1 AFCOM Data Center World March 15, 2016 Moderator: Donna Jacobs, MBA Panel: Greg Hartley Bill Kiss Adam Ringle, MBA ITM 9.2 The New Security Challenge: Infiltrating the infrastructure

2 Data Center World – Certified Vendor Neutral Each presenter is required to certify that their presentation will be vendor-neutral. As an attendee you have a right to enforce this policy of having no sales pitch within a session by alerting the speaker if you feel the session is not being presented in a vendor neutral fashion. If the issue continues to be a problem, please alert Data Center World staff after the session is complete.

3 When, Not if Put video # 1 here

4 What cyber security means Ask the panel

5 RankStateLoss 1California$131,363,796 2Florida$ 52,544,107 RankCountryLoss 1United States$672,080,323 IC3* 2014 Complainant Loss by Victim State** **The IC3 was established as a partnership between the Federal Bureau of Investigation (FBI) and the National White Collar Crime Center (NW3C) to receive Internet related criminal complaints and to further research, develop, and refer the criminal complaints to federal, state, local, or international law enforcement and/or regulatory agencies for any investigation they deem to be appropriate.Federal Bureau of InvestigationNational White Collar Crime Center *Note: This total of complaints represents the top 50 countries reporting to the IC3. This total includes complaints listing dollar loss amounts and complaints reporting no dollar loss. Statistics were rounded to the nearest hundredth percent. The top 50 countries represent 99% of the complaints receive

6 Symantec April 2015 Volume 20 Report Internet Security Threat Report Government reports “a 183 percent increase in DNS amplification attacks between January and August 2014”. The Ponemon Institute published “2015 Cost of Data Breach Study” in May The study stated “The cost of data breach varies by industry. The average global cost of data breach per lost or stolen record is $154. However, if a healthcare organization has a breach the average cost could be as high as $363 and in education the average cost could be as high as $300. The lowest cost per lost or stolen record is in transportation ($121) and public sector ($68). The retail industry’s average cost increased dramatically from $105 last year to $165 in this year’s study.” Distributed Denial of Service - DDoS

7

8 When, Not if Put video # 2 here

9 How do we prepare? Educate Users Partnerships Review Policy Review 3 rd Party Contracts Implement Tools

10 Educate Users Weakest Link Can spot and report oddities Can be suspicious Must use Strong Passwords Connect to Internet with Caution Must Secure mobile Devices

11 Partnerships Industry or Sector Information sharing Teams and Committees US-Cert (Computer Emergency Readiness) ISAC’s (Sector Specific information sharing and analysis centers) Regional Committees Fusion Centers (A fusion center is a collaborative effort of two or more agencies that provide resources, expertise and information to the center with the goal of maximizing their ability to detect, prevent, investigate, and respond to criminal and terrorist activity) Local Universities FBI Regional Cyber Security Office Federal Agencies In-House Facilities Management In-House Risk management In-House Procurement In-House Human Resources

12 Review 3 rd party contracts HVAC Electronic Identification Electrical 3 rd Party processing Websites ISP Providers

13 Review and Update Policies Times have changed Physical security and electronic access Physical infrastructure and remote access User Remote Access Internet access Termination

14 When, Not if Put video # 3 here

15 Implement Tools In order to fight the Cyber-War and be in compliance with State and Federal laws, we must implement the CyberSecurity policies in line with state and federal laws, identify and mitigate risks while implementing software and/or equipment designed to: Detect and Stop Expose the cyber-attack life cycle Report Cyber-attack Produce forensic attack details

16 What IS the Greatest Threat or Vulnerability in the future? When, Not if

17 3 Key Things You Have Learned During this Session 1.Key terminology and acronyms used in discussion of CyberSecurity. 2.Best practice security measures to bring back to your organization. 3.Most importantly: awareness of what a security incident could mean to your organization.

18 Thank you! Moderator: Donna M. Jacobs, MBA IT Senior Director University of Pennsylvania Panelist:Gregory Hartley IT Senior Project Lead University of Pennsylvania William Kiss CEO Global 1 Research & Development, Ltd. Adam Ringle, MBA President Adam Ringle Consulting, LLC