The Journey to Cyber Resilience in a World of Fear, Uncertainty and Doubt
•Download as PPTX, PDF•
2 likes•1,245 views
This presentation was given at CampIT. It motivated the need for a high level of maturity of the enterprise security program, by striving for cyber resiliency.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to The Journey to Cyber Resilience in a World of Fear, Uncertainty and Doubt
Similar to The Journey to Cyber Resilience in a World of Fear, Uncertainty and Doubt (20)
More from John D. Johnson
More from John D. Johnson (14)
Recently uploaded
Recently uploaded (20)
The Journey to Cyber Resilience in a World of Fear, Uncertainty and Doubt
- 1. John D. Johnson CEO/Founder Aligned Security
- 2. John D. Johnson, Ph.D., CISSP, CRISC www.johndjohnson.com @johndjohnson
- 3. The journey begins… •Where are we and how did we get here? •Where are we going? •Why are we going there? •What will it take to get there? •Are we there yet? •Why aren’t we stopping? “I’m going on an adventure!”
- 5. Cyber Resilience Capability Maturity Enterprise Risk Mgmt Corporate Culture *As I view it… • Basic Hygiene • Compliance and Audit Process • Risk Based Security Management • Anchor to Standards Frameworks • Threat Assessment & Modeling • Threat Intelligence • Information Sharing • Use Layered Security to Address Gaps – People/Process/Tools • Assess Effectiveness/Efficacy of Controls with Meaningful Metrics • Integrate with Enterprise Risk Council • Utilize Consistent Methodology and Taxonomy • Communicate Risk Effectively to Stakeholders • Develop Cyber Response & Recovery Playbooks • Build Security Aware Culture • Security Seen as Change Agent • Security Enables Business Value at Risk (VaR) Goal: Prevent or respond quickly to reduce the impact and duration of threat events to your organization, and through preparation, restore normal business operations sooner.
- 9. There was a time when nobody worried about security…
- 10. In the early days, we had security through obscurity.
- 11. Defending The Castle In the 1990s we implemented a castle defense to keep out the bad guys.
- 12. The Castle Model of Defense • What is the advantage of a castle? • The castle is built on high ground • The castle has visibility to see enemies approaching far away • The castle has thick, impervious walls • Guards watch everyone coming and going • It is very difficult and expensive for enemies to breach a castle • Why is our enterprise not a castle? • The Internet has no high ground • We don’t have good visibility to threats • We have lots of holes in our walls • We don’t inspect all the traffic coming and going • A castle is not resilient. It takes a long time to rebuild a wall after it gets hit by a catapult. • The Asymmetric Problem: It is expensive to defend, but the adversary only needs to find one hole to breach the enterprise
- 14. Different Stakeholders Want to Use Technology Differently • Different Employee Segments • Business Partners • Customers • Dealers / Resellers • Business Leaders
- 15. Technology as a Business Advantage Risk Opportunity
- 21. Cybersecurity Spending in U.S. (%GDP)
- 22. Rise in Data Breaches Source: https://www.bluefin.com/bluefin-news/continued-rise-data-breaches-start-going-2017/
- 28. Great opportunities, but are our IT staff ready to secure products, IoT, ICS, OT? Product Security
- 29. Physical and Cyber Infrastructure are Reliant on Each Other for Resiliency 29 Source: DHS, "Securing the Nation’s Critical Cyber Infrastructure
- 30. “There is a massive lack of security awareness in the industrial control systems community.”
- 32. Threat Actors Source: Carbon Black
- 34. Threat Capabilities - 2010 Source: Invincea Sophistication
- 35. Threat Capabilities - Today Source: Invincea Sophistication
- 36. Top Global Risks for 2017 Risk 2017 Rating 2016 Rating Economic Conditions 6.61 5.83 Regulatory Changes and Scrutiny 6.51 6.06 Cyberthreats 5.91 5.80 Speed of Disruptive Innovation 5.88 5.48 Privacy or Identity Management & Information Security 5.87 5.55 Succession Challenges, Ability to Attract and Retain Talent 5.76 5.63 Global Market and Currency Volatility 5.67 5.33 Organizational Culture Hindering Escalation of Risk Issues 5.66 5.30 Resistance to Change Operations 5.63 5.40 Sustaining Customer Loyalty and Retention 5.62 5.28 Source: http://www.journalofaccountancy.com/news/2016/dec/top-business-risks-for-2017-201615723.html
- 37. The Situation Today We cannot enable business transformation if we are still trying to defend a castle. We need to mature our capabilities and strive for cyber resiliency. The Perimeter is Evolving The Volume and Sophistication of Attacks is Rapidly Increasing Global Regulatory Changes Variety and Use of Technology
- 40. Capability Maturity As the security program matures, more fundamental pieces will be in place to support advanced toolsets and capabilities necessary to protect against more advanced threats, respond faster to attacks and recover. The pace of threats, regulatory change and advancing technology require maturity and resiliency. Informal 1 Planned & Tracked 2 Well Defined 3 Quantitatively Controlled 4 Continuously Improving 5 Improved ability to anticipate, execute & respond quickly/effectively N.B. – Ponemon Self-Assessment ranges from -2 to +2 Basic Hygiene Resilient Siloed Top-Down Pervasive
- 41. Anchor Cybersecurity Program Using Standard Frameworks * NIST Cybersecurity Framework
- 42. Cybersecurity Domains Source: Henry Jiang, https://www.linkedin.com/pulse/map-cybersecurity-domains-version-20-henry-jiang-ciso-cissp
- 48. Basic Hygiene We start with ”Basic Hygiene”, such as CIS Top 20 Critical Security Controls. Source: https://learn.cisecurity.org/20-controls-download
- 49. Baseline Configurations CIS also has baseline security configurations for systems and software. This allows you to set a security baseline (with documented variances) which maps back to a framework (NIST CSF) – good security based on industry standards which you can audit against using automation. • OS Platforms: Linux, Novell, Unix, MS Windows, Apple Mac OS • Amazon AWS (Hardened virtual images in EC2) • Browsers: Chrome, Firefox, MS IE, Opera, Safari • Microsoft Office, SharePoint, MS Exchange, Apache, IIS • Mobile Device Platform OS: Apple iOS, Android • Network Devices: Cisco Devices, Juniper, Palo Alto, CheckPoint, Wireless Network Devices • Multifunction Printers • Databases: IBM DB2, MS SQL, Oracle MySQL, Oracle DB, Sybase • Virtualization: Docker, VMware, Citrix Xen
- 50. Risk Based Security Management Roadmap • Understand Current State • Environment (assets (value/inventory/vulns/compliance…), networks, data, applications) • Business knowledge (requirements, processes…) • Regulatory environment • Threats (std process for threat modeling/assessment) • Capability maturity • Determine Risk • Prioritize Security Portfolio • Business Alignment and Enablement • Reduce Risk (Business will choose to Accept, Transfer or Mitigate) • Build capabilities (maturity) • Develop Metrics (operational tactical strategic) • Measure effectiveness of controls at risk reduction • Measure efficiency (are resources going where they add the most value?) • Communicate Business Value If everything is protected equally, nothing is protected adequately.
- 51. A Cyber Risk Framework Improves Resiliency Source: http://www3.weforum.org/docs/WEF_IT_PathwaysToGlobalCyberResilience_Report_2012.pdf
- 52. IT Risk Management Life Cycle IT Risk Identification IT Risk Assessment Risk Response & Mitigation Risk & Control Monitoring & Reporting Source: COBIT
- 53. IT Risk in the Risk Hierarchy Source: COBIT
- 54. BOARD-LEVEL RISK SECURITY PROGRAM ELEMENTS Board Level Risk Categories Business Areas with Security-related Risk Security Program: Security Strategies/Mitigation Financial • Asset Management • Accounting & Reporting • Market Fluctuations • Asset Protection • Exceptions Management • Violation Detection and Reporting • Allegation of Manipulation Investigations • Regulatory Inquiries Business Continuity & Resiliency • R&D and Manufacturing • Logistics • Environment & Safety • Distribution • Business Continuity • Outsourcing • Branding • Information Safeguards and Intellectual Property Protection • Disruption Detection • Mitigation Management • Emergency Response • Disaster Recovery Plans Reputation & Ethics • Customer Relationship Data • Community Relations • Corporate Governance • Privacy Policies & Compliance • Law Enforcement & Liaison • Regulatory Security Adherence • Allegation Response Human Capital • Misconduct • Environmental Hazards • Turnover • Employee Skills & Performance • Compensation & Benefits • Labor Union Issues • Services • Background Checks • Awareness & Training • Code of Conduct • Drug Testing • Benefits Loss Prevention • Labor Disruption Planning • Intellectual Property Protection Information • Intellectual Property • Information & Privacy • Networks • Applications • Hardware • New Technologies • Data Classification • Intrusion Detection • Authentication and Access Control • Physical Access Controls • Digital ID Management Legal, Regulatory/Compliance & Liability • Antitrust Violations • Noncompliance • Audits • Accreditation • Third-party Vendors • Supply Chain • Liability • Litigation • Partnerships & Service Providers • Sales & Marketing • Procurement • Regulatory Controls • Risk Assessment • Security Programs Certification • Partner Due Diligence • Records Retention Policy • Investigations • Program Integrity • Regulatory Compliance • Vendor Contracts/Code of Ethics New or Emerging Markets for Business • Global/International • Mergers & Acquisitions • Competition • Intelligence Analysis and Mitigation • Country Business Risk Assessment • Due Diligence Investigations • Business Intelligence Gathering • Information Safeguards Physical/Premises & Product • Partnerships • Inventory & Products • Unauthorized Access • Warehouse Facility Protection • Product Protection Program • Property Protection Program • Facility Access Policy ©Security Executive Council
- 55. Risk Identification Process Identify Assets Identify Threats Identify Existing Controls Identify Vulnerabilities Identify Consequences Risk Estimation Process Feeds Into Source: COBIT
- 59. Risk Analysis and Response Source: COBIT
- 60. Information Security Risk Management Process Establish Context Identify Risk Risk Analysis Risk Evaluation Risk Treatment Communication and Consultation Monitoring and Review Source: COBIT
- 62. Situational Awareness – Understanding the Current State • Can’t assess risk without knowledge; turn uncertainty into a risk measurement (risk-based security management) • Know the Enterprise: Assets, Data, Applications, Network, Identities… • Know the Business: What is important, learn business processes • Know the Enemy: A case for actionable Threat Intelligence • Root Cause Analysis and Attribution can tell you where to focus (access to historical and forensic data)
- 63. If you’ve ever travelled you are well aware that most people have no situational awareness!
- 64. Asset Vulnerabilities and Value • Knowledge of posture gives vulnerability, and along with understanding threats and value of resources, risk can be calculated • Look for solutions that help you aggregate information from disparate sources about assets (much different from SIEM): • System configuration, patch levels and OS details • Details about desktops, servers, cloud-hosted, BYOD, non-compliant systems, OT systems and ICS • Inventory of software and versions installed • This is not the same as vulnerability scanning • Centralizing this information is key – avoid delays from running to various IT teams whenever you need to gather compliance/IR details
- 65. Cyber Risk Analysis: Threat Modeling Target •Data (DAR, DIM, DIU) •Code/Software •Services •Databases •Operating Systems •Networks/Infrastructure •Platforms/Hardware/Firmware Threat Vector •Copy, Exfiltrate •Modify, Corrupt •Destroy, Denial of Service Threat Source • Insider • Hacktivists • Motivated Hobbyist • Corporate Espionage • Cybercriminals • Nation State Requirements • Level of knowledge required • Ability, Expertise • Proximity required • Access required • Resources required • Time required Motivations • Money • Ideology • Coercion • Ego Risk can be mitigated; the threat landscape remains unchanged. Threat Intel • Industry Peer Groups; ISACs • Threat Intel Feeds • Private/Public Partnerships
- 66. Attack Chain Mapping and Threat Modeling Recon Penetrate Co-Opt Conceal Irreversible Action
- 67. Risk Scenario Overview Source: COBIT
- 68. Black Swan Events • Can’t predict well – statistical methods, extrapolating from trend data fails • If you know: • your organization – strengths and weaknesses • which adversaries might want to attack you • what those adversaries might want to accomplish (money, ideology, disruption) • what they would target • their capabilities • Then you can focus resources to make it costly for the adversaries • And you can focus your resources at protecting what is at greatest risk • This applies to adversaries as well as natural disasters Reference: US Cyberconsequences Unit, http://www.usccu.us
- 70. So why do we want security metrics? • Are we being effective? • Performance • Controls/Processes • Risk Management • Are we efficient? • Are we strategically aligned? • Are we maturing our capabilities? • Are we doing well compared to others?
- 71. Metrics Measure Effectiveness of Controls
- 72. Filling the Gaps with Layered Security Once we have assessed our security risk and measured where we are effective/efficient, we identify additional security layers to improve and mature our security program. This involves People, Processes and Technology. Risk can never be eliminated, but it can be mitigated. Layered security is the most effective way to do this.
- 74. Additional Risk Mitigation Areas that need more focus in the future and emerging security technologies to consider to provide cyber resiliency: • Keys and Certificate Management • Cloud Security Access Brokers & Cloud Proxies • Solutions to help give you situational awareness, such as Endpoint Inventory, Compliance, Vulnerability Management • Improved Threat Intelligence (timely, detailed) • Continuous Risk Profiling (if you have Posture, Value and Threat Info = RISK) • I suggest as technology improves and converges that you can have near real- time view to quantitative and actionable enterprise risk • There are vendors today that will give you an overall risk score that you can compare to peers in your industry – not perfect but proven beneficial
- 75. Fog of War – Deception Technology • Raise the bar for the adversary – Reduce adversary’s operating surface and increase their economic cost • Assume applications know what transactions are legitimate. By adding lots of noise for adversaries it becomes hard to avoid false leads. No false positives for incident response team.
- 76. AI and Machine Learning • With the volume, velocity, variety and sophistication of attacks, it can be very difficult for humans to sort through and triage events and incidents • SIEM is a partial solution that requires a lot of up front work, as you are typically looking for what you expect • Tier I in the future will need to be AI, identifying patterns that are too fast or too slow or fly under the radar for humans with eyes that are tired of starting at a pane of glass • Humans have an important role, but emerging technologies can help your IR staff detect and respond to incidents quicker and better
- 77. Cyber Insurance • Cyber insurance is one way to transfer risk • Cyber insurance won’t absorb all the cost, but helps to reduce the impact of a breach or incident • Today, no two cyber insurers are the same • Cyber insurers are motivated to help you become cyber resilient (they don’t LIKE to pay out) • Cyber insurance is a necessity these days, but don’t think it lets you off the hook for not doing your due diligence
- 78. Training Security Staff • Your security staff, and others in your organization (as you embed security across the organization) will need appropriate training. • Example: Can your IT staff really apply IP network security techniques to secure OT or product? • Training, mentoring and providing a career path is also key for attracting and retaining the best • Smaller organizations may not be able to support the number of experts (or attract and retain) and should consider MSSP
- 79. Perform Exercises and Practice
- 80. Key Aspects of a Successful Awareness Program Security awareness should have: • Executive sponsorship – walk the walk • Targeted content and delivery methods depending on the audience • Classroom, CBT, Teachable Moments, Easy to find Policies & Procedures • Clearly articulated goals • Metrics to measure program efficacy and success • Metrics and surveys to ensure program improvements • Content that emphasizes in a meaningful way, why security is an important part of every employee’s job • Understand the impact to the company and consequences of not following the rules • Security solutions should be designed with the user experience in mind • If the secure way is the easiest way, people are less likely to choose Shadow IT
- 81. Cyber Value at Risk (VaR) • Classifying risks in broad terms such as “high,” “medium,” or “low” does not truly support effective risk management decisions and resource allocation. The cyber value-at-risk (VaR) concept offers firms a game-changing new approach. • VaR both quantifies risk and expresses it in economic terms that can be understood by boards and throughout the executive suite. • VaR aggregates cyber risk with other operational risks in the enterprise risk management framework. • VAR approach will put CISOs in a much better position to offer objective answers to fundamental questions from executives and the board, such as: • What are our top cyber risks in terms of probability and severity? • What impact will risk mitigation/transfer plans have on these risks? • How large are our cyber risks compared to other enterprise risks? • How might our business expansion plans increase our cyber risks? • What are our most cost-effective risk management strategies? Source: https://www.afponline.org/trends-topics/topics/articles/Details/cybersecurity-quantifying-value-at-risk/ Source: http://www.fairinstitute.org/blog/what-is-a-cyber-value-at-risk-model
- 82. Risk Communication Components Effective IT Risk Communication Expectation: Strategies, Policies, Procedures, Awareness, Training, etc. Capability: Risk Management Process Maturity Status: Risk Profile, Key Risk Indicators, Loss Data, etc. Source: COBIT
- 83. Security Metrics for Management • Find a way to add business value • Meeting regulatory requirements • Consolidation of tools, reduction of resources • Demonstrate reduced costs by reduction in help desk cases • Business leaders take the loss of IP seriously • Have security seen as a business enabler. New technologies come with risks, but they may also lead to new innovations and competitive advantage. • Explain it in language business leaders understand • Make presentations clear & concise • Avoid IT jargon • Provide the information executives need to make informed decisions 83
- 84. Where does the CISO report? • The ability to communicate and be effective as a CISO can be hindered by an inefficient organizational structure. • Where does your CISO report? Most continue to report to the CIO, although some organizations have a deeper hierarchy or dotted line reporting. • The key is for the CISO to have access across the business and up to the executive level. This is important for breaking down siloes and improving the cross-team effectiveness necessary. • The CISO should have authority and a budget which will not be at the mercy of IT budget planning and cuts. Because the value of security measures may still be difficult to sell to IT management, less mature organizations will see their security budgets cut, which may prevent them from building the capabilities they need to be cyber resilient.
- 85. Security Leadership • A more mature organization runs security “like a business” in a very strategic and measured way, aligning with business objectives • Metrics demonstrate that resources are going where there is greatest risk/need • Security leaders should lead by example • Leadership is key to successfully achieving cyber resilience • Learn to communicate well to various audiences/stakeholders • The role of security is to express risk in the context of the business to business leaders so they can make informed decisions
- 87. Key takeaways from a Forbes survey of 300 CIOs and CISOs: Investing in Cyber Resilience Source: http://media.cms.bmc.com/documents/Forbes_Insights_SecOps_Survey.pdf
- 88. With data breaches averaging $4 million, what are exec priorities? Source: http://media.cms.bmc.com/documents/Forbes_Insights_SecOps_Survey.pdf
- 89. What technologies do execs feel have biggest security implications? Source: http://media.cms.bmc.com/documents/Forbes_Insights_SecOps_Survey.pdf
- 90. Cyber Resilience Levers McKinsey outlines 7 levers for achieving cyber resilience that help integrate security into the overall business: 1. Prioritize information assets based on business risks 2. Provide differentiated protection for the most important assets 3. Integrate cybersecurity into enterprise-wide risk management and governance processes 4. Enlist frontline personnel to protect the information assets they use 5. Integrate cybersecurity into the technology environment 6. Deploy active defenses to engage attackers 7. Test continuously to improve incident response across business functions Source: https://www.upguard.com/hubfs/UpGuard/ebooks/pdfs/eBook_itil-guide-cyber-resilience-UpGuard.pdf
- 91. Cyber Resilience Review (DHS) • The Cyber Resilience Review (CRR)[1] is an assessment method developed by the United States Department of Homeland Security (DHS). • It is a voluntary examination of operational resilience and cyber security practices offered at no cost by DHS to the operators of critical infrastructure and state, local, tribal, and territorial governments. • The CRR comprises 42 goals and 141 specific practices extracted from the CERT-RMM (Resilience Management Model) and organized in 10 domains): • Asset Management • Controls Management • Configuration and Change Management • Vulnerability Management • Incident Management • Service Continuity Management • Risk Management • External Dependency Management • Training and Awareness • Situational Awareness [1] "Cyber Resilience Review Fact Sheet" (PDF). Retrieved 27 February 2015.
- 93. Barriers to Cyber Resilience • Lack of enterprise awareness • Poor communication • Lack of leadership • Too much focus on compliance and not enterprise risk • Silo mentality • Not having a balance of operational, tactical and strategic; cyber resilience demands “whole system” approach • Lack of new thinking for new problems • Cyber resilience needs to be ingrained in your organizational culture
- 94. Summary 1. Anchor to standard frameworks 2. Perform basic hygiene 3. Implement risk-based security to prioritize your risk response • Focus on high value/mission critical assets 4. Gain situational awareness (assets, data, access, identity…) 5. Model potential threats and risk scenarios (and Black Swans) • Develop incident response plans involving preparedness, detection and recovery • Consider the use of new security technology to mitigate risk from use of disruptive technologies 6. Make use of and understand limitations of Cyber Insurance 7. Invest in training and awareness to build culture of security (resilience) 8. Develop SMART and meaningful metrics 9. Develop CISO leadership and communication skills and consider new reporting structures 10. Exchange information on threats and best practices with peers, vendors, business partners & government
- 95. Instead of fighting the headwinds…
- 96. Change your tack and make them an advantage! Cyber resilience is a journey, not a destination
- 97. Questions? Contact: John D. Johnson, Ph.D., CISSP, CRISC www.johndjohnson.com @johndjohnson
Editor's Notes
- We often talk about the Fortune 500, but there are 9.6 million small to medium sized businesses in the U.S..
- DHS has provided: CIKR facility risk assessments Data center risk assessments These guidelines exist to connect physical and cyber security Even PCI DSS and ISO/IEC 27001:2005 have physical security control requirements
- This article was in the paper the week before researchers were set to disclose information at Black Hat. Let me quote from the article: "The world’s most important facilities—think massive hydroelectric dams and nuclear power plants—are vulnerable to devastating cyberattacks. And it may be just a matter of time before someone gets hurt. The trouble centers around vulnerabilities in so-called Industrial Ethernet Switches (IES), the devices that create the internal networks that are vital for the function of modern factories, refineries, ports, and countless other industrial environments today. The critical vulnerabilities in IES allow attackers to gain access to the network, take full control, and cause potentially fatal damage, the researchers say. “There is a massive lack of security awareness in the industrial control systems community.” Industrial switches are ubiquitous in today's networked industry but rarely appear in homes, making them unfamiliar for most people. But the instrumental role they play in countless facilities means any single vulnerability has far-reaching consequences. The vulnerabilities can lead to events reminiscent of the 2010 Stuxnet attack on Iranian nuclear facilities or the 2014 cyberattack on a German steel mill. These attacks were the first time purely digital weapons caused physical damage to their targets. Stuxnet shut down a wide swath of Iran's nuclear facilities, while the 2014 attack caused “massive” damage in the German facilities when the factory owners were unable to shut down a blast furnace." --- Today, it can take years to replace vulnerable Industrial Control Systems. This has been an area that was more operational and less managed by the IT department. So, the actual process of patching the switches can take several years and loads of money to accomplish, leaving many plants like this vulnerable to network attacks. Industrial control systems often use default passwords, hard-coded encryption keys, and a lack of proper authentication for firmware updates. These three fundamental failures of security combine to make it easier for attackers to gain access to industry devices and therefore cross the divide from the digital world into the physical world.
- Another threat that has been in the news lately is the hacking of vehicles. Cyber attacks against entertainment systems, radios, vehicle networks, can cause real and potentially widespread kinetic damage. Tesla has a good story of reducing functionality if their vehicles are hacked while traveling down the highway. They don't immediately stop the engine, they disable acceleration and allow the driver to steer and brake and get off the highway safely. This is some of what needs to be considered in designing networked vehicles in the future. Now fast forward a few years to autonomous vehicles… self-driving cars and semi-trucks. Now, extend this problem to pacemakers and insulin pumps. Consider the wearable personal health technology. Consider home security systems. Consider the recent hack against baby monitors. It’s clear that the threat landscape is significantly greater that it was just a few years ago, and it is exponentially growing.
- No longer are we dealing with script kiddies in Mom and Dad’s basement. Cybercrime is big business. Hactivism can be destructive and unpredictable. Is anyone familiar with something called Wikileaks? They haven’t caused any trouble lately have they? And, of course nation state actors are sophisticated, patient and well-funded. None of us want to be a victim of nation states.
- What are the take-aways from the latest Verizon Report? Attackers tend to come from the outside, but insider threats are on the rise. We have nation states and organized crime. But, we also have business partners. Our supply chain can be a weak point in our security. Hacking and malware are the two primary methods of stealing data, and compromised passwords are still the main way that hackers are gaining unauthorized access.
- Just a few years ago, only Nation States had the sophistication to create attack tools that could get past our defenses.
- NOW, the threat curve has radically changed and you can see that sophisticated threats are even accessible by Hacktivists with less knowledge and means. Traditional signature-based solutions like antivirus will not prevent these new sophisticated attacks. We need to develop adaptive response capabilities and, BETTER DEFEND - MORE QUICKLY DETECT -And IMPROVE OUR RESPONSE when we detect an indicator of compromise There are several things I will suggest to accomplish this later, as a part of risk based security management.
- Again, the chart on the left comes from the Verizon report showing that the sophistication and volume of attacks are on the rise, year after year. In a survey by Commvault, 87% of CIOs surveyed believe their current policies and procedures leave them exposed to risk under GDPR. 58% believe their companies will be fined under GDPR. The perimeter remains important, but with an increase in remote access by our suppliers and contractors, and moving data to the cloud where services may lack some of the enterprise security controls, the perimeter is definitely changing. Firewalls are not the solution. Castle defense is not the solution. Rather than focusing on trying to protect everything, our new perimeter needs to ”follow the data” and provide a consistent way of assuring data is managed and shared appropriately, by the right users under the right conditions, on the right devices. This becomes a challenge as we rapidly adapt our business processes and adopt new technologies.
- Many of us are in the middle of the pack, but in order to support the demands of the business, our business partners, employees and customers, in order to seize opportunities in the face of increased threats and uncertainty, we need to strive to become cyber resilient. Security not seen as important to the business. Very fragmented and siloed. There is understanding of a need for security from the top-down, but security is not integrated into business processes. Security has broken out of its siloes and security is pervasive at the organization. The organization is highly connected to partners and peers sharing information. Employees have a high degree of awarenes.
- Everyone should recognize the NIST Cybersecurity Framework, 5 domains or pillars…
- Here is another look at cybersecurity domains. You have identity and access management. Network security. Data Protection. Secure Development. Architecture. Frameworks, standards and policies. Endpoint security. Mobile security. Risk management. Incident response and threat management. Security operations. eDiscovery and forensics. Training and awareness. Vulnerability management. We all have our own way of organizing these areas into domains in our organizations. And, we realize that the people, processes and tools we use as well as our methods of risk management overlap.
- Let’s say we are assessing our endpoint security program. We can map our endpoint controls back to NIST CSF. This is a high level diagram, where I also indicate other data sources and integration points. The point being that in order to ensure a robust, layered security program, you should make use of standard frameworks.
- I will expand on the reference architecture for endpoints, related to the IDENTIFY section of NIST CSF.
- Read off the top 5… #1 is the most important, and so on… You can see that there are basic things you can be doing, whether it is endpoints, network, data, cloud, mobile, and so on. The CIS critical security controls are also mapped back to the NIST CSF.
- A little more about secure configurations…
- So far, we’ve discussed the importance of: Using standard frameworks, basic hygiene and utilizing standard baseline security configurations. These are all interrelated and whether you are using COBIT or NIST CSF, or other standard frameworks, they provide a foundation on which you can manage risk at your organization.
- World Economic Forum did a study and determined that a cyber risk framework is the best method of becoming cyber resilient.
- We often do a poor job of communicating risk in terms that are meaningful to business leaders, and which are comparable. IT related risk hits all areas of enterprise risk, so it is important that our approach to calculating risk be in line with what the rest of the enterprise is doing. Scoring risk as red, yellow or green is probably not sufficient. I suggest you work closely with your enterprise risk council if you have one.
- Risk scoring then leads to prioritization of mitigation strategies. If we have a consistent process for assessing and expressing risk, we can compare risks and look at how they are trending and the impact they have and better utilize our limited resources to reduce those risks that are greatest.
- We may show red, yellow and green here, but that’s ok if you are accounting for the enterprise risk appetite and expressing risk in terms that are consistent for the enterprise.
- These COBIT slides are just reinforcing the process of analyzing risk and selecting appropriate and prioritized risk response options.
- And, of course, security does not exist in a vacuum. It is important to work with other teams and communicate effectively throughout the process. When you apply your risk treatment, you continue the cycle through the use of metrics and other feedback. So this is a continuous process.
- One thing that can interfere with the accuracy and precision of a risk calculation is a lack of information or poor quality or stale data. Perhaps I have put the cart before the horse in addressing the process of risk management before discussing the importance of what I’ll refer to as situational awareness.
- We can't protect everything. As the saying goes, If everything is protected equally, nothing is protected adequately.
- Imagine you have people coming up to you asking questions: Is AV running on all our endpoints? Do any endpoints have OS or software vulnerabilities that can be exploited? Are endpoints configured properly? What exposure do we have to the latest zero day? What was accessed from that compromised laptop? What assets are the most important? What is our risk? You don’t have a complete inventory of all systems and software (rogue devices, multiple asset DBs, what about IoT?). You might have disparate data on everything from spreadsheets to specialized application databases. When it isn’t all centralized and automated, you have to ask the other IT teams who own these data sources and tools to run scans and provide reports and then you must manipulate them in Excel to try and find an answer. You are faced with a slow and time consuming chore and the next time someone asks that same question, you have to go through the entire process again. It is painful! Really, without having up-to-date, centralized, reliable data on your assets, their posture and their value, you have a hard time calculating risk. You are guessing. You won’t immediately know what assets are affected by the latest exploit. Vulnerability scanning won’t solve this problem, neither will SIEM. I tried but was never able to home-grow a solution to this problem, because other teams didn’t feel it was a priority. I think gaining situational awareness, and it extends to identity and privilged access and data management and network… is a journey of its own, and you don’t need to wait to have the perfect data sources. I think if you start to centrally aggregate data and automate this and keep it current, you can have a very powerful tool for assessing compliance and risk in your environment. It is just a matter of deciding what questions you need to answer and start to build that extensible platform.
- We want to identify the risk, and one way to do that is with threat modeling. When you are modeling threat, you want to determine who wants what and how they are likely to go about getting it. I think there are some really smart people and service providers in this space, who can help you understand the risk your industry and your company in specific may be facing.
- Threat modeling can then be mapped to the attack chain, to determine where you can best prevent or detect and respond to likely threats.
- Risk scenarios can go beyond just the attack chain, so you may formalize a process for developing and walking through generic or business-specific risk scenarios.
- If you know these things, you can walk through specialized risk scenarios to identify potential black swan events.
- I bet you didn’t see this coming!
- Now that we have matured capabilities, by: Anchoring to standard frameworks Performed basic hygiene Implemented risk-based security to prioritize your risk response Gained situational awareness And identified potential threats and risk scenarios You need to gather metrics to determine if your risk response is effective…
- I just want to emphasize that your controls are never perfect.
- What we are developing here is a high level strategy for maturing your capabilities, with cyber resiliency being the goal. So far, this is all positioning you to have a solid foundation for your security program so you can better identify and reduce risk in your environment. In the next couple slides I will suggest some technical solutions that may help address the evolving threat landscape and changing regulations and business transformation involving new technologies and the cloud.
- These are areas that companies are often weak in. I am seeing new and innovative solutions that should be considered.
- Now we shift gears and look at the human element and often our weakest link. We will discuss different types of training, exercises and awareness that will help build skills, preparedness and a culture of security awareness in your organization.
- I wanted to come back to this concept because it really relates to not only assessing risk, but doing it in a way that is meaningful to executives and boards.
- Another COBIT slide expressing the aspects of effective IT risk communication.
- Some additional advice for the CISO who needs to report to the board. Smart and meaningful metrics can be a strong indication as to the effectiveness and efficiency of the security program. Make it personal. Make it relevant.
- Let’s take a look at what matters to senior executives.
- Whether it is a review by DHS or benchmarking and sharing of best practices and threat intelligence, a highly resilient organization is proactive and involved in information sharing beyond their four walls.
- This slide is new.