The document discusses sensible defense strategies for cybersecurity. It outlines how to ensure the CIA triad of confidentiality, integrity and availability through prevention, detection and response techniques. It also discusses risk management best practices such as identifying threats, assessing impact and frequency, and conducting quantitative and qualitative risk analyses. Finally, it advocates for a balanced, common sense approach to security that considers economic incentives, legal compliance, user awareness, technology tradeoffs and security as an ongoing process of managing tradeoffs.

1. Conostix S.A. koen@conostix.com
Sensible defence

2. Conostix S.A. koen@conostix.com
• CIA and prevention/dectection/response
• Risk management and its pitfalls
• Economic incentives
• Liability/regulation/compliance
• Due care and due dilligence
• Technology
• Awareness
• Conclusion
Introduction

3. Conostix S.A. koen@conostix.com
• To ensure the CIA triad we use:
• Detection
• Prevention
• Response
How security works

4. Conostix S.A. koen@conostix.com
• Identification
Identify the actual threat
• Impact factor
The possible consequences of an attack
• Frequency
The probable frequency of the occurrence of a threat
• Probability
The extent of how confident we are a threat will happen
Today’s risk management
Identification of a threat

5. Conostix S.A. koen@conostix.com
• Identification of the current risks
• The cost/benefit justification of the countermeasures
• Influences the decision making process on hardware,
etc
• Focus on security resources where they are needed
most
Today’s risk management
Risk analysis goals

6. Conostix S.A. koen@conostix.com
• Threat
• Asset
• Vulnerability
• Safeguard
• Asset value (AV)
• Exposure factor (EF), value in percentage
• Single loss expectancy (SLE), dollar figure (EFxAV)
• Annualized rate of occurrence
• Annualized loss expectancy (ALE= SLExARO)
Today’s risk management
Risk analysis – key terms

7. Conostix S.A. koen@conostix.com
• Aims to assign tangible values
• Relies on qualitative data
• Process
• Estimate potential losses to the assets
• Analyze potential threats to the assets
• Define impact and frequency levels
• Define the ALE
Today’s risk management
Risk analysis – Quantitative

8. Conostix S.A. koen@conostix.com
• Scenario oriented approach
• Rank threats on a scale to evaluate their risks, costs
and outcome
• In contrast to quantitative analysis a purely qualitative
analysis is always possible
• High guess rating
Today’s risk management
Risk analysis – Qualitative

9. Conostix S.A. koen@conostix.com
• Misunderstanding between risk and certainty
• A risk is the anticipated frequency of losses
• Certainties are occurring with high frequency
• Reliance on probability, impact and frequency
• The unknown, controls the probability, frequency
and the impact of a future incident.
Today’s risk management
Pitfalls

10. Conostix S.A. koen@conostix.com
• Benefits vs costs
• Economic pressure
Sensible defence
Economic incentives

11. Conostix S.A. koen@conostix.com
• Laws push standards
• Liability creates awareness
• Regulatory bodies motivate
Sensible defence
Liability, regulation, compliance

12. Conostix S.A. koen@conostix.com
• Due care is using reasonable care to
protect the interests of an organization
• Due diligence is practicing the activities
to maintain the due care efforts.
• Common sense security framework
Sensible defence
Due care and due diligence

13. Conostix S.A. koen@conostix.com
• Functionality vs security
• User friendly does not mean insecure
• Ease-of-Use + Common Sense = Security
• Privacy vs security
• Sacrifice privacy for security?
• Should security protect privacy or ignore it
to enhance security?
Sensible defence
Technology

14. Conostix S.A. koen@conostix.com
• Human intelligence most important
• Reduce risk without technology
• Limit damage in case of an incident
• Give users insight in values of company assets
and the usage of information systems
Sensible defence
Awareness

15. Conostix S.A. koen@conostix.com
• Sensible defence is balanced security
• Balance cost vs economic gain
• Balance liberty vs privacy
• Balance functionality vs security
• Liability, legislation and regulation
Sensible defence
security is a trade-off

16. Conostix S.A. koen@conostix.com
Q & A
Thanks to:
My colleagues
Donn Parker
Bruce Schneier
Rebecca Herolds
Sensible defence
Questions?