Recommended
More Related Content
What's hot
What's hot (20)
Similar to Security challenges in 2017
Similar to Security challenges in 2017 (20)
Recently uploaded
Recently uploaded (20)
Security challenges in 2017
- 1. SECURITY CHALLENGES IN 2017 Prevalent cyber security challenges facing businesses today. Etienne Liebetrau - CISSP Infrastructure Architects @Woolworths Holdings Security Consultant Technical Writer Solution Deployment Contractor Researcher Firewall / UTM collector Public Speaker – working on it! The views and opinions expressed in this presentation are my personal ones based on experience in the field. It is not sanctioned by any 3rd party customer or vendor.
- 2. SCARY STATS SLIDE - MANDATORY
- 4. PEOPLE ARE THE PROBLEM • Getting adequate focus and funds allocated to security initiatives • Technically focused individuals can’t translate the needs to business motivators • Use C-suite to further your cause – explain liability • Security seen as a non functional service, as a preventative measure • Focus rather on the enablement • Create visibility • Find your weak spots
- 5. LACKING SECURITY IMPLEMENTATION • People • Lack of understanding the issues • Lack of ability to execute a solution • Lack of caring – not my issue • Process • Poor change control – low value • Slow to adapt to change • Slow to respond to incident • BCP and DR confusion • Technology • Sweating assets beyond common sense • Budget cycles • Business priority • Technical Debt racks up with cloud adoption
- 6. MANY PROBLEMS - MANY SOLUTIONS • Patch management • Software and device vulnerabilities • Capacity and replacement • Device management • Network access – BYODisaster • RBAC • Lack of visibility, lack of understanding • Solutions are all over • Various frameworks to address the issues • Users are a weak spot Snowden showed how well it worked
- 7. SECURITY SUGGESTIONS • Simplify – deployments – solutions and process. Less is more • Update – Update - Update • Consolidate on a technology partner • Leverage all value from single platform before adding another • Multi instances better than monolithic • Leverage cloud technologies • Visibility is key • Perimeter, core and endpoint security • Cryptography is your friend and your enemy • Talk to anyone who will listen – create awareness - change the culture • Challenge the status quo – attackers don’t care about your change freeze • Test “people – process – technology” and do it often
- 8. RISK BASED ASSESSMENT • Attackers go after low hanging fruit first, so should you. • Stay up to date with attack vectors and methods • User awareness such as phishing tools and campaigns • Have an automated plan for alerting and incident response • Red team, Blue team and Command • Red team - Basic vulnerability testing of environment (fun team) • Blue team – Detect, Defend, Secure, Remediate (sitting ducks) • Command – Takes care of paperwork – escalates up the chain
- 9. EXECUTIVE LIABILITY • Law varies per country and region - GDPR • More and more executive liability • Negligence leading to personal fines or jail time • Inter company or corporate disciplinary actions • Statistically - breach, attack or compromise is inevitable • Know what is and is not your burden • Cover yourself • Non-repudiation communication of issues • If all else fails and no one listens…
- 10. GOOD STATS TO CHEER YOU UP
- 11. SECURITY CHALLENGES IN 2017 Prevalent cyber security challenges facing businesses today. Questions and discussions
Editor's Notes
- Cyber crime is a business – some of it is organised and well funded Employee know how bad the security is and what they can get away with Noise clouds the real picture
- Email is still used because it is effective Even internet facing systems remain vulnerable for a long time People are expecting cyber security issues - soon
- Business is worried and not sure of security team can protect them and services gained from something like a firewall - Example – Firewall enables internet VPN on BBoF reduces MPLS cost.
- Identify where you issues lie, so you don’t repeat the cycle Great technology can be defeated by a bad administrator Technology solution can have limited or delayed implementation due to bad process Required technical bits are not implemented at the same speed as cloud adoption.
- Break down the problems Address them holistically Expect failure
- Elegance in simplicity Update software, patches, versions, operating systems Find someone who you can trust Find a platform that will scale and grow and cover you Cover all of the bases and attack points Cryptography It keeps both you and attackers secure and undetected Softer human side of things
- Some practical advice Do basic checks, often. Bug bounty, incentivise vulnerability identification.
- GDPR in Europe Mid 2018 massive fine for enterprises 4% of turnover Who is responsible for security Who shares the liability Who gets fired Who owns the response plane Who executes it