security Analyst in 2021..How to Become a Cyber Security Analyst in 2021..
How to Become a Cyber Security Analyst in 2021..
 
CCA study group
CCA study groupCCA study group
CCA study group
 
Information Security - I.T Project Management
Information Security - I.T Project ManagementInformation Security - I.T Project Management
Information Security - I.T Project Management
 
Tft2 Task3 Essay
Tft2 Task3 EssayTft2 Task3 Essay
Tft2 Task3 Essay
 
SOC Service in India.pdf
SOC Service in India.pdfSOC Service in India.pdf
SOC Service in India.pdf
 
Security and personnel bp11521
Security and personnel bp11521Security and personnel bp11521
Security and personnel bp11521
 
Rothke rsa 2012 building a security operations center (soc)
Rothke rsa 2012 building a security operations center (soc)Rothke rsa 2012 building a security operations center (soc)
Rothke rsa 2012 building a security operations center (soc)
 
ZSAH Security - Web
ZSAH Security - WebZSAH Security - Web
ZSAH Security - Web
 
Module 02 Performance Risk-based Analytics With all the advancem
Module 02 Performance Risk-based Analytics With all the advancemModule 02 Performance Risk-based Analytics With all the advancem
Module 02 Performance Risk-based Analytics With all the advancem
 
IT SECURITY ASSESSMENT PROPOSAL
IT SECURITY ASSESSMENT PROPOSALIT SECURITY ASSESSMENT PROPOSAL
IT SECURITY ASSESSMENT PROPOSAL
 
Infopercept_Technology_Risk_Review
Infopercept_Technology_Risk_ReviewInfopercept_Technology_Risk_Review
Infopercept_Technology_Risk_Review
 
INFORMATION AND COMMUNICATIONS TECHNOLOGY PROGRAM
INFORMATION AND COMMUNICATIONS TECHNOLOGY PROGRAMINFORMATION AND COMMUNICATIONS TECHNOLOGY PROGRAM
INFORMATION AND COMMUNICATIONS TECHNOLOGY PROGRAM
 

PTX12_Presentation_George Delikouras AIA

  • 1. George D. Delikouras Head Information Security Athens International Airport Greece
  • 2. Contents  A tough question: How secure are we?  What are the corporate information security needs?A top- down approach  How can we prioritize our needs? A risk-based approach  How can we persuade top management to invest in information security?  How can we present analysis results to the top management?  From strategy to implementation: Project phases
  • 3. Introduction  Many Information Security Officers desire a strategic approach on the information security issue for the organization.  In most cases executives lack time or the necessary tools to map the organization’s needs and priorities in order to schedule tasks or prepare an investment plan.  A well documented proposal based on a plan that can be easily understood is the first step. A successful presentation to the top management is the most important step towards the objective.
  • 4. The top-down approach  Information security applies to people, processes and technology.  These are the 3 sectors that we initially choose and then we can split them in more specific domains.  Many executives understand better these specific domains in which we are going to propose investments. i.e. “we have security issues in our databases infrastructure”  The top-down approach offers a structured presentation of the sectors and domains on which we are willing to invest.
  • 5. Overall framework: Sectors Security program People Process Technology Enforcement Policydefinition Monitoring&response Measurement&reporting Enforcement Policydefinition Monitoring&response Measurement&reporting Enforcement Policydefinition Monitoring&response Measurement&reporting
  • 6. Overall framework: Domains Process Technology Enforcement Policydefinition Monitoring&response Measurement&reporting Enforcement Policydefinition Monitoring&response Measurement&reporting People Enforcement Policydefinition Monitoring&response Measurement&reporting Identity & access management Information security mgmt. Training, awareness, & personnel Information risk management Policy & compliance framework Business continuity & DR Incident & threat management Information asset management Physical and environment sec. Systems dev. & ops mgmt. Network Database Systems Endpoints Application infrastructure Messaging & content Data Security program
  • 7. The next step  Even if we stay at this level of analysis it is sufficient for a CEO or a CIO to assess and understand the sectors and domains where investments will be needed.  The next step is to proceed to an even lower level for the domains that we have already define. This way we specify the technologies necessary to be deployed in the organization and the way these technologies can be used in order first of all to protect information and systems but also to create measurable results required for their justification.
  • 8. Monitoring, metrics, reporting  Our investments’ effectiveness will be revealed from the systematic measurement and reporting. This must be an objective and its prerequisite is the correct framework for data collection.  We define 4 horizontal actions for the organization: 1. Information security policies with applicable and achievable rules. 2. Obligatory enforcement of policies and rules 3. Monitoring of the policies compliance and enforcement 4. Metrics and reporting that show policies effectiveness
  • 9. People Policy definition Enforcement Monitoring & response Measurement Information security organization Training, awareness, & personnel Identity and access management
  • 10. People Policy definition Enforcement Monitoring & response Measurement Information security organization Training, awareness, & personnel Identity and access management ITgovernancestructure Business outreach program IT operations security Security advocacy & marketing Auditframework Personnel identity & eligibility checking Security steering committee Information risk management team Business-level security Corporate-level security Security awareness & education Performancemanagement Role definition Performance management integration Privilege definition Awareness testing Access control implementation Activity monitoring Privacy, compliance, & ethics training Business controls monitoring
  • 11. Process Systems dev. and operations management Physical and environmental security Incident & threat management Information asset management Policy and compliance framework Information risk management Business continuity & disaster recovery Policy definition Monitoring & response Enforcement Measurement
  • 12. Contents Systems dev. and operations management Physical and environmental security Incident & threat management Information asset management Policy and compliance framework Information risk management Business continuity & disaster recovery Policy definition Monitoring & response Enforcement Measurement Requirementsmanagement QA & system security review Sourcingstrategy ITacquisition Event analysis App access control Change management System access controls Log retention Auditframework Architecturalreview Threat research Response planning Post- incident review Forensics Incident response Security testing Facilities access control Riskassessment Contract management Businessimpact analysis Asset life-cycle management Asset ownership Continuity planning Redundancy management BCP testing Plan maintenance Information asset tracking Records retention Information risk tracking Information risk classification Policy creation Policy maintenance Compliance research Policy distribution Information risk handling BCP training
  • 14. Technology Data Network Databases Systems Endpoints Messaging & content Application infrastructure Policy definition Enforcement Monitoring & response Measurement Network access control NBAD Wireless gateway WLAN monitoring Audit&riskmanagementframework IPS Firewall SSL VPN Database encryption Vulnerabilitymanagement Database monitoring Antivirus Configuration mgmt. Storage security Firewall/Host IPS Directory Application assessment Antivirus Antispam Email encryption & filtering Web filtering Enterprise SSO Antivirus/Antispyware Endpoint control Firewall/Host IPS Client encryption XML gatewayWeb SSO IM filtering Digitalinvestigation&forensics SIM App encryption Information leak protection Enterprise encryption & key management Digital rights management Identity&accessmanagement Strongauthentication Database config. mgmt. Application FW
  • 15. From theory to practice  Very nice theory so far. What can I do in my company?  How can Checkpoint technologies really help me;  The answer in 3 steps: 1. Draw a map of the sectors and domains that we have described so far noting which technologies add value to the eterprise. 2. Draw the same map depicting the exisiting situation in the organization. 3. Prioritize the needs and draw them on paper. Discuss with Checkpoint technology experts how the organization benefit in each sector and every domain.
  • 16. Step 1: Value map Data Network Databases Systems Endpoints Messaging & content Application infrastructure Policy definition Enforcement Monitoring & response Measurement Network access control NBAD Wireless gateway WLAN monitoring Audit&riskmanagementframework IPS Firewall SSL VPN Database encryption Vulnerabilitymanagement Database monitoring Antivirus Configuration management Storage security Firewall/Host IPS Directory Application assessment Email encryption & filtering Web filtering Enterprise SSO Antivirus/Antispyware Endpoint control Firewall/host IPS Client encryption Application firewall XML gatewayWeb SSO IM filtering Digitalinvestigation&forensics SIM Information leak protection App encryption Enterprise encryption & key management Digital rights management Identity&accessmanagement Strongauthentication Database config. mgmt. High Medium Low Antispam Antivirus
  • 17. Step 2: Existing situation Data Network Databases Systems Endpoints Messaging & content Application infrastructure Policy definition Enforcement Monitoring & response Measurement Network access control NBAD Wireless gateway WLAN monitoring Audit&riskmanagementframework IPS Firewall SSL VPN Database encryption Vulnerabilitymanagement Database monitoring Antivirus Configuration mgmt. Storage security Firewall/Host IPS Directory Application assessment Email encryption & filtering Web filtering Enterprise SSO Antivirus/Antispyware Endpoint control Firewall/Host IPS Client encryption Application firewall XML gatewayWeb SSO IM filtering Digitalinvestigation&forensics SIM Information leak protection App encryption Enterprise encryption & key management Digital rights management Identity&accessmanagement Strongauthentication Database config. mgmt. Not implemented Needs attention Satisfactorily implemented Antivirus Antispam
  • 18. Step 3: Prioritization Network Databases Systems Endpoints Applications infrastructure Messaging & content Data Policy & risk management Immediate attention Short-term review Long-term review SIM Audit framework Strong authenticati on IA M Forensics Vulnerability management NA C IPS WLAN gateway WLAN monitoring NBAD Firewa ll VPN Directory App assess Application firewall Application encryption XML gateway Web SSO Configuration mgmt.Server AV FW/IPS FW/IPS Antispyware Client encryption Endpoint control Enterprise SSO Storage security Database encryption Database Monitoring Database config. mgmt. ILP IM filtering Antivirus Antispam Email encryption Web filtering Enterprise encryption & key management DRM Not implemented Needs attention Satisfactorily implemented
  • 19. …some advice  This framework might seem too generic but it is a solid start as it gives a security x-ray image of the organization.Αυτό πλαίσιο είναι πολύ γενικό αλλά αποτελεί μια καλή αρχή καθώς μας δίνει μια ακτινογραφία του οργανισμού.  It must be clear that each enterprise and each sector of the economy or industry has its own special needs.  For best results: 1. Modify the plan to best suit your needs 2. Repeat the exercise every 2 years 3. Build your strategy with annual intervals  A comparative analysis between your company and its peers will persuade even the most demanding CEO or Board.
  • 20. Comparative presentation Information risk mgmt. Policy and compliance framework Information asset mgmt. BC/DR Incident and threat mgmt. Physical and environmental security Systems dev. and ops mgmt. Process Poor Average Good Exceptional Company = 3-year target Company = Current Peer average
  • 21. Athens International Airport Thank you for your attention! George D. Delikouras Athens International Airport S.A. Head Information security IT&T Business Unit george.delikouras@aia.gr