PA DGS 16 Presentation - Cybersecurity How Do I Know When I'm Doing Enough - Dennis Birchard

Dennis Birchard – Principal Enterprise Security Architect

©2016 AKAMAI | FASTER FORWARDTM

THIS IS NOT FUD – THIS IS JUST ME

Fear, uncertainty and doubt (FUD) is a tactic used in sales,

marketing, public relations, politics and propaganda.

FUD is generally a strategic attempt to influence perception by

disseminating negative and dubious or false information.

PERCEIVED RISK

REALITY OF RISK


WHAT IS THE FIRST WORD YOU SEE?


How Do I Know When I’m Doing Enough?



OR


Security Strategies


Security ToolsPhishing Social Engineering Endpoint Security DNS Poisoning

DDOS WebApp Vuls Critical Vuls Identity and Access


Good Security Hygiene


1) Patch / Update – Firmware, Software, All

2) Limit Access – Admin vs Production & Non-Production

3) Monitor Admin Usage CLOSELY

4) Employee Recon

5) Policy Segmentation

6) Automation vs Manual Ad-Hoc

7) SIEM/Visualization

8) Documentation and Escalation Repositories

9) Escalation Training (Readiness - Red-Team Drills)

10) Evaluate / Optimize / Adherence

10 Easy Steps “Back to the Basics”


PATCH PATCH PATCH and LIMIT ACCESS


EMPLOYEE RECON and POLICY SEGMENTATION

VPN Concentrator wwwwww

ISP xcons

Public Internet

Relational Database

wwwwww

Users (good/bad)

DMZ

IPS/IDS

Remote Offices

LB

Name Servers

=


AUTOMATE and VISUALIZE EVENT DATA


DOCUMENTATION and ATTACK DRILLS


TRAINING and ADHERENCE / OPTIMIZATION



Government & Nonprofit

PA DGS 16 Presentation - Cybersecurity How Do I Know When I'm Doing Enough - Dennis Birchard