Security awarenesspreso draft-v-11

SECURITY AWARENESS SERIES
TOP 5 SECURITY ISSUES FOR 2012

Presented By:
Joe Schorr
Principal Security Architect

Jschorr@cbihome.com

Agenda

• Current Events
• Top 5 Security Issues in 2012
• Self-Defense Online
• Tips for home
• Next Steps
• Q&A
• Glossary of Terms

2 Jschorr@cbihome.com
800.747.8585 | comerica@cbihome.com

Security Trends

CHALLENGING
THREAT LANDSCAPE

MALICIOUS INSIDERS
TARGETED ATTACKS

EVOLVING INCREASING
INCREASING FINANCIAL
INFRASTRUCTURE COMPLEXITY
AND BRAND RISK

COMPLIANCE
DATA GROWTH REQUIREMENTS
MOBILE VIRTUALIZATION

VENDOR COMPLEXITY
CLOUD

Jschorr@cbihome.com

State of Security

Source: 2011 Symantec State of Security Survey

Recent Events – ‘The Year of The Hacker’


Recent Events – Personal Information Lost


Top 5 Security Issues in 2012

 Mobile Security

 Cloud Security

 Malware and Viruses

 Data Leakage

 Targeted Attacks


Mobile Security

And yet…
29% of enterprises use tablets today1
67% intend to in the next year1
60+ million iPads® in less than 2 years2
75% of Fortune 500 testing and
deploying iPads3

Q1 2012 – The Mobile Tsunami Arrives:
• Execs (and others) are bringing in iPads,
Tablets and Smart Phones with or without
permission
• Comingling of personal and corporate apps
heightens risk to data
• Primary concern is email, followed by web,
file sharing, social media & other cloud-
based that use web to share data
1 Morgan Stanley Research Blue Paper: “Tablet Demand and Disruption”, Feb. 2011
2 Forecast: Media Tablets by Operating System, Worldwide, 2008-2015, 3Q11 Update, 16 Sept. 2011, Gartner
3 Apple CFO, Apple earnings call, April 2011


Mobile Security - Tips

 Audit your current state

 Create a policy!

 Assess your Plan

Invest in Mobile
 Management


Cloud Security – Attractive but Challenging

Talent
• Do you have knowledgable Security staff?
• Can you invest in developing them going
forward?

Time
• 24/7 management
• 24/7 incident response

Technology
Time
• Up-to-date, optimal mix of defensive
solutions
Tech • If your working methods change, does
Talent security keep pace


Cloud Security - Tips

Check the reputation of
 the Service Provider

How does the Provider
 address your security
needs

Research Service Level
 Agreements, Certifications
and Disaster Recovery

Try it! Cloud makes it easy
 to ‘turn on/turn off’


Malware and Viruses

SMB Threat Awareness Poll Global Results 2011

Malware and Viruses - Tips

Conduct a ‘Healthcheck’ of
 your current defenses

Review the results and
 match against your security
needs

Ensure you are updated and
 using all standard features


Data Leakage:
Intellectual Property (IP) and Personal Info (PII)

+ Billion/year
$6
=

Data Leakage Tips

 Classify your data!

Create a IP PII policy
 (what is and isn’t
allowed out)

Perform a Risk
 Assessment

Factor ‘Data Leakage’
 protection into the
security plan

Targeted Attacks

Phishing is a well-known type of hacking attack using spam
emails to trick the recipient into clicking a link or opening
an attachment in order to get control of their computer.
Spear Phishing is a newer, targeted attack using email.
These attacks are random but more often the persistent
efforts of criminal enterprises, or state-sponsored
professionals seeking trade secrets, financial gain or
military intelligence.
Spear Phishing uses social engineering techniques and
appear to come from within a person’s place of
employment, an authority figure or a friend.

What this looks like to you….

1. The targeted person receives the fake email
2. User follows instructions on false site they are directed to
3. Or… the user opens a malicious payload in an attachment


Online Defense Tips

1. REVIEW! Your personal information on the internet
and social networking sites immediately. Start to
look at your online persona as an attacker would.


Online Defense Tips

2. SANITIZE! Your online life. Remove references to
personal information on social networking and social
media sites. Even family info, photos and hobbies
can be used against you and your company.


Online Defense Tips

3. DON’T! Click links or respond to mysterious email
messages. Double-check the authenticity especially if
they seem abnormally urgent. Examine the link
names.


Online Defense Tips

4. UPDATE! And patch your anti-virus software. Many
attackers make use of ‘zero-day’ or very new viruses
and attack vectors. Keeping up to date is your best
defense against new malware.


Online Defense Tips

5. TURN ON! All the features on your security software.
Make sure that all elements of the solution are
enabled and active. It does no good if your anti-virus
is ‘On’ but the firewall or email filters are ‘Off’.


Tips for Home

http://www.connectsafely.org/ http://www.staysafeonline.org http://us.norton.com/content/en
pdfs/fbparents.pdf /sites/default/files/resource_d /us/home_homeoffice/media/the
ocuments/Parents%20Internet me/parentresources/FamilyOnlin
%20Safety%20and%20Security eSafetyGuide_3rdEd_final.pdf
%20STC.pdf

Next Steps

• Publish a corporate policy for public information
• Prohibit publication of org charts, personal info, phone lists,
customer lists, etc.

• Implement awareness training for your employees
• Let them know they are targets and what attackers want to
know

• Create a Response Strategy
• Begin to track the kinds of ‘spam’ you’re getting (you may be
targeted and not realize it)

• Contact CBI for assistance with these and other information
security and security awareness issues, including security and
vulnerability assessments


MVAS Services
(Managed Vulnerability Assessment Services)

MVAS was developed and
Conduct
created in response to many Baseline
clients requesting ongoing Assessment

vulnerability assessments from
Remediate
CBI Identified
Presentation
of Results
Risks

Generally these clients require a
more frequent occurrence of
assessment testing based on
different variables:
Remediate
• Regulatory Compliance Presentation
of Results
Identified
Risks
• Due Diligence
• Highly volatile Threat
Conduct
Landscape Quarterly
Assessment
• Previous Incidents


THANK YOU
jschorr@cbihome.com
@JoeSchorr

Security awarenesspreso draft-v-11

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (6)

Similar to Security awarenesspreso draft-v-11

Similar to Security awarenesspreso draft-v-11 (20)

Recently uploaded

Recently uploaded (20)

Security awarenesspreso draft-v-11