Cyber (In)Security Where To Get Help - GENEDGE · 7/26/2017  · Cyber (In)Security “Where To Get Help ... Part of the Department of Commerce / NIST network of Centers across the

Cyber (In)Security

ldquoWhere To Get Helprdquo

Presented by

Roy LuebkeInnovation and Growth Consultant

July 26 2017

2

We are the Manufacturing Extension Program of Virginia

An Economic Development unit of the Commonwealth of Virginia

Part of the Department of Commerce NIST network of Centers across the country (60 centers 1500 staff nationally)

20 years of success supporting Virginia businesses

Since 2000 the 1 Bottom-Line and Top-Line Impact Producer in the system ndash over $35 Billion of business impact reported

Over 10500 industrial jobs created retained

32 staff including two sub-recipient partners The Manufacturing Technology Center in SW VA and Old Dominion University in Hampton Roads

72617

What is GENEDGE

3

What Does GENEDGE Do

Strategic Innovation and Growth

Continuous Process Improvement

Sustainability

Supply Chain Optimization

Technology Acceleration

Export Assistance

Market Commercialization

72617

Growth

4

First Thing To Knowhellip

YOU HAVE ALREADY BEEN COMPROMISED

72617

5

What Is The Solution

72617

6

First Things First

Identify your assets to be protected

ndash Intellectual property

ndash Electronic assets

ndash Business relationshipssupply chain

ndash Download self-assessment

httpwwwgenedgeorgcybersecurity-assessment-request

Conduct an external vulnerability assessment

ndash NOT a penetration test (PEN test)

72617

7

Sources of Help Cyber Insurance

International Risk Management Institutendash httpswwwirmicomonlineinsurance-glossarytermsccyber-

and-privacy-insuranceaspx

ndash httpswwwirmicomexpert-commentarytaxonomy=topicsamppropertyName=categoryamptaxon=2frisk-management-and-multiline-topics2fcyber-and-privacy-risk-and-insurance

72617

8

Dark Reading

From Information Week

ndash httpwwwdarkreadingcom

72617

9

Sources of Help - DHS

US Department of Homeland Security

For critical infrastructure every day to provide energy water transportation financial systems

httpswwwus-certgovccubedvp

httpswwwdhsgovtopiccybersecurity

DHS Computer Cyber Division

ndash httpswwwdhsgovscience-and-technologycyber-security-division

72617

10

DFARS

FAR 52204-21 (15 Basic Security Controls)

httpswwwacquisitiongovfarhtml52_200_206html

DFARS 225204-7012 (110 Security Controls)

Includes the NIST SP 800-171 specs

ndash httpwwwacqosdmilsedocsDFARS-guidepdf

ndash httpwwwacqosdmildpapdarsdfarshtmlcurrent252204htm

72617

11

DFARSNIST Specs

NIST SP 800-53

ndash Security and Privacy Controls for Federal Information Systems and Organizations

ndash httpnvlpubsnistgovnistpubsSpecialPublicationsNISTSP800-53r4pdf

NIST SP 800-171

ndash Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations

ndash httpnvlpubsnistgovnistpubsSpecialPublicationsNISTSP800-171pdf

72617

12

DISA ndash Defense Information Systems Agency

Joint information environment

httpwwwdisamilCybersecurity

httpwwwdisamilaboutour-workjie

ndash Cyber securityinformation assurance program

httpdibnetdodmil

External Certificate Authority Program (for third parties to securely communicate with the DoD and authenticate to DoD Information Systems)

httpiasedisamilpkiecaPagesindexaspx

72617

13

FBI

To file complaints about cyber crime

httpswwwic3govcrimeschemesaspx

For tips

httpswwwic3govcrimeschemesaspx

httpswwwfbigovinvestigatecyber

72617

14

Industrial Controls

Industrial Controls Cyber Security

The National Cybersecurity and Integration Center (NCCIC) a division of the Department of Homeland Securitys Office of Cybersecurity and Communications (DHS CSampC)

httpsics-certus-certgovAbout-Industrial-Control-Systems-Cyber-Emergency-Response-Team

httpsics-certus-certgovsitesdefaultfilesdocumentsStrategy20for20Securing20Control20Systemspdf

httpsscadahackercomlibrary

72617

15

Industrial Controls

72617

16

MACH37 ndash Virginia Agency via CIT

MACH37trade is Americarsquos premier market-centric cybersecurity accelerator

The Accelerator is designed to facilitate the creation of the next generation of cybersecurity product companies MACH37s unique program design places heavy emphasis on the validation of product ideas and the development of relationships that produce an initial customer base and investment capital

MACH37 is located at the Center for Innovative Technology The Accelerator is operated by the MACH37 partners

httpswwwmach37com

72617

17

Sources of Help - NIST

US Department of Commerce ndash National Institute of Technology

ndash httpswwwnistgovtopicscybersecurity

NIST Cyber Framework httpswwwnistgovcyberframework

NIST National Cybersecurity Center of Excellence

ndash httpsnccoenistgov

72617

18

NISTDHS Vulnerability Database

httpwebnvdnistgovviewvulnsearch

72617

NVD Primary ResourcesVulnerability Search EngineNational Checklist Program

SCAP Validated ToolsVisualizations

CVSS V3 CalculatorData Feeds

Product DictionaryVulnerability Metrics

Vulnerability CategoriesCVSS V2 Calculator

19

SANS Institute

The SANS Institute was established in 1989 as a cooperative research and education organization Its programs now reach more than 165000 security professionals around the world A range of individuals from auditors and network administrators to chief information security officers are sharing the lessons they learn and are jointly finding solutions to the challenges they face

httpswwwsansorg

Training and certifications

Guidance

Resources httpswwwsansorgsecurity-resources

72617

20

Virginia State Government

httpcybervavirginiagov

httpsvirginiacyberrangeorg

httpcybervavirginiagovresourcesiama=Professional

httpcybervavirginiagovresources

72617

21

Universities

Virginia

For a listing of all education and support programs available

httpcybervavirginiagovcolleges

University of Maryland

httpscyberchainrhsmithumdedu

Norfolk State UniversityOld Dominion University

httpswwwnsueducsetcsetgraduatecybersecurityindex

72617

22

Key Commercial Sites

Kaspersky labs httpsusakasperskycom

FireEye httpswwwfireeyecom

Symantec httpswwwsymanteccomsecurity_response

McAfee httpscommunitymcafeecomcommunityhome

IBM httpswwwibmcomsecurity

Verizon httpwwwverizonenterprisecomverizon-insights-labdbir2017

72617

23

The ldquoBiggerrdquo Options

On-Premise Managed Services

ndash Old PCs Old printers Old software

Cloud based

ndash Entire systems

ndash Platforms as a Service (PAAS)

ndash Software as a Service (SAAS)

ndash Data sharing servicescontent

ndash Specific applications

72617

2472617

2572617

2672617

2772617

2872617

2972617

30

Downloadable Self-Assessment

httpwwwgenedgeorgcybersecurity-assessment-request

72617

31

Cyber Firms in Virginia

Red Lion httpredlionio

Prometheus Global httpprogllccom

Klett Consulting Group httpkcg-incnet

Peregrine Technical Solutions httpwwwgbptscom

Hemisphere Cyber Risk Management httpswwwhemispherecybercom

Talatek httpstalatekcom

Tiber Creek Consulting httpstibercreekcom

McClean Insurance (cyber policies) httpwwwmcleaninsurancecom

72617

32

List of Virginia Cyber Firms

The Cybersecurity 500 List

httpcybersecurityventurescomcybersecurity-500-listhomeview_1_per_page=500ampview_1_page=1ampview_1_sort=field_1|ascampview_1_search=virginia

72617

3372617

bull GENEDGE services can help identify your weak spots decrease the costs of increasing your security

bull We work with technical firms to conduct a vulnerability assessment

bull Provide you with a gap analysis

bull Work with you to prioritize the gaps and target spending to protect ldquoCrown Jewelsrdquo

bull Help develop an implementation plan to close the gaps

bull Provide guidance on completing an Information Security Plan

34

Contact GENEDGE

To Help Improve Your Security Posture

And Reduce Cyber Risks

Roy Luebke

Email rluebkegenedgeorg

Cell 276-732-8372

72617

Thank You For Attending