CISO forum X, 2017, Moscow, Russia

1. RISKS VS. REAL LIFE
Mona Arkhipova
Unit Manager of information security architecture and monitoring
Acronis

2. PROPRIETARY AND CONFIDENTIAL 2PROPRIETARY AND CONFIDENTIAL 2
About me
Unit Manager of information security architecture and monitoring,
Acronis
Past:
• Head of SOC and OPS monitoring, Lead information security expert
at QIWI group;
• Security analyst at General Electric (GE Capital);
• independent security consultant at fintech start-ups;
• *nix systems and network administrator

3. PROPRIETARY AND CONFIDENTIAL 3PROPRIETARY AND CONFIDENTIAL 3
Traditional approach
Risk is a function of the likelihood of a given threat-source’s
exercising a particular potential vulnerability, and the resulting
impact of that adverse event on the organization.
- NIST 800-30
Risks management is the base for most part of security-related
standards.
But is it applicable to security in real life?

4. Prepare your perimeters

5. PROPRIETARY AND CONFIDENTIAL 5PROPRIETARY AND CONFIDENTIAL 5
Physical security
Most widely used state to argue about internal systems’ security:
“Why should we harden this asset/application/device? It’s for
internal users only, no one can enter our office! There’s no risk!”
There are many ”unbelievable” ways to get inside:
• Shared areas in your business center
• ”Comfortable” ways to less secure areas for employees
• Good old social engineering

6. PROPRIETARY AND CONFIDENTIAL 6PROPRIETARY AND CONFIDENTIAL 6
Internal resources
One more state to argue about internal systems security:
“Why should we harden this asset/application/device? It’s for
internal users only, everyone should be authorized to use those
systems! The risk is low!”
In many companies way inside is much easier than it could be
imagined:
• Lack of segmentation
• Lack of controls on remote access
• External-facing intranet portals
• Oh, and one step back – physical security

7. PROPRIETARY AND CONFIDENTIAL 7PROPRIETARY AND CONFIDENTIAL 7
Test environments
”There’s no sensitive data, it is not production”
Common mistakes:
• Not (properly) segregated from internal network
• Passwords/keys reuse
• Core management systems links
• Often DOES CONTAIN production data

8. PROPRIETARY AND CONFIDENTIAL 8PROPRIETARY AND CONFIDENTIAL 8
(Not so) good services
Do you really rely on external services?
• Had you ever reviewed information you send?
• Aren’t you afraid to transfer your sensitive data to services with no
formal background?
• Do you believe to your security service providers’ employees like
your own ones?
• Do you have 3rd party security review?

9. Legacy systems

10. PROPRIETARY AND CONFIDENTIAL 10PROPRIETARY AND CONFIDENTIAL 10
Mission-critical systems
”We can not patch the system, it’s too critical, update would ruin it”
• Good start point for your BCM program
• Vulnerability and patch management declared by standards
• One day it may ruin your business not only for security reasons
• Human mistakes
• Lack of expertise (delayed issues)

11. PROPRIETARY AND CONFIDENTIAL 11PROPRIETARY AND CONFIDENTIAL 11
Core Business Impact
Code quality and less legacy directly
affects business, especially based on in-
house developed applications
 Good code – stable and secure code
 Stable code is the basic brick of overall
service stability and availability
 Stable HA service – good customer
experience
 Good customer experience brings more
than just money.

12. Weakest link in your
security chain

13. PROPRIETARY AND CONFIDENTIAL 13PROPRIETARY AND CONFIDENTIAL 13
Endpoints
“I’m tired of all that weekly/monthly/quarter reboots”
• Security is around data, not only a server somewhere
• Old good software may be a great security risk
• …as well as service tested on workstation for faster
feedback/dev/PoC/whatever
• What’s about lost devices, BYOD and remote access?

14. PROPRIETARY AND CONFIDENTIAL 14PROPRIETARY AND CONFIDENTIAL 14
Employees
”Our employees are loyal, we believe them”
• Prepare for a lot of disappointment after DLP installation
• Not all loyal employees stay loyal in crisis situations (or just local
conflicts)
• Not all “oldboys” are playing on your side
• Unspoken things about contracts bribery and its detection
• Not all companies have employment pre-checks and proper
conflict of interests detection
• Do you really know your data flows?

15. Questions?
Mona Arkhipova
Unit Manager of information security architecture and monitoring
Mona@acronis.com /monaarkhipova