2 - Cyber Security

BUILDING SECURITY SYSTEM AT ANY COST? Business Aspects of Security Management

Dr. Richardus Eko Indrajit indrajit@post.harvard.edu

Potpourri of Experiences

  Auditing many systems: government, education, and various industries

  Promoting BS7799 as national standard for computer security

  Studying and implementing several security standard (ISO17799, COBIT, ITIL, etc.)

  Researching social behavior on information technology and security awareness

  Analysing several executives who do not care about computer security

The Knowing-Doing Gap Phenomena

  Executives know the risks, but they’’re just hoping that such unexpected events might not occur during their time of services ““I am a good guy, God loves me, nobody will be trying to hurt my career…””

  They understand the impacts, but when it comes to the cost of preventing it, they favor the fact that such probability of happening is very small ““If nothing happens, the boss will sacrifice me for the lost of money for nothing, when it does occur, nobody will praise me cause it is not an outstanding job…””

Psychological State of Mind

  Defensive Reasoning: Disasters are coming from the bad guys, so if something happens, blame those people (I have protected my place as necessary, based on my best effort limited capabilities)

  Natural Reasoning: If God’’s willing, nothing can stop Him from doing anything (Don’’t forget, God has asked you to take care of yourself)

  Logical Reasoning: I have done the risk management assessment, I understand it, but the cost of developing controls exceed the business benefits

  Heroic Reasoning: I am an ex-hacker, I am a risk taker, I am willing to take the risk

Common Misperceptions

  The highest risks are the loss of business No! Million of people can die because of it!

  It’’s an externality issue, nothing you can do about it, the thieves are always smarter than the police No! It’’s your job to help the police protecting your environment!

  The personal risk that I might be facing is being fired from the job No! You can go to jail for not doing nothing!

  If you are too busy paying attention to the risks, you are forgetting and too afraid of conducting your business No! If you do the business, you have just married the highest risk of your life

Passive Action

  Wait and see   Favor reactive behavior   Stay low profile

Things-to-Do

  Wake up call!!!

  Wake up call!!!  Wake up call!!!

… experiencing is believing…

Things to Remember

… getting hacked is not a natural disaster …

it can be predicted it can be mitigated it can be prevented

so, if it happens… it’’s totally your faults…

Thank You

2 - Cyber Security

Internet

Cyber Security isn’t Really Cyber

National Cyber Security Alliance National Cyber Security Awareness … · 2020-02-13 · National Cyber Security Alliance National Cyber Security Awareness Month 2017 Results Summary

Cyber Security Design Requirements for Power …Current Cyber Security Regulations & Guidance (1/2) • (2004) Publication of NUREG/CR-6847, “Cyber Security Self- Assessment Method

THE LOGICAL EVOLUTION SECURITY OF CYBER SECURITY THE LOGICAL EVOLUTION SECURITY OF CYBER SECURITY BASED ON THE ANATOMY OF A CYBER-ATTACK . 2 REACTIVE defense Cyber attacks in the 20th

Cyber Security Part 2

Cyber Security - documents.swisscom.comdocuments.swisscom.com/.../Security-Doks/cyber-security-report_de.… · Swisscom AG, August 2015-08-19 Cyber Security: die aktuelle Bedrohungslage

Cyber security & Importance of Cyber Security

Cyber Physical Security for Smart Grid - pserc.wisc.edu · Cyber Physical Security for Smart Grid ... Cyber-Physical System Security 2. Risk modeling and mitigation 3. ... • Synergistic

CYBER SECURITY DIVISION - dhs.gov · CYBER SECURITY DIVISION: SECURING YOUR CYBER FUTURE • • • CYBER SECURITY DIVISION OVERVIEW The nation’s economic strength and security

MAGAZINE - Cyber Security Raad€¦ · progression of cyber security ° Cyber security: limitation and opportunity Cyber security belongs in the boardroom ° °Greater internet security

Improving Cyber-Security Improving Cyber-Security through

Cyber Security Specialist Information Security • Cyber ... · Cyber Security • Security Analyst • Cyber Security Specialist Information Security • Cyber Operations Manager

FOCUS GROUPS - Cyber Security Coalition | Cyber Security ... · A central pillar of the European Union cyber security strategy, the Cyber Security Act aims to strengthen the cyber

CIP-005-5 6 — Cyber Security – Electronic Security Perimeter(s) 201603 Cyber... · 2017. 5. 2. · CIP-005-5 6 — Cyber Security – Electronic Security Perimeter(s) Page 4 of

Cyber Security Working Group March 17, 2010. 2 Smart Grid Cyber Security Strategy Establishment of a Cyber Security Coordination Task Group (CSCTG) Established

Cyber Security Risk Rating The Egan-Jones Cyber Security

CYBER SECURITY AND ELECTRIC UTILITY COMMUNICATIONS … · cyber security and electric utility communications what nerc/cip means for your microwave . 2 aviat networks ... cyber security

Using R for Cyber Security Part 2

Enterprise and Cyber Security in Defence -Cyber...2 3 Taking control of your cyber security future In this Digital age, managing cyber security is a perpetual challenge. Evermore sophisticated

Cyber Security Conference October 2 & 3 2015 · Cyber Security Conference – October 2 & 3 2015 Page 2 of 14 Speakers and Session Synopsis Antony Abraham; Security Architect –