SlideShare a Scribd company logo

What every executive needs to know about information technology security

•Download as PPTX, PDF•
•
Legal Services National Technology Assistance Project (LSNTAP)
Legal Services National Technology Assistance Project (LSNTAP)

This document provides an overview of key information technology security topics for executives, including cloud computing, cyber insurance, passwords, mobile security, and network security. It discusses the business reasons for protecting an organization's data, assesses data sensitivity levels, outlines considerations for using cloud services and drafting cloud contracts, reviews types of cyber insurance coverage, and recommends password, mobile device, and network security best practices. The goal is to help executives understand current IT security challenges and strategies.

Technology
1 of 32
What Every Executive Needs To Know About Information Technology Security Peter Campbell Chief Information Officer Legal Services Corporation
Topics Introduction/Data Security Cloud Computing Cyber Insurance Passwords Mobile Network Security Questions?
The Internet is rapidly changing, as are the ways that you should protect yourself. This is relatively current information that factors in the use of mobile technology and cloud computing.
Image by National Institute for Occupational Safety and Health (NIOSH), via Wikimedia Commons Why we need to be protected: Business continuity Safety of clients, staff, data, and property Compliance (PCI, HIPAA, etc.)
Attackers either: Want something you have, or Want to extort money from you by taking what you have, or Want to attack others by using what you have.
Two kinds of risk: Sensitive Information Breached Systems Attacked Image by Setreset (Own work), via Wikimedia Commons
Data Sensitivity must be assessed: High - Medium - Low Risk to organization vs risk to clients, etc. Labor/time to reproduce Security policies should be based on these assessments Image by Friedrich Graf, via Wikimedia Commons
Cloud Computing
Core Cloud Considerations: Established cloud services might offer higher data security than you can How many certified IT Security Specialists do you have on staff, compared to Google or Microsoft? But also have low accountability for confidentiality Vendor might give data in response to subpoenas that you wouldn’t
Cost concerns: Moves software from capital to expense Subscriptions cost more than maintenance renewals, but are possibly offset by infrastructure and support savings Huge benefits for remote access
Contracting Tips: Make sure that you backup your data locally and are able to access it if a cloud vendor goes out of business Clearly delineate duties Never agree to termination fees [Image: “The Land of Contracts” by David Anthony Colarusso]
Cyber Insurance
As of 2013, 35 insurers covered this1. Now many more do. Third party and first party offerings Costs vary widely, as do items covered (shop around!) About Cyber-Insurance 1. https://www.mcguirewoods.com/Client- Resources/Alerts/2013/12/A-Nonprofit-Buyers-Guide-to- Cyber-Insurance.aspx
Third Party Coverage Litigation Costs Regulatory Expenses Notification Costs Crisis Management PR
First Party Coverage Theft and Fraud Forensic Investigation Business Interruption Data Loss and Restoration Photo by Jon Crel
Passwords aren’t secure. Any password can be deciphered Any network can be hacked The old rules about password safety are invalid Image by nikcname
But passwords are still critical. Strong passwords: Long phrases are better than words Upper case letters, lower case letters, numerals, punctuation, spaces. Not too difficult to remember - or Stored in a Password Manager Subject to two-factor authentication Unique across systems
New Thinking on Passwords Changing the password regularly is not as important as changing it after a breach. Fingerprint readers and other physical alternatives are only secure if they aren’t compromised - a fingerprint can’t easily be changed. Password Managers are necessary.
Dual Factor Authentication AKA “Two Factor Authentication” “2FA” Insures that a hacker with your password can’t access your account Multiple methods: text, phone, email, fob, or app Home and work PCs can be trusted Image by Brian Ronald
Password Managers Only one password to memorize Fills in passwords across computers and devices Generates secure passwords The best include breach alerts and security checks
Mobile Image by HLundgaard (Own work) [CC BY-SA 3.0 (http://creativecommons.org/licenses/by-sa/3.0)], via Wikimedia Commons
Core Mobile Considerations Business data on mobile devices is not subject to network security measures Mobile devices are easily lost or stolen Public WiFi networks are often insecure Malicious apps surreptitiously copy private information from mobile devices Image by Alan Levine
Security Measures Screen Locks Passcodes are safer than patterns Fingerprint, facial recognition only good if phone isn’t hacked. Encryption (SSL Anywhere) Two Factor Authentication Hotspots (as opposed to public WiFi)
Mobile Device Management Software Mobile Device Management Systems (MDMs) offer a degree of security for mobile devices. With them, you can Remotely wipe data Track devices Remotely install/remove applications Block application installs Enforce security options
Policies and Education Key to safely letting staff work with company data (email, documents, etc.) on mobile devices is solid policies and user education. The best security in the world won’t protect you if staff don’t know how to protect passwords and detect scams. Policies should be sensible and not so prohibitive that staff are compelled to work around them.
Network Security
Office Security If you have IT staff, you likely have these things in place Firewalls, anti-virus, anti-spam and other standard security tools can only protect what passes through them Mobile devices, USB drives and other portable media can bypass security Servers open to the public (web servers, remote access, client-facing applications) are at greatest risk. Photo by Ilya Sedhyk
Monitoring and Perimeter Testing It’s important to have software that monitors the systems and alerts IT staff in case of hardware issues or attacks. Investigations might be critical in case of a breach. Perimeter Testing should be done regularly to identify security issues. Pricing varies widely on this service Find best mix of pricing/frequency Can be a requirement/cost offset for cyber-insurance
Ransomware PC and/or server drives are encrypted and data inaccessible until a ransom is paid to hacker Triggered by links in emails or infected media (such as flash drives) Protection: Backup to cloud or alternate media Spam and virus filtering User education! Avoidance:
Contact Peter Campbell, CIO, LSC pcampbell@lsc.gov 202-295-1685 @peterscampbell Session Eval: http://tinyurl.com/TIGeval

Recommended

Information Technology Security A Brief Overview 2001
Information Technology Security A Brief Overview 2001Information Technology Security A Brief Overview 2001
Information Technology Security A Brief Overview 2001
Donald E. Hester
 
information security technology
information security technologyinformation security technology
information security technologygarimasagar
 
22 need-for-security
22 need-for-security22 need-for-security
22 need-for-security
Al Balqa Applied University
 
Introduction to Information Security
Introduction to Information SecurityIntroduction to Information Security
Introduction to Information Security
Dr. Loganathan R
 
Introduction to information security
Introduction to information securityIntroduction to information security
Introduction to information security
KATHEESKUMAR S
 
Securing information system
Securing information systemSecuring information system
Securing information system
Tanjim Rasul
 
InformationSecurity
InformationSecurityInformationSecurity
InformationSecuritylearnt
 
Information security
Information security Information security
Information security
razendar79
 

Recommended

Information Technology Security A Brief Overview 2001
Information Technology Security A Brief Overview 2001Information Technology Security A Brief Overview 2001
Information Technology Security A Brief Overview 2001
Donald E. Hester
 
information security technology
information security technologyinformation security technology
information security technologygarimasagar
 
22 need-for-security
22 need-for-security22 need-for-security
22 need-for-security
Al Balqa Applied University
 
Introduction to Information Security
Introduction to Information SecurityIntroduction to Information Security
Introduction to Information Security
Dr. Loganathan R
 
Introduction to information security
Introduction to information securityIntroduction to information security
Introduction to information security
KATHEESKUMAR S
 
Securing information system
Securing information systemSecuring information system
Securing information system
Tanjim Rasul
 
InformationSecurity
InformationSecurityInformationSecurity
InformationSecuritylearnt
 
Information security
Information security Information security
Information security
razendar79
 
Security & control in management information system
Security & control in management information systemSecurity & control in management information system
Security & control in management information system
Online
 
Introduction to information security
Introduction to information securityIntroduction to information security
Introduction to information security
Dhani Ahmad
 
System Security Threats and Risks)
System Security Threats and Risks)System Security Threats and Risks)
System Security Threats and Risks)
BPalmer13
 
Chapter2 the need to security
Chapter2 the need to securityChapter2 the need to security
Chapter2 the need to security
Dhani Ahmad
 
SECURITY & CONTROL OF INFORMATION SYSTEM (Management Information System)
SECURITY & CONTROL OF INFORMATION SYSTEM (Management Information System)SECURITY & CONTROL OF INFORMATION SYSTEM (Management Information System)
SECURITY & CONTROL OF INFORMATION SYSTEM (Management Information System)Biswajit Bhattacharjee
 
Securing information system (Management Information System)
Securing information system (Management Information System)Securing information system (Management Information System)
Securing information system (Management Information System)
Masudur Rahman
 
8 - Securing Info Systems
8 - Securing Info Systems8 - Securing Info Systems
8 - Securing Info SystemsHemant Nagwekar
 
Information security
Information securityInformation security
Information security
avinashbalakrishnan2
 
Security and ethical issues - Arber Hoxhallari
Security and ethical issues - Arber HoxhallariSecurity and ethical issues - Arber Hoxhallari
Security and ethical issues - Arber HoxhallariArber Hoxhallari
 
IT Security and Risk Mitigation
IT Security and Risk MitigationIT Security and Risk Mitigation
IT Security and Risk Mitigation
Mukalele Rogers
 
Chap5 2007 C I S A Review Course
Chap5 2007 C I S A Review CourseChap5 2007 C I S A Review Course
Chap5 2007 C I S A Review CourseDesmond Devendran
 
Information security management
Information security managementInformation security management
Information security managementUMaine
 
Introduction to security
Introduction to securityIntroduction to security
Introduction to security
Mukesh Chinta
 
Information security
Information securityInformation security
Information security
Lusungu Mkandawire CISA,CISM,CGEIT,CPF,PRINCE2
 
Introduction to information security
Introduction to information securityIntroduction to information security
Introduction to information security
jayashri kolekar
 
Data security
Data securityData security
Data securitySoumen Mondal
 
Security and Control Issues in Information System
Security and Control Issues in Information SystemSecurity and Control Issues in Information System
Security and Control Issues in Information System
Daryl Conson
 
Security and control in Management Information System
Security and control in Management Information SystemSecurity and control in Management Information System
Security and control in Management Information System
Satya P. Joshi
 
1. security management practices
1. security management practices1. security management practices
1. security management practices7wounders
 
Introduction to information security
Introduction to information securityIntroduction to information security
Introduction to information security
Kumawat Dharmpal
 
Securing the C-Suite: Cybersecurity Perspectives from the Boardroom
Securing the C-Suite: Cybersecurity Perspectives from the BoardroomSecuring the C-Suite: Cybersecurity Perspectives from the Boardroom
Securing the C-Suite: Cybersecurity Perspectives from the Boardroom
IBM Security
 
IT Governances
IT GovernancesIT Governances
IT Governances
Jerald Burget
 

More Related Content

What's hot

Security & control in management information system
Security & control in management information systemSecurity & control in management information system
Security & control in management information system
Online
 
Introduction to information security
Introduction to information securityIntroduction to information security
Introduction to information security
Dhani Ahmad
 
System Security Threats and Risks)
System Security Threats and Risks)System Security Threats and Risks)
System Security Threats and Risks)
BPalmer13
 
Chapter2 the need to security
Chapter2 the need to securityChapter2 the need to security
Chapter2 the need to security
Dhani Ahmad
 
SECURITY & CONTROL OF INFORMATION SYSTEM (Management Information System)
SECURITY & CONTROL OF INFORMATION SYSTEM (Management Information System)SECURITY & CONTROL OF INFORMATION SYSTEM (Management Information System)
SECURITY & CONTROL OF INFORMATION SYSTEM (Management Information System)Biswajit Bhattacharjee
 
Securing information system (Management Information System)
Securing information system (Management Information System)Securing information system (Management Information System)
Securing information system (Management Information System)
Masudur Rahman
 
8 - Securing Info Systems
8 - Securing Info Systems8 - Securing Info Systems
8 - Securing Info SystemsHemant Nagwekar
 
Information security
Information securityInformation security
Information security
avinashbalakrishnan2
 
Security and ethical issues - Arber Hoxhallari
Security and ethical issues - Arber HoxhallariSecurity and ethical issues - Arber Hoxhallari
Security and ethical issues - Arber HoxhallariArber Hoxhallari
 
IT Security and Risk Mitigation
IT Security and Risk MitigationIT Security and Risk Mitigation
IT Security and Risk Mitigation
Mukalele Rogers
 
Chap5 2007 C I S A Review Course
Chap5 2007 C I S A Review CourseChap5 2007 C I S A Review Course
Chap5 2007 C I S A Review CourseDesmond Devendran
 
Information security management
Information security managementInformation security management
Information security managementUMaine
 
Introduction to security
Introduction to securityIntroduction to security
Introduction to security
Mukesh Chinta
 
Introduction to information security
Introduction to information securityIntroduction to information security
Introduction to information security
jayashri kolekar
 
Security and Control Issues in Information System
Security and Control Issues in Information SystemSecurity and Control Issues in Information System
Security and Control Issues in Information System
Daryl Conson
 
Security and control in Management Information System
Security and control in Management Information SystemSecurity and control in Management Information System
Security and control in Management Information System
Satya P. Joshi
 
1. security management practices
1. security management practices1. security management practices
1. security management practices7wounders
 
Introduction to information security
Introduction to information securityIntroduction to information security
Introduction to information security
Kumawat Dharmpal
 

What's hot (20)

Security & control in management information system
Security & control in management information systemSecurity & control in management information system
Security & control in management information system
 
Introduction to information security
Introduction to information securityIntroduction to information security
Introduction to information security
 
System Security Threats and Risks)
System Security Threats and Risks)System Security Threats and Risks)
System Security Threats and Risks)
 
Chapter2 the need to security
Chapter2 the need to securityChapter2 the need to security
Chapter2 the need to security
 
SECURITY & CONTROL OF INFORMATION SYSTEM (Management Information System)
SECURITY & CONTROL OF INFORMATION SYSTEM (Management Information System)SECURITY & CONTROL OF INFORMATION SYSTEM (Management Information System)
SECURITY & CONTROL OF INFORMATION SYSTEM (Management Information System)
 
Securing information system (Management Information System)
Securing information system (Management Information System)Securing information system (Management Information System)
Securing information system (Management Information System)
 
8 - Securing Info Systems
8 - Securing Info Systems8 - Securing Info Systems
8 - Securing Info Systems
 
Information security
Information securityInformation security
Information security
 
Security and ethical issues - Arber Hoxhallari
Security and ethical issues - Arber HoxhallariSecurity and ethical issues - Arber Hoxhallari
Security and ethical issues - Arber Hoxhallari
 
IT Security and Risk Mitigation
IT Security and Risk MitigationIT Security and Risk Mitigation
IT Security and Risk Mitigation
 
Chap5 2007 C I S A Review Course
Chap5 2007 C I S A Review CourseChap5 2007 C I S A Review Course
Chap5 2007 C I S A Review Course
 
Information security management
Information security managementInformation security management
Information security management
 
Introduction to security
Introduction to securityIntroduction to security
Introduction to security
 
Information security
Information securityInformation security
Information security
 
Introduction to information security
Introduction to information securityIntroduction to information security
Introduction to information security
 
Data security
Data securityData security
Data security
 
Security and Control Issues in Information System
Security and Control Issues in Information SystemSecurity and Control Issues in Information System
Security and Control Issues in Information System
 
Security and control in Management Information System
Security and control in Management Information SystemSecurity and control in Management Information System
Security and control in Management Information System
 
1. security management practices
1. security management practices1. security management practices
1. security management practices
 
Introduction to information security
Introduction to information securityIntroduction to information security
Introduction to information security
 

Viewers also liked

Securing the C-Suite: Cybersecurity Perspectives from the Boardroom
Securing the C-Suite: Cybersecurity Perspectives from the BoardroomSecuring the C-Suite: Cybersecurity Perspectives from the Boardroom
Securing the C-Suite: Cybersecurity Perspectives from the Boardroom
IBM Security
 
IT Governances
IT GovernancesIT Governances
IT Governances
Jerald Burget
 
Information security governance
Information security governanceInformation security governance
Information security governance
Koen Maris
 
Executive Information Security Training
Executive Information Security TrainingExecutive Information Security Training
Executive Information Security Training
Angela Samuels
 
Cybersecurity in the Boardroom
Cybersecurity in the BoardroomCybersecurity in the Boardroom
Cybersecurity in the Boardroom
Marko Suswanto
 
Information security management system
Information security management systemInformation security management system
Information security management systemArani Srinivasan
 
The Board and Cyber Security
The Board and Cyber SecurityThe Board and Cyber Security
The Board and Cyber Security
FireEye, Inc.
 
INFORMATION SECURITY
INFORMATION SECURITYINFORMATION SECURITY
INFORMATION SECURITY
Ahmed Moussa
 

Viewers also liked (8)

Securing the C-Suite: Cybersecurity Perspectives from the Boardroom
Securing the C-Suite: Cybersecurity Perspectives from the BoardroomSecuring the C-Suite: Cybersecurity Perspectives from the Boardroom
Securing the C-Suite: Cybersecurity Perspectives from the Boardroom
 
IT Governances
IT GovernancesIT Governances
IT Governances
 
Information security governance
Information security governanceInformation security governance
Information security governance
 
Executive Information Security Training
Executive Information Security TrainingExecutive Information Security Training
Executive Information Security Training
 
Cybersecurity in the Boardroom
Cybersecurity in the BoardroomCybersecurity in the Boardroom
Cybersecurity in the Boardroom
 
Information security management system
Information security management systemInformation security management system
Information security management system
 
The Board and Cyber Security
The Board and Cyber SecurityThe Board and Cyber Security
The Board and Cyber Security
 
INFORMATION SECURITY
INFORMATION SECURITYINFORMATION SECURITY
INFORMATION SECURITY
 

Similar to What every executive needs to know about information technology security

Top Cyber Security Interview Questions and Answers 2022.pdf
Top Cyber Security Interview Questions and Answers 2022.pdfTop Cyber Security Interview Questions and Answers 2022.pdf
Top Cyber Security Interview Questions and Answers 2022.pdf
Careerera
 
Mobile Security: 5 Steps to Mobile Risk Management
Mobile Security: 5 Steps to Mobile Risk ManagementMobile Security: 5 Steps to Mobile Risk Management
Mobile Security: 5 Steps to Mobile Risk Management
DMIMarketing
 
5 Steps to Mobile Risk Management
5 Steps to Mobile Risk Management5 Steps to Mobile Risk Management
5 Steps to Mobile Risk Management
DMIMarketing
 
Ijnsa050215
Ijnsa050215Ijnsa050215
Ijnsa050215
IJNSA Journal
 
Discuss how a successful organization should have the followin.docx
Discuss how a successful organization should have the followin.docxDiscuss how a successful organization should have the followin.docx
Discuss how a successful organization should have the followin.docx
cuddietheresa
 
Discuss how a successful organization should have the followin.docx
Discuss how a successful organization should have the followin.docxDiscuss how a successful organization should have the followin.docx
Discuss how a successful organization should have the followin.docx
salmonpybus
 
Cybersecurity Interview Questions and Answers.pdf
Cybersecurity Interview Questions and Answers.pdfCybersecurity Interview Questions and Answers.pdf
Cybersecurity Interview Questions and Answers.pdf
Jazmine Brown
 
Just-How-Secure-is-your-Remote-Workforce-Infinity-Group-Ebook.pdf
Just-How-Secure-is-your-Remote-Workforce-Infinity-Group-Ebook.pdfJust-How-Secure-is-your-Remote-Workforce-Infinity-Group-Ebook.pdf
Just-How-Secure-is-your-Remote-Workforce-Infinity-Group-Ebook.pdf
InfinityGroup5
 
Security Transformation
Security TransformationSecurity Transformation
Security Transformation
Faisal Yahya
 
Module 1Introduction to cyber security.pptx
Module 1Introduction to cyber security.pptxModule 1Introduction to cyber security.pptx
Module 1Introduction to cyber security.pptx
Skippedltd
 
Protective Intelligence
Protective IntelligenceProtective Intelligence
Protective Intelligence
wbesse
 
InformationSecurity_11141
InformationSecurity_11141InformationSecurity_11141
InformationSecurity_11141sraina2
 
2015 Cyber security solutions vs cyber criminals @WOHIT2015 (EU eHealth week)
2015 Cyber security solutions vs cyber criminals @WOHIT2015 (EU eHealth week)2015 Cyber security solutions vs cyber criminals @WOHIT2015 (EU eHealth week)
2015 Cyber security solutions vs cyber criminals @WOHIT2015 (EU eHealth week)
Andris Soroka
 
7 Practices To Safeguard Your Business From Security Breaches!
7 Practices To Safeguard Your Business From Security Breaches!7 Practices To Safeguard Your Business From Security Breaches!
7 Practices To Safeguard Your Business From Security Breaches!
Caroline Johnson
 
The significance of the 7 Colors of Information Security
The significance of the 7 Colors of Information SecurityThe significance of the 7 Colors of Information Security
The significance of the 7 Colors of Information Security
learntransformation0
 
What i learned at issa international summit 2019
What i learned at issa international summit 2019What i learned at issa international summit 2019
What i learned at issa international summit 2019
Ulf Mattsson
 
Segurinfo2014 Santiago Cavanna
Segurinfo2014 Santiago CavannaSegurinfo2014 Santiago Cavanna
Segurinfo2014 Santiago Cavanna
Santiago Cavanna
 
Measures to Avoid Cyber-attacks
Measures to Avoid Cyber-attacksMeasures to Avoid Cyber-attacks
Measures to Avoid Cyber-attacks
Skillmine Technology Consulting
 
Measure To Avoid Cyber Attacks
Measure To Avoid Cyber AttacksMeasure To Avoid Cyber Attacks
Measure To Avoid Cyber Attacks
Skillmine Technology Consulting
 
The future of cyber security
The future of cyber securityThe future of cyber security
The future of cyber security
Sandip Juthani
 

Similar to What every executive needs to know about information technology security (20)

Top Cyber Security Interview Questions and Answers 2022.pdf
Top Cyber Security Interview Questions and Answers 2022.pdfTop Cyber Security Interview Questions and Answers 2022.pdf
Top Cyber Security Interview Questions and Answers 2022.pdf
 
Mobile Security: 5 Steps to Mobile Risk Management
Mobile Security: 5 Steps to Mobile Risk ManagementMobile Security: 5 Steps to Mobile Risk Management
Mobile Security: 5 Steps to Mobile Risk Management
 
5 Steps to Mobile Risk Management
5 Steps to Mobile Risk Management5 Steps to Mobile Risk Management
5 Steps to Mobile Risk Management
 
Ijnsa050215
Ijnsa050215Ijnsa050215
Ijnsa050215
 
Discuss how a successful organization should have the followin.docx
Discuss how a successful organization should have the followin.docxDiscuss how a successful organization should have the followin.docx
Discuss how a successful organization should have the followin.docx
 
Discuss how a successful organization should have the followin.docx
Discuss how a successful organization should have the followin.docxDiscuss how a successful organization should have the followin.docx
Discuss how a successful organization should have the followin.docx
 
Cybersecurity Interview Questions and Answers.pdf
Cybersecurity Interview Questions and Answers.pdfCybersecurity Interview Questions and Answers.pdf
Cybersecurity Interview Questions and Answers.pdf
 
Just-How-Secure-is-your-Remote-Workforce-Infinity-Group-Ebook.pdf
Just-How-Secure-is-your-Remote-Workforce-Infinity-Group-Ebook.pdfJust-How-Secure-is-your-Remote-Workforce-Infinity-Group-Ebook.pdf
Just-How-Secure-is-your-Remote-Workforce-Infinity-Group-Ebook.pdf
 
Security Transformation
Security TransformationSecurity Transformation
Security Transformation
 
Module 1Introduction to cyber security.pptx
Module 1Introduction to cyber security.pptxModule 1Introduction to cyber security.pptx
Module 1Introduction to cyber security.pptx
 
Protective Intelligence
Protective IntelligenceProtective Intelligence
Protective Intelligence
 
InformationSecurity_11141
InformationSecurity_11141InformationSecurity_11141
InformationSecurity_11141
 
2015 Cyber security solutions vs cyber criminals @WOHIT2015 (EU eHealth week)
2015 Cyber security solutions vs cyber criminals @WOHIT2015 (EU eHealth week)2015 Cyber security solutions vs cyber criminals @WOHIT2015 (EU eHealth week)
2015 Cyber security solutions vs cyber criminals @WOHIT2015 (EU eHealth week)
 
7 Practices To Safeguard Your Business From Security Breaches!
7 Practices To Safeguard Your Business From Security Breaches!7 Practices To Safeguard Your Business From Security Breaches!
7 Practices To Safeguard Your Business From Security Breaches!
 
The significance of the 7 Colors of Information Security
The significance of the 7 Colors of Information SecurityThe significance of the 7 Colors of Information Security
The significance of the 7 Colors of Information Security
 
What i learned at issa international summit 2019
What i learned at issa international summit 2019What i learned at issa international summit 2019
What i learned at issa international summit 2019
 
Segurinfo2014 Santiago Cavanna
Segurinfo2014 Santiago CavannaSegurinfo2014 Santiago Cavanna
Segurinfo2014 Santiago Cavanna
 
Measures to Avoid Cyber-attacks
Measures to Avoid Cyber-attacksMeasures to Avoid Cyber-attacks
Measures to Avoid Cyber-attacks
 
Measure To Avoid Cyber Attacks
Measure To Avoid Cyber AttacksMeasure To Avoid Cyber Attacks
Measure To Avoid Cyber Attacks
 
The future of cyber security
The future of cyber securityThe future of cyber security
The future of cyber security
 

More from Legal Services National Technology Assistance Project (LSNTAP)

Language Access Webinar
Language Access WebinarLanguage Access Webinar
Language Access Webinar
Legal Services National Technology Assistance Project (LSNTAP)
 
Free and Low Cost Technology Tools for Legal Aid
Free and Low Cost Technology Tools for Legal AidFree and Low Cost Technology Tools for Legal Aid
Free and Low Cost Technology Tools for Legal Aid
Legal Services National Technology Assistance Project (LSNTAP)
 
50 Tech Tips
50 Tech Tips50 Tech Tips
50 Tech Tips
Legal Services National Technology Assistance Project (LSNTAP)
 
Sharelaw + Video Tips
Sharelaw + Video TipsSharelaw + Video Tips
Sharelaw + Video Tips
Legal Services National Technology Assistance Project (LSNTAP)
 
Intro to UX
Intro to UXIntro to UX
Intro to UX
Legal Services National Technology Assistance Project (LSNTAP)
 
Online Dispute Resolution
Online Dispute ResolutionOnline Dispute Resolution
Online Dispute Resolution
Legal Services National Technology Assistance Project (LSNTAP)
 
Supporting Mobile Pro Bono Attorneys
Supporting Mobile Pro Bono AttorneysSupporting Mobile Pro Bono Attorneys
Supporting Mobile Pro Bono Attorneys
Legal Services National Technology Assistance Project (LSNTAP)
 
Guide to Office 365
Guide to Office 365Guide to Office 365
Guide to Office 365
Legal Services National Technology Assistance Project (LSNTAP)
 
The State of E-Filing 2017
The State of E-Filing 2017The State of E-Filing 2017
The State of E-Filing 2017
Legal Services National Technology Assistance Project (LSNTAP)
 
Intro to Data Analysis Framework
Intro to Data Analysis Framework Intro to Data Analysis Framework
Intro to Data Analysis Framework
Legal Services National Technology Assistance Project (LSNTAP)
 
Language Access for Legal Aid Websites
Language Access for Legal Aid WebsitesLanguage Access for Legal Aid Websites
Language Access for Legal Aid Websites
Legal Services National Technology Assistance Project (LSNTAP)
 
Teaching Your Staff About Phishing
Teaching Your Staff About PhishingTeaching Your Staff About Phishing
Teaching Your Staff About Phishing
Legal Services National Technology Assistance Project (LSNTAP)
 
Data Visualization Tools
Data Visualization ToolsData Visualization Tools
Data Visualization Tools
Legal Services National Technology Assistance Project (LSNTAP)
 
Data Visualization Tools
Data Visualization Tools Data Visualization Tools
Data Visualization Tools
Legal Services National Technology Assistance Project (LSNTAP)
 
Creating a Technology Disaster Plan
Creating a Technology Disaster PlanCreating a Technology Disaster Plan
Creating a Technology Disaster Plan
Legal Services National Technology Assistance Project (LSNTAP)
 
Factors in Software Selection
Factors in Software SelectionFactors in Software Selection
Factors in Software Selection
Legal Services National Technology Assistance Project (LSNTAP)
 
Can i work remotely
Can i work remotelyCan i work remotely
Can i work remotely
Legal Services National Technology Assistance Project (LSNTAP)
 
Intro to data analysis framework april 25 2017
Intro to data analysis framework april 25 2017Intro to data analysis framework april 25 2017
Intro to data analysis framework april 25 2017
Legal Services National Technology Assistance Project (LSNTAP)
 
LSC Tech Baselines
LSC Tech BaselinesLSC Tech Baselines
LSC Tech Baselines
Legal Services National Technology Assistance Project (LSNTAP)
 
Legal Aid Tech Baseline 2016
Legal Aid Tech Baseline 2016 Legal Aid Tech Baseline 2016
Legal Aid Tech Baseline 2016
Legal Services National Technology Assistance Project (LSNTAP)
 

More from Legal Services National Technology Assistance Project (LSNTAP) (20)

Language Access Webinar
Language Access WebinarLanguage Access Webinar
Language Access Webinar
 
Free and Low Cost Technology Tools for Legal Aid
Free and Low Cost Technology Tools for Legal AidFree and Low Cost Technology Tools for Legal Aid
Free and Low Cost Technology Tools for Legal Aid
 
50 Tech Tips
50 Tech Tips50 Tech Tips
50 Tech Tips
 
Sharelaw + Video Tips
Sharelaw + Video TipsSharelaw + Video Tips
Sharelaw + Video Tips
 
Intro to UX
Intro to UXIntro to UX
Intro to UX
 
Online Dispute Resolution
Online Dispute ResolutionOnline Dispute Resolution
Online Dispute Resolution
 
Supporting Mobile Pro Bono Attorneys
Supporting Mobile Pro Bono AttorneysSupporting Mobile Pro Bono Attorneys
Supporting Mobile Pro Bono Attorneys
 
Guide to Office 365
Guide to Office 365Guide to Office 365
Guide to Office 365
 
The State of E-Filing 2017
The State of E-Filing 2017The State of E-Filing 2017
The State of E-Filing 2017
 
Intro to Data Analysis Framework
Intro to Data Analysis Framework Intro to Data Analysis Framework
Intro to Data Analysis Framework
 
Language Access for Legal Aid Websites
Language Access for Legal Aid WebsitesLanguage Access for Legal Aid Websites
Language Access for Legal Aid Websites
 
Teaching Your Staff About Phishing
Teaching Your Staff About PhishingTeaching Your Staff About Phishing
Teaching Your Staff About Phishing
 
Data Visualization Tools
Data Visualization ToolsData Visualization Tools
Data Visualization Tools
 
Data Visualization Tools
Data Visualization Tools Data Visualization Tools
Data Visualization Tools
 
Creating a Technology Disaster Plan
Creating a Technology Disaster PlanCreating a Technology Disaster Plan
Creating a Technology Disaster Plan
 
Factors in Software Selection
Factors in Software SelectionFactors in Software Selection
Factors in Software Selection
 
Can i work remotely
Can i work remotelyCan i work remotely
Can i work remotely
 
Intro to data analysis framework april 25 2017
Intro to data analysis framework april 25 2017Intro to data analysis framework april 25 2017
Intro to data analysis framework april 25 2017
 
LSC Tech Baselines
LSC Tech BaselinesLSC Tech Baselines
LSC Tech Baselines
 
Legal Aid Tech Baseline 2016
Legal Aid Tech Baseline 2016 Legal Aid Tech Baseline 2016
Legal Aid Tech Baseline 2016
 

Recently uploaded

FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdfFIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance
 
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
DanBrown980551
 
Mission to Decommission: Importance of Decommissioning Products to Increase E...
Mission to Decommission: Importance of Decommissioning Products to Increase E...Mission to Decommission: Importance of Decommissioning Products to Increase E...
Mission to Decommission: Importance of Decommissioning Products to Increase E...
Product School
 
DevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA ConnectDevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA Connect
Kari Kakkonen
 
How world-class product teams are winning in the AI era by CEO and Founder, P...
How world-class product teams are winning in the AI era by CEO and Founder, P...How world-class product teams are winning in the AI era by CEO and Founder, P...
How world-class product teams are winning in the AI era by CEO and Founder, P...
Product School
 
When stars align: studies in data quality, knowledge graphs, and machine lear...
When stars align: studies in data quality, knowledge graphs, and machine lear...When stars align: studies in data quality, knowledge graphs, and machine lear...
When stars align: studies in data quality, knowledge graphs, and machine lear...
Elena Simperl
 
Key Trends Shaping the Future of Infrastructure.pdf
Key Trends Shaping the Future of Infrastructure.pdfKey Trends Shaping the Future of Infrastructure.pdf
Key Trends Shaping the Future of Infrastructure.pdf
Cheryl Hung
 
The Art of the Pitch: WordPress Relationships and Sales
The Art of the Pitch: WordPress Relationships and SalesThe Art of the Pitch: WordPress Relationships and Sales
The Art of the Pitch: WordPress Relationships and Sales
Laura Byrne
 
IOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptx
IOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptxIOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptx
IOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptx
Abida Shariff
 
Knowledge engineering: from people to machines and back
Knowledge engineering: from people to machines and backKnowledge engineering: from people to machines and back
Knowledge engineering: from people to machines and back
Elena Simperl
 
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
Product School
 
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...
UiPathCommunity
 
Essentials of Automations: Optimizing FME Workflows with Parameters
Essentials of Automations: Optimizing FME Workflows with ParametersEssentials of Automations: Optimizing FME Workflows with Parameters
Essentials of Automations: Optimizing FME Workflows with Parameters
Safe Software
 
PHP Frameworks: I want to break free (IPC Berlin 2024)
PHP Frameworks: I want to break free (IPC Berlin 2024)PHP Frameworks: I want to break free (IPC Berlin 2024)
PHP Frameworks: I want to break free (IPC Berlin 2024)
Ralf Eggert
 
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdfFIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance
 
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
James Anderson
 
GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...
GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...
GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...
Sri Ambati
 
Epistemic Interaction - tuning interfaces to provide information for AI support
Epistemic Interaction - tuning interfaces to provide information for AI supportEpistemic Interaction - tuning interfaces to provide information for AI support
Epistemic Interaction - tuning interfaces to provide information for AI support
Alan Dix
 
Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...
Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...
Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...
Thierry Lestable
 
"Impact of front-end architecture on development cost", Viktor Turskyi
"Impact of front-end architecture on development cost", Viktor Turskyi"Impact of front-end architecture on development cost", Viktor Turskyi
"Impact of front-end architecture on development cost", Viktor Turskyi
Fwdays
 

Recently uploaded (20)

FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdfFIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
 
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
 
Mission to Decommission: Importance of Decommissioning Products to Increase E...
Mission to Decommission: Importance of Decommissioning Products to Increase E...Mission to Decommission: Importance of Decommissioning Products to Increase E...
Mission to Decommission: Importance of Decommissioning Products to Increase E...
 
DevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA ConnectDevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA Connect
 
How world-class product teams are winning in the AI era by CEO and Founder, P...
How world-class product teams are winning in the AI era by CEO and Founder, P...How world-class product teams are winning in the AI era by CEO and Founder, P...
How world-class product teams are winning in the AI era by CEO and Founder, P...
 
When stars align: studies in data quality, knowledge graphs, and machine lear...
When stars align: studies in data quality, knowledge graphs, and machine lear...When stars align: studies in data quality, knowledge graphs, and machine lear...
When stars align: studies in data quality, knowledge graphs, and machine lear...
 
Key Trends Shaping the Future of Infrastructure.pdf
Key Trends Shaping the Future of Infrastructure.pdfKey Trends Shaping the Future of Infrastructure.pdf
Key Trends Shaping the Future of Infrastructure.pdf
 
The Art of the Pitch: WordPress Relationships and Sales
The Art of the Pitch: WordPress Relationships and SalesThe Art of the Pitch: WordPress Relationships and Sales
The Art of the Pitch: WordPress Relationships and Sales
 
IOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptx
IOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptxIOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptx
IOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptx
 
Knowledge engineering: from people to machines and back
Knowledge engineering: from people to machines and backKnowledge engineering: from people to machines and back
Knowledge engineering: from people to machines and back
 
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
 
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...
 
Essentials of Automations: Optimizing FME Workflows with Parameters
Essentials of Automations: Optimizing FME Workflows with ParametersEssentials of Automations: Optimizing FME Workflows with Parameters
Essentials of Automations: Optimizing FME Workflows with Parameters
 
PHP Frameworks: I want to break free (IPC Berlin 2024)
PHP Frameworks: I want to break free (IPC Berlin 2024)PHP Frameworks: I want to break free (IPC Berlin 2024)
PHP Frameworks: I want to break free (IPC Berlin 2024)
 
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdfFIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
 
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
 
GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...
GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...
GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...
 
Epistemic Interaction - tuning interfaces to provide information for AI support
Epistemic Interaction - tuning interfaces to provide information for AI supportEpistemic Interaction - tuning interfaces to provide information for AI support
Epistemic Interaction - tuning interfaces to provide information for AI support
 
Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...
Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...
Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...
 
"Impact of front-end architecture on development cost", Viktor Turskyi
"Impact of front-end architecture on development cost", Viktor Turskyi"Impact of front-end architecture on development cost", Viktor Turskyi
"Impact of front-end architecture on development cost", Viktor Turskyi
 

What every executive needs to know about information technology security

  • 1. What Every Executive Needs To Know About Information Technology Security Peter Campbell Chief Information Officer Legal Services Corporation
  • 2. Topics Introduction/Data Security Cloud Computing Cyber Insurance Passwords Mobile Network Security Questions?
  • 3. The Internet is rapidly changing, as are the ways that you should protect yourself. This is relatively current information that factors in the use of mobile technology and cloud computing.
  • 4. Image by National Institute for Occupational Safety and Health (NIOSH), via Wikimedia Commons Why we need to be protected: Business continuity Safety of clients, staff, data, and property Compliance (PCI, HIPAA, etc.)
  • 5. Attackers either: Want something you have, or Want to extort money from you by taking what you have, or Want to attack others by using what you have.
  • 6. Two kinds of risk: Sensitive Information Breached Systems Attacked Image by Setreset (Own work), via Wikimedia Commons
  • 7. Data Sensitivity must be assessed: High - Medium - Low Risk to organization vs risk to clients, etc. Labor/time to reproduce Security policies should be based on these assessments Image by Friedrich Graf, via Wikimedia Commons
  • 9. Core Cloud Considerations: Established cloud services might offer higher data security than you can How many certified IT Security Specialists do you have on staff, compared to Google or Microsoft? But also have low accountability for confidentiality Vendor might give data in response to subpoenas that you wouldn’t
  • 10. Cost concerns: Moves software from capital to expense Subscriptions cost more than maintenance renewals, but are possibly offset by infrastructure and support savings Huge benefits for remote access
  • 11. Contracting Tips: Make sure that you backup your data locally and are able to access it if a cloud vendor goes out of business Clearly delineate duties Never agree to termination fees [Image: “The Land of Contracts” by David Anthony Colarusso]
  • 13. As of 2013, 35 insurers covered this1. Now many more do. Third party and first party offerings Costs vary widely, as do items covered (shop around!) About Cyber-Insurance 1. https://www.mcguirewoods.com/Client- Resources/Alerts/2013/12/A-Nonprofit-Buyers-Guide-to- Cyber-Insurance.aspx
  • 14. Third Party Coverage Litigation Costs Regulatory Expenses Notification Costs Crisis Management PR
  • 15. First Party Coverage Theft and Fraud Forensic Investigation Business Interruption Data Loss and Restoration Photo by Jon Crel
  • 16.
  • 17. Passwords aren’t secure. Any password can be deciphered Any network can be hacked The old rules about password safety are invalid Image by nikcname
  • 18. But passwords are still critical. Strong passwords: Long phrases are better than words Upper case letters, lower case letters, numerals, punctuation, spaces. Not too difficult to remember - or Stored in a Password Manager Subject to two-factor authentication Unique across systems
  • 19. New Thinking on Passwords Changing the password regularly is not as important as changing it after a breach. Fingerprint readers and other physical alternatives are only secure if they aren’t compromised - a fingerprint can’t easily be changed. Password Managers are necessary.
  • 20. Dual Factor Authentication AKA “Two Factor Authentication” “2FA” Insures that a hacker with your password can’t access your account Multiple methods: text, phone, email, fob, or app Home and work PCs can be trusted Image by Brian Ronald
  • 21. Password Managers Only one password to memorize Fills in passwords across computers and devices Generates secure passwords The best include breach alerts and security checks
  • 22. Mobile Image by HLundgaard (Own work) [CC BY-SA 3.0 (http://creativecommons.org/licenses/by-sa/3.0)], via Wikimedia Commons
  • 23. Core Mobile Considerations Business data on mobile devices is not subject to network security measures Mobile devices are easily lost or stolen Public WiFi networks are often insecure Malicious apps surreptitiously copy private information from mobile devices Image by Alan Levine
  • 24. Security Measures Screen Locks Passcodes are safer than patterns Fingerprint, facial recognition only good if phone isn’t hacked. Encryption (SSL Anywhere) Two Factor Authentication Hotspots (as opposed to public WiFi)
  • 25. Mobile Device Management Software Mobile Device Management Systems (MDMs) offer a degree of security for mobile devices. With them, you can Remotely wipe data Track devices Remotely install/remove applications Block application installs Enforce security options
  • 26. Policies and Education Key to safely letting staff work with company data (email, documents, etc.) on mobile devices is solid policies and user education. The best security in the world won’t protect you if staff don’t know how to protect passwords and detect scams. Policies should be sensible and not so prohibitive that staff are compelled to work around them.
  • 28. Office Security If you have IT staff, you likely have these things in place Firewalls, anti-virus, anti-spam and other standard security tools can only protect what passes through them Mobile devices, USB drives and other portable media can bypass security Servers open to the public (web servers, remote access, client-facing applications) are at greatest risk. Photo by Ilya Sedhyk
  • 29. Monitoring and Perimeter Testing It’s important to have software that monitors the systems and alerts IT staff in case of hardware issues or attacks. Investigations might be critical in case of a breach. Perimeter Testing should be done regularly to identify security issues. Pricing varies widely on this service Find best mix of pricing/frequency Can be a requirement/cost offset for cyber-insurance
  • 30. Ransomware PC and/or server drives are encrypted and data inaccessible until a ransom is paid to hacker Triggered by links in emails or infected media (such as flash drives) Protection: Backup to cloud or alternate media Spam and virus filtering User education! Avoidance:
  • 31.
  • 32. Contact Peter Campbell, CIO, LSC pcampbell@lsc.gov 202-295-1685 @peterscampbell Session Eval: http://tinyurl.com/TIGeval