Protecting the Information Infrastructure
Post on 13-May-2015
350 Views
Preview:
DESCRIPTION
Transcript
Wednesday, October 12, 11
Protecting the Information Infrastructure:
Why CIOs and CSOs are Becoming Mission-Critical
Business Partners
SNW Fall 2011
Jay McLaughlin, CISSPChief Security Officer, Q2ebanking
Wednesday, October 12, 11
DISCLAIMERThe materials, thoughts, comments, ideas and opinions expressed throughout this presentation are entirely my own and do not necessarily represent the thoughts or opinions of my employer (past or present).
Wednesday, October 12, 11
AGENDA• Information..the lifeblood of an organization
• Events involving loss of data are rising - who is to blame?
• Mitigating our vulnerabilities
• A shift to Information-Centric Security
• Developing critical partnerships across the organization
Wednesday, October 12, 11
Information is the lifeblood of organizations, and considered a critical factor in a company’s effective pursuit of its business goals and success.
Wednesday, October 12, 11
Information is not only valuable to an organization…but also to...
Wednesday, October 12, 11
WHAT ARE WE TRYING TO PROTECT?
Regulated information is the type of data most often thought of when the subject of information protection is raised.
• Includes personally identifiable information (PII) of individuals, such as social security numbers, bank and credit card numbers and medical records. A great deal of public outrage, lawsuits, fines and loss of brand trust can accompany the compromising of this information.
Confidential information may involve marketing plans, financial projections, sales reports and M&A discussions.
• Breaches on this information can range from public embarrassment to catastrophe
Intellectual property (IP) is arguably the most critical type of information.
• According to the FBI, $600 billion worth of intellectual property is stolen every year in the U.S
• Companies tend to focus on regulated data while doing comparatively little to secure the IP that is critical to their business.
Wednesday, October 12, 11
Setting the Stage - Recent Attacks–Defense Contractors
»Lockheed Martin»Northrop Grumman»L-3
–Commercial Organizations»SONY»GOOGLE
–Security Firms»RSA»Barracuda Networks »HB Gary Federal»Comodo / Digitar
–Government»United States DoD»Texas Comptroller’s Office
Wednesday, October 12, 11
It gets worse...
Source: Scientific American, “Data Theft: Hackers Attack”, Oct 2011
Wednesday, October 12, 11
Change in Tactics• Highlighted that in 2010,
the largest number of data breach incidents occurred, yet the volume of records dropped significantly
• Criminals are engaging in small, opportunistic attacks rather than large-scale, difficult attacks using relatively low sophistication attacks to penetrate organizations.
Wednesday, October 12, 11
Will your organization be on this list?
• University of Texas: 688 students' and prospective students' personal information accessed by employees after configuration error made data available on intranet
• Blackpool Coastal Housing: 80 tenants' names, addresses, national insurance numbers, telephone numbers and confidential care plans transferred to employee's home computer where they were accessible to others
• Guilford County Tax Dept: 1,000 taxpayers' SSNs, names and addresses, and images of checks paid were accessible on internet
• Bright House Networks: Customer names, addresses, phone numbers and account numbers exposed in unauthorized access
• California State Assembly: 50 employees' personal information may have been acquired by hacker
• Montgomery County Dept of Job and Family Svcs: Names and Social Security numbers of 1,200 individuals seeking agency assistance were on lost thumb drive
Wednesday, October 12, 11
Organizations are
sloppy
Wednesday, October 12, 11
Overly Confident?Ninth Annual Global Information Security Survey
9,600-plus business and technology execs surveyed, 43 percent identify themselves as security frontrunners and believe they have a sound security strategy and are executing it effectively.
http://www.pwc.com/gx/en/information-security-survey/giss.jhtmx
Wednesday, October 12, 11
Source: Information Security Magazine, October 2010
Wednesday, October 12, 11
CIOs: Call to Action
• Delivery of effective technology solutions to external customers and internal constituents
• Maximizing the value of technology investments to improve business performance
• Increasing agility of the organization, enabling it to adapt to changing needs
• Reducing related operational costs across business units
Wednesday, October 12, 11
Roles of the CSO
• ENABLE
• AUDIT
• ENFORCE
• EDUCATE
Wednesday, October 12, 11
Influencing Behavior
• Education is critical
• Security awareness is a start...but not good enough
• “Behavioral change” is required
Wednesday, October 12, 11
Wednesday, October 12, 11
Overly Confident?To a fault...
• “...we haven’t been attacked before”
• “...why would someone target our company?”
• “...we undergo routine internal/external audits”
Why do we remiss security?
• CIOs and C-Level executives often don’t hear about security until an incident occurs
• CIOs are value-focused managers
• is security NOT viewed AS value-adding?
Wednesday, October 12, 11
Source: Scientific American, “Data Theft: Hackers Attack”, Oct 2011
Wednesday, October 12, 11
...in fact, we are spending more on security solutions to protect
our information systems
Wednesday, October 12, 11
Security
Physical
Management
Operational
...but we’re not making investments in our processes
Wednesday, October 12, 11
COMPLIANCE
Wednesday, October 12, 11
Compliance Security
• Compliance Defined
: conformity in fulfilling official requirements.
• This isn’t about checking the box
It is the standard that is the problem, not the compliance with the standard.
Wednesday, October 12, 11
CSOs tend to fixate on building an “EXCELLENT”
information security program
Wednesday, October 12, 11
Where does the CSO fit in?
Wednesday, October 12, 11
The Business Problem Topology
• Security is new to the executive table
• Security discussions in today’s enterprise tend to be focused on the qualitative aspects instead of the quantitative
• CSOs speak a language that is NOT understood by others executives
• CSOs struggle with creating awareness and changing behaviors
Wednesday, October 12, 11
But, Security is often viewed as a BOTTLENECK
Wednesday, October 12, 11
The “R” Word
• Developing those critical RELATIONSHIPS within the organization
• WALK A MILE
• Breaking down the walls...we’re all fighting the same battle
Wednesday, October 12, 11
Wednesday, October 12, 11
Current Environment
• Regulations and compliance requirements are demanding more time and attention• Regulators and auditors including PCI-DSS, GLBA, SOX/
404, HIPAA, etc. are demanding more executive time and attention
• Greater interest from CIOs and other business stakeholders regarding information security
• Routine communication around information security, compliance, investment and risk is critical...but challenging.
Wednesday, October 12, 11
Management Differences
RISK MITIGATION translates to
VALUE
Risk-focused
managers
Value-focused
managers
CSOCIO
LEADERSHIP PHILOSOPHIES
Wednesday, October 12, 11
Effective Risk Managers?
• Generally, human beings struggle at managing risk
• We often overestimate risks that are highly visible or catastrophic and underestimate the risks that are slower to develop or not easily seen
• CIOs tend to overestimate risks that they have less control over, and underestimate the risks that they have more control over
ex: flying an airplane vs driving a car
Wednesday, October 12, 11
Assessing Risk
• Engagement of business
• Top-Down Approach, ranking information assets
• Business Impact Analysis
• Quantitative vs. Qualitative
Wednesday, October 12, 11
Understanding Risk Risk Management involves identifying threats and applying mitigating controls to effectively reduce the risk of those threats:
• Multiple by VALUE for quantitative
• Controls can mitigate risk…
...but can rarely fully eliminate risk
• RISK=(THREAT x VULNERABILITY)
COUNTERMEASURES
Wednesday, October 12, 11
Calculating Loss Expectancy• The annualized loss expectancy (ALE) is the
product of the annual rate of occurrence (ARO) and the single loss expectancy (SLE)
Mathematically expressed: ALE = ARO * SLE
-> calculating SLE SLE = AV * EF
• Suppose than an asset is valued at $100,000, and the exposure factor (EF) for this asset is 25%. The SLE then, is (25% * $100,000), or $25,000.
• For an annual rate of occurrence of 1, the annualized loss expectancy is (1 * $25,000)
Wednesday, October 12, 11
Applying Countermeasures
Our Approach is CRITICAL
THREATS
COUNTERMEASURES
WRONG
• Focus efforts on the mitigating the ACTUAL vulnerabilities that are specific to the organization
• Avoid industry marketing FUD
Wednesday, October 12, 11
Defense By Layer
• Acknowledges that reliance on any single control or mitigating factor is not sufficient
• This approach is commonly recommended
Scenario: Protecting Hosted Customer Data from an external attacker
• Database tables are encrypted
• Role-based access levels are applied
• Data Storage Encryption
Wednesday, October 12, 11
Paradigm ShiftInformation-Centric Security
• Emphasizes security of the INFORMATION itself...rather than the security of networks, systems, and applications.
• 4 Principles:
1. Information (data) must be self describing and defending.
2.Policies and controls must account for business context.
3. Information must be protected as it moves from structured to unstructured, in and out of applications, and changing business context.
4.Policies must work consistently through the different defensive layers and technologies we implement.
Source: Rich Mogull, CEO/Principal Analyst, Securosis
Wednesday, October 12, 11
Developing A Strategy• Creating an information protection strategy
– understanding the business and its specific needs for information protection.
– defining a set of objectives to deliver quick wins and address long-term goals.
• Locating and classifying the information that means the most– An impact analysis should be performed to identify the information
with the greatest impact to strategic, tactical and operational objectives.
• Weaving information protection into the fabric of the organization
• Developing the necessary capabilities to protect their information assets– Organizations need to determine the technologies and processes
that best support their information protection objectives
Source: Dr. Alastair MacWillson, Security Week Aug 2011
Wednesday, October 12, 11
Summary
• Educate by establishing a foundation for communication (e.g. metrics, scorecards)
• Embrace an information-centric approach
• Play offense (ACT vs. REACT)
• Leverage leading edge technology that enables agility within the organization
• Security is NOT perfect, and it requires ACCOUNTABILITY
• START with the BASICS
Wednesday, October 12, 11
The future ain’t what it used to be.
- Yogi Berra, New York Yankees
Be Prepared
Wednesday, October 12, 11
QUESTIONS?
Wednesday, October 12, 11
@jaymclaughlin
linkedin.com/in/mclaughlinjay
THANK YOU
Wednesday, October 12, 11
top related