THOR: Building a strong Cyber defence · THOR – Building a strong Cyber Defence. Gary Hibberd -...

Gary Hibberd - ghibberd@theagenci.com -(T) 0845 4133 666 : (M) 0744 7911 742

GARY HIBBERDManaging Director

THOR: Building a strong Cyber defence

Over to you…

• What does ‘Good’ cyber Security look like?

• Setting standards

• Identifying your own threats, vulnerabilities & risks

• THOR – Building a strong Cyber defence

THOR – Building a strong Cyber Defence

What does ‘Good’ look like?

Good Security is a journey.Not a destination.

Defend Deter Develop

Our Vision:We are secure and resilient to cyber threats, prosperous and confident in our digital world.

National Cyber Security Strategy 2016 to 2021

• People

• Premises

• Processes

• PC’s

• Providers

‘Good’

Strategy

Enabler

Remember: No such thing as 100% Secure

Awareness

Business buy-in; IT and Operations

Continual Improvement

• Clear Leadership

• There’s a Strategy

• Security Budget

• It’s an Enabler

• Risk Assessment

Do YOU have this?

• Risk Management

• ‘Some’ Awareness

• Business Buy-in

• Continually Improving

Score: 1 to 101 = Nothing in place10 = No further action required

• Clear Leadership

• There’s a Strategy

• Security Budget

• It’s an Enabler

• Risk Assessment

Do YOU have this?

• Risk Management

• Awareness in place

• Business Buy-in

• Continually Improving

Setting StandardsSetting Standards

The Information Security Journey

CSA STARCertificationFor Cloud

Cyber Essentials

ISO/IEC 27001

Information Security Kitemarks

Above and beyond

Cyber Essentials PlusISO/IEC27018

PCI DSS

Not a sequential journey, but modular options basedon organisational needsLevels of complexity or specialism and requiredinputs by client increase from left to rightVulnerability scanning andpenetration testingBSI KitemarkTM Certification

System audits and certification

Increasing Requirements for Cyber /Information Security:

• From the 1st October 2014 all suppliersmust now be compliant with the newCyber Essentials controls if bidding forgovernment contracts which involve thehandling of sensitive or personal information.

• Secure Configuration• Boundary Firewalls and Internet Gateways• Access Control and Administrative Privilege

Management• Patch Management• Malware Protection

• A specification for an informationsecurity management system (ISMS).An ISMS is a framework of policies andprocedures that includes all legal,physical and technical controlsinvolved in an organisation'sinformation risk managementprocesses.

112 212 322 329 435 552 712 814 14451064 1432

21723563

4800 52896379

7952 8663

42105550

87889665

1011610414

10,000

15,000

20,000

25,000

30,000

2006 2007 2008 2009 2010 2011 2012 2013 2014 2015

ISO/IEC 27001 - Worldwide total

Middle East

Central and South Asia

East Asia and Pacific

Europe

North America

Central / South America

Africa

Information Security Management SystemISO27001:Annex A

Security Policies Organisation of InformationSecurity Asset Management

Access Control Communications Security Physical & Environment

Operations Security Cryptography Supplier Relationships

System Acquisition, development & maintenance Business Continuity Management

Security IncidentManagementHuman Resources Compliance

ISO27001:2013It is not just about IT!

• IT

• People

• Information

• Intellectual Property

• Infrastructure and Buildings

Security Protection could include for:

Identifying your own threats, vulnerabilities & risksIdentifying your own threats, vulnerabilities & risks

We need to understand…

• What are we trying to protect?

• Where is the data?

• Who is the owner?

• Who has access to it?

• What are they doing with the data?

ACTION:Spend a few minutes reviewing these questions.

Your Business

What are we trying to protect?

Where is the data?

Who is the owner?

Who has access to it?

What are they doing with it?

THOR – Building your own plansTHOR – Building your own plans

Technical

Operational

Regulatory

ACTION:Spend a few minutes considering the followingareas

Your Business

Technical

Operational

Regulatory

Information security is not a technical issue

Finally…

People are our greatest threat

our greatest ally

• What does ‘Good’ cyber Security look like?

• Setting standards

• Identifying your own threats, vulnerabilities & risks

• THOR – Building a strong Cyber defence

THOR – Building a strong Cyber Defence

1. Understand your threats and vulnerabilities

2. Getting the basics right

3. Anti-virus, Anti-Spam, Firewall/s Vulnerability &

Penetration testing

4. Security patching for everyone

5. Password Security

6. What is Encryption and Why it’s important?

7. Incident Management and Contingency plans

8. Look at your 3rd parties Suppliers

9. Education, Education, Education

10. ISO27001, PCI DSS or Cyber Essentials

11. Cyber Insurance & how it helps

Cyber Self-Defence

GARY HIBBERDManaging Director

Shúkran.Any Questions?

THOR: Building a strong Cyber defence · THOR – Building a strong Cyber Defence. Gary Hibberd -...

Documents

PROCUREMENT AT CYBER SPEED - Defence and Security

Cyber Defence Data Exchange and Collaboration Infrastructure (CDXI)

CYBER AS A NEW WAR DOMAIN Cengiz ÖZTEKE Colonel Commander, TAF Cyber Defence Command

“CYBER DEFENCE” KEAMANAN INFORMASI DAN KEDAULATAN NKRI MELALUI BATALYON CYBER

Cyber Defence Intelligence (CDI)

Cyber Defence East Africa Summit 2015 invitation

Cyber Defence Digital Signals Insights Make sense of the noise … · 2020-02-25 · 1 2 3 Digital Signals Insights Platform Cyber Defence Cyber Serenity is spotting threats in the

The future challenges of Defence cyber - snclavalin.com€¦ · The future challenges of Defence cyber Dr Richard Piggin Principal Operational Technology Cyber Security ... Data Acquisition

Seminar CYBER DEFENCE UNSOED 21 September 2014

Invitation to Cyber Defence East Africa 2014 conference

Cyber defence sebagai garda terdepan ketahanan nasional

Cyber Defence in the Corporate World

Mainstreaming European Military Cyber Defence Training & Exercises · Mainstreaming European Military Cyber Defence Training & Exercises 2nd ENISA International Conference on Cyber

Multinational Cyber Defence Capability Development (MNCD2) · Multinational Cyber Defence Capability Development (MNCD2) Cyber Defence Smart Defence Projects Conference . Lisbon –

FUTURE OF CYBER CONFERENCE 2016 CYBER · Project on Cyber Defence Education Cyber Security in the Slovak Republic & Training, Portugal NATO Multinational Smart Defence Project on

M&S Support for Cyber Defence

European Defence Agency Capabilities Directorate cyber defence systems, ... identified cyber defence as one of ten priorities in its Capability Development Plan ... Exercise & Testing

How to Strengthen Cyber Defence Competencies and Skills … · The Cyber Defence Aspects of the Capability Development Plan. The Value of Architectures for planning Cyber Defence

Defence and Cyber-Security - publications.parliament.uk · Defence and Cyber-Security ... Protection of critical national infrastructure ... Cybersecurity Bill Ineffective Without

Active Cyber Defence Alliance - Home Affairs