Protecting the Information Infrastructure

Wednesday, October 12, 11

Protecting the Information Infrastructure:

Why CIOs and CSOs are Becoming Mission-Critical

Business Partners

SNW Fall 2011

Jay McLaughlin, CISSPChief Security Officer, Q2ebanking

DISCLAIMERThe materials, thoughts, comments, ideas and opinions expressed throughout this presentation are entirely my own and do not necessarily represent the thoughts or opinions of my employer (past or present).

AGENDA• Information..the lifeblood of an organization

• Events involving loss of data are rising - who is to blame?

• Mitigating our vulnerabilities

• A shift to Information-Centric Security

• Developing critical partnerships across the organization

Information is the lifeblood of organizations, and considered a critical factor in a company’s effective pursuit of its business goals and success.

Information is not only valuable to an organization…but also to...

WHAT ARE WE TRYING TO PROTECT?

Regulated information is the type of data most often thought of when the subject of information protection is raised.

• Includes personally identifiable information (PII) of individuals, such as social security numbers, bank and credit card numbers and medical records. A great deal of public outrage, lawsuits, fines and loss of brand trust can accompany the compromising of this information.

Confidential information may involve marketing plans, financial projections, sales reports and M&A discussions.

• Breaches on this information can range from public embarrassment to catastrophe

Intellectual property (IP) is arguably the most critical type of information.

• According to the FBI, $600 billion worth of intellectual property is stolen every year in the U.S

• Companies tend to focus on regulated data while doing comparatively little to secure the IP that is critical to their business.

Setting the Stage - Recent Attacks–Defense Contractors

»Lockheed Martin»Northrop Grumman»L-3

–Commercial Organizations»SONY»GOOGLE

–Security Firms»RSA»Barracuda Networks »HB Gary Federal»Comodo / Digitar

–Government»United States DoD»Texas Comptroller’s Office

It gets worse...

Source: Scientific American, “Data Theft: Hackers Attack”, Oct 2011

Change in Tactics• Highlighted that in 2010,

the largest number of data breach incidents occurred, yet the volume of records dropped significantly

• Criminals are engaging in small, opportunistic attacks rather than large-scale, difficult attacks using relatively low sophistication attacks to penetrate organizations.

Will your organization be on this list?

• University of Texas: 688 students' and prospective students' personal information accessed by employees after configuration error made data available on intranet

• Blackpool Coastal Housing: 80 tenants' names, addresses, national insurance numbers, telephone numbers and confidential care plans transferred to employee's home computer where they were accessible to others

• Guilford County Tax Dept: 1,000 taxpayers' SSNs, names and addresses, and images of checks paid were accessible on internet

• Bright House Networks: Customer names, addresses, phone numbers and account numbers exposed in unauthorized access

• California State Assembly: 50 employees' personal information may have been acquired by hacker

• Montgomery County Dept of Job and Family Svcs: Names and Social Security numbers of 1,200 individuals seeking agency assistance were on lost thumb drive

Organizations are

sloppy

Overly Confident?Ninth Annual Global Information Security Survey

9,600-plus business and technology execs surveyed, 43 percent identify themselves as security frontrunners and believe they have a sound security strategy and are executing it effectively.

http://www.pwc.com/gx/en/information-security-survey/giss.jhtmx

Source: Information Security Magazine, October 2010

CIOs: Call to Action

• Delivery of effective technology solutions to external customers and internal constituents

• Maximizing the value of technology investments to improve business performance

• Increasing agility of the organization, enabling it to adapt to changing needs

• Reducing related operational costs across business units

Roles of the CSO

• ENABLE

• AUDIT

• ENFORCE

• EDUCATE

Influencing Behavior

• Education is critical

• Security awareness is a start...but not good enough

• “Behavioral change” is required

Overly Confident?To a fault...

• “...we haven’t been attacked before”

• “...why would someone target our company?”

• “...we undergo routine internal/external audits”

Why do we remiss security?

• CIOs and C-Level executives often don’t hear about security until an incident occurs

• CIOs are value-focused managers

• is security NOT viewed AS value-adding?

Source: Scientific American, “Data Theft: Hackers Attack”, Oct 2011

...in fact, we are spending more on security solutions to protect

our information systems

Security

Physical

Management

Operational

...but we’re not making investments in our processes

COMPLIANCE

Compliance Security

• Compliance Defined

: conformity in fulfilling official requirements.

• This isn’t about checking the box

It is the standard that is the problem, not the compliance with the standard.

CSOs tend to fixate on building an “EXCELLENT”

information security program

Where does the CSO fit in?

The Business Problem Topology

• Security is new to the executive table

• Security discussions in today’s enterprise tend to be focused on the qualitative aspects instead of the quantitative

• CSOs speak a language that is NOT understood by others executives

• CSOs struggle with creating awareness and changing behaviors

But, Security is often viewed as a BOTTLENECK

The “R” Word

• Developing those critical RELATIONSHIPS within the organization

• WALK A MILE

• Breaking down the walls...we’re all fighting the same battle

Current Environment

• Regulations and compliance requirements are demanding more time and attention• Regulators and auditors including PCI-DSS, GLBA, SOX/

404, HIPAA, etc. are demanding more executive time and attention

• Greater interest from CIOs and other business stakeholders regarding information security

• Routine communication around information security, compliance, investment and risk is critical...but challenging.

Management Differences

RISK MITIGATION translates to

Risk-focused

managers

Value-focused

managers

CSOCIO

LEADERSHIP PHILOSOPHIES

Effective Risk Managers?

• Generally, human beings struggle at managing risk

• We often overestimate risks that are highly visible or catastrophic and underestimate the risks that are slower to develop or not easily seen

• CIOs tend to overestimate risks that they have less control over, and underestimate the risks that they have more control over

ex: flying an airplane vs driving a car

Assessing Risk

• Engagement of business

• Top-Down Approach, ranking information assets

• Business Impact Analysis

• Quantitative vs. Qualitative

Understanding Risk Risk Management involves identifying threats and applying mitigating controls to effectively reduce the risk of those threats:

• Multiple by VALUE for quantitative

• Controls can mitigate risk…

...but can rarely fully eliminate risk

• RISK=(THREAT x VULNERABILITY)

COUNTERMEASURES

Calculating Loss Expectancy• The annualized loss expectancy (ALE) is the

product of the annual rate of occurrence (ARO) and the single loss expectancy (SLE)

Mathematically expressed: ALE = ARO * SLE

-> calculating SLE SLE = AV * EF

• Suppose than an asset is valued at $100,000, and the exposure factor (EF) for this asset is 25%. The SLE then, is (25% * $100,000), or $25,000.

• For an annual rate of occurrence of 1, the annualized loss expectancy is (1 * $25,000)

Applying Countermeasures

Our Approach is CRITICAL

THREATS

COUNTERMEASURES

• Focus efforts on the mitigating the ACTUAL vulnerabilities that are specific to the organization

• Avoid industry marketing FUD

Defense By Layer

• Acknowledges that reliance on any single control or mitigating factor is not sufficient

• This approach is commonly recommended

Scenario: Protecting Hosted Customer Data from an external attacker

• Database tables are encrypted

• Role-based access levels are applied

• Data Storage Encryption

Paradigm ShiftInformation-Centric Security

• Emphasizes security of the INFORMATION itself...rather than the security of networks, systems, and applications.

• 4 Principles:

1. Information (data) must be self describing and defending.

2.Policies and controls must account for business context.

3. Information must be protected as it moves from structured to unstructured, in and out of applications, and changing business context.

4.Policies must work consistently through the different defensive layers and technologies we implement.

Source: Rich Mogull, CEO/Principal Analyst, Securosis

Developing A Strategy• Creating an information protection strategy

– understanding the business and its specific needs for information protection.

– defining a set of objectives to deliver quick wins and address long-term goals.

• Locating and classifying the information that means the most– An impact analysis should be performed to identify the information

with the greatest impact to strategic, tactical and operational objectives.

• Weaving information protection into the fabric of the organization

• Developing the necessary capabilities to protect their information assets– Organizations need to determine the technologies and processes

that best support their information protection objectives

Source: Dr. Alastair MacWillson, Security Week Aug 2011

Summary

• Educate by establishing a foundation for communication (e.g. metrics, scorecards)

• Embrace an information-centric approach

• Play offense (ACT vs. REACT)

• Leverage leading edge technology that enables agility within the organization

• Security is NOT perfect, and it requires ACCOUNTABILITY

• START with the BASICS

The future ain’t what it used to be.

- Yogi Berra, New York Yankees

Be Prepared

QUESTIONS?

@jaymclaughlin

linkedin.com/in/mclaughlinjay

THANK YOU

Protecting the Information Infrastructure

Technology

ONEVIEW Protecting people, assets & infrastructure

Protecting Energy Infrastructure - SANS · Protecting Energy Infrastructure ITALIAN NATIONAL AGENCY FOR NEW TECHNOLOGIES, ENERGY AND SUSTAINABLE ECONOMIC ... • CRESCO - LAIII "Modeling,

Protecting atoll habitability, land and infrastructure in

Protecting vital national aviation infrastructure

Protecting Critical Infrastructure is Critical - RSA … · Protecting Critical Infrastructure is Critical. HT-W02. Check Point Fellow. #RSAC. American Blackout. National Geographic

Workshop „Information Security“ Protecting information efficiently€¦ · ABB ABILITY™ CYBER SECURITY SERVICES Workshop „Information Security“ Protecting information efficiently

SECCON - Protecting Banking and Financial Infrastructure

New Approaches to Protecting Critical Infrastructure from ...star-tides.net/sites/default/files/documents/files/Protecting Critical Infrastructure...Industrial Control Systems (ICS)

Protecting Critical Infrastructure Against the Next Stuxnet

Protecting Our Infrastructure: utilizing everything we have. Suguru Yamaguchi Advisor on Information Security, Cabinet Secretariat, Government of Japan

Protecting Critical Telecommunications and Networking Infrastructure

Improving Biosurveillance Protecting People as Critical Infrastructure

PROTECTING CRITICAL INFRASTRUCTURE IN THE EUaei.pitt.edu/15445/1/Critical_Infrastructure_Protection_Final_A4.pdf · PROTECTING CRITICAL INFRASTRUCTURE IN THE EU CEPS TASK FORCE REPORT

Remote Site Security: Protecting Critical Infrastructure & Key

Protecting Critical Infrastructure: a multi-layered approach

Protecting Vanderbilt Information

Protecting patient information

Ecosystems protecting infrastructure and communities · Ecosystems protecting infrastructure and communities: lessons learned and guidelines for implementation Ecosystem-based Disaster

CYBERSECURITY for ENTERPRISE INFRASTRUCTURE: Protecting ... · CYBERSECURITY for ENTERPRISE INFRASTRUCTURE: Protecting your DataCenter Marco Mazzoleni Consulting Systems Engineer,

Protecting information - University of York · Protecting information >> Introduction >> We are all responsible for protecting information Effective information security is fundamental