Downloaded 22 times
Uploaded byMarc Vael
Valuendo cyberwar and security (jan 2012) handout
This document discusses cybersecurity threats and lessons learned regarding cyber attacks. It outlines various types of cyber threats including criminals, malware, and state-sponsored attacks. It notes that cyber attacks are difficult to execute but governments have the resources to conduct attacks. The document emphasizes that cyber attacks are a real danger and targets are often unprepared. It provides strategies for mitigating cyber attacks, including governance, policies, education, resources, and incident management. Overall, the document stresses that while technology is important, training people is also critical for cybersecurity.
More Related Content
![CERT Australia Update, by Scott Brown [APNIC 38 / Network Abuse BoF]](https://cdn.slidesharecdn.com/ss_thumbnails/certaustralia-engagement-apnic382014networkabusebof1410842858-140916001728-phpapp01-thumbnail.jpg?width=640&height=640&fit=bounds)
Similar to Valuendo cyberwar and security (jan 2012) handout
Valuendo cyberwar and security (jan 2012) handout
- 1. How vulnerable areyou to cyber attack?
- 2. Cybersecurity threats • Cyber-criminals •Malware • Phishers • Spammers • Negligent staff • Hackers • Unethical employees misusing/misconfiguring security functions • Unauthorized access, modification, disclosure of information • Nations attacking critical information infrastructures • Technical advances that can render encryption algorithms obsolete
- 3. Lessons learned sofar Cyberattacks are DIFFICULT to execute.
- 4. Lessons learned sofar Governments do have the resources/skills to conduct cyberattacks.
- 5. Cyberwarfare is "the fifthdomain of warfare“
- 6. “Cyberspace is anew domain in warfare which has become just as critical to military operations as land, sea, air and space.”
- 7. “Actions to penetratecomputers or networks for the purposes of causing damage or disruption.”
- 8. Information warfare is “using& managing IT in the pursuit of a competitive advantage over an opponent“
- 9. Lessons learned sofar Cyberattacks are a real, clear and present danger to organisations & government agencies.
- 10. “It’s possible thathackers have gotten into administrative computer systems of utility companies, but says those aren’t linked to the equipment controlling the grid, at least not in developed countries. I have never heard that the grid itself has been hacked.” Howardt Schmidt, Cyber-Security Coordinator of the US
- 11. Lessons learned sofar Targeted organizations are unprepared.
- 12. Lessons learned sofar Security professionals are at risk.
- 13. Risk always exists! (whether or not it is detected / recognised by the organisation).
- 14. Impact of anattack on the business
- 15. Cyberattack mitigating strategies Corporategovernance : ERM = COSO Support from Board of Directors & Executive Management
- 16. Cyberattack mitigating strategies Managing risks appropriately
- 17. Cyberattack mitigating strategies Policies & Standards
- 18. Cyberattack mitigating strategies Project Management
- 19. Cyberattack mitigating strategies Supply Chain Management
- 20. Cyberattack mitigating strategies EDUCATION!
- 21. Cyberattack mitigating strategies Providingproper funding
- 22. Cyberattack mitigating strategies Providingproper resources
- 23. Cyberattack mitigating strategies Measuring performance
- 24. Cyberattack mitigating strategies Review / Audit
- 25. Cyberattack mitigating strategies Incident/Crisis Management
- 26. Governance Objectives Business Objectives PO1 Define a strategic IT plan PO2 Define the information architecture Information Criteria PO3 Determine technological direction • Effectiveness PO4 Define the IT processes, organisation and • Efficiency relationships • Confidentiality • Integrity PO5 Manage the IT investment • Availability PO6 Communicate mgt aims & direction • Compliance PO7 Manage IT human resources • Reliability PO8 Manage quality PO9 Assess and manage IT risks ME1 Monitor & evaluate IT performance PO10 Manage projects ME2 Monitor & evaluate internal control IT RESOURCES ME3 Ensure compliance with external • Applications requirements • Information ME4 Provide IT governance • Infrastructure • People PLAN & ORGANISE MONITOR & EVALUATE ACQUIRE & DS1 Define & manage service levels IMPLEMENT DS2 Manage third-party services DS3 Manage performance & capacity DS4 Ensure continuous service DS5 Ensure systems security AI1 Identify automated solutions DS6 Identify & allocate costs DELIVER & AI2 Acquire & maintain application software DS7 Educate & train users AI3 Acquire & maintain IT infrastructure DS8 Manage service desk and incidents SUPPORT AI4 Enable operation and use DS9 Manage the configuration AI5 Procure IT resources DS10 Manage problems AI6 Manage changes DS11 Manage data DS12 Manage the physical environment AI7 Install & accredit solutions and changes DS13 Manage operations
- 28.
- 29. “I don’t carehow many millions of dollars you spend on security technology. If you don’t have people trained properly, I’m going to get in if I want to get in.” Susie Thunder, Cyberpunk
- 31. Contact information Marc Vael CISA, CISM, CISSP, CGEIT, ITIL Service Manager, Prince2 Director Knowledge Board ISACA 3701 Algonquin Road, Suite 1010 Rolling Meadows IL 60008 USA http://www.isaca.org/security marc@vael.net http://www.linkedin.com/in/marcvael http://twitter.com/marcvael