Cyber Security Enterprise Risk Management: Key to an Organization’s Resilience Richard A. Spires CEO, Learning Tree International Former CIO, IRS and US DHS August 3, 2017

Our Cyber Security Challenge COMPLEXITY IT Environment Cyber Tools ADVERSARIES APTs Criminal Orgs TALENT One Million Openings Development HOUSTON, WE HAVE A PROBLEM!

Complexity – Evolution of Technology Wireless Technology Internetworked Internet of Things Mobile Devices Mobile Devices Distributed Clouds Client–Server Service- Oriented SQL Database Monolithic Object-Oriented Components Minicomputers Single-Tier Mainframe PCs Time 60s 70s 80s 90s 00s 10s

Complexity – No Longer a Perimeter to Defend

Complexity – Cyber Security Tools Thousands of Products/Solutions Lack of Integration Big Data – but Good Results?

Cyber Security Risk Management Perfect Security Is Not Achievable Too little is clearly not desired Too much can make systems practically unusable Risk to the Organization Financial and reputational risks from breaches How does an organization determine what to do and how much is enough? TWO KEY TOOLS to support answering the risk management question: 1. NIST Cyber Security Framework 2. Center for Internet Security (CIS) 20 Critical Security Controls (CSCs)

NIST Cyber Security Framework Response to Presidential Directive 13636, Improving Critical Infrastructure Cyber Security More than 3,000 people from diverse parts of industry, academia, and government participated in workshops and webinars Other Advantages Appropriate for both government or private-sector Developed as high-level guidance and approach Scalable, flexible, comprehensive, and explicit Suitable for incorporating industry-specific requirements References elements of NIST SP 800, ISO/IEC 27001, and COBIT

NIST Cyber Security Framework “The Framework helps an organization to better understand, manage, and reduce its cyber security risk. It will assist in determining which activities are most important to assure critical operations and service delivery. In turn, that will help to prioritize investments and maximize the impact of each dollar spent on cyber security.” —From the NIST Framework

NIST Framework Elements The Framework Core (“Core”) A set of cyber security activities, desired outcomes, and applicable references The Core covers life cycle of Identify, Protect, Detect, Respond, Recover Framework Implementation Tiers (“Tiers”) Provide context on how an organization views and manages cyber security risk A Framework Profile (“Profile”) Represents the outcomes based on business needs that an organization has Standards, guidelines, and practices to the Framework Core in a particular implementation scenario See http://www.nist.gov/cyberframework/

Core Functions Functions Description Categories Identify Protect Develop the organizational understanding to manage cyber security risk - Asset Management - Business Environment - Governance - Risk Assessment - Risk Management Strategy Protect Appropriate safeguards to ensure delivery of critical infrastructure services - Access Control - Awareness and Training - Data Security - Maintenance - Protective Technology - Information Protection Processes and Procedures Detect Appropriate activities to identify the occurrence of a cyber security event - Anomalies and Events - Detection Processes - Security Continuous Monitoring Respond Appropriate activities to take action regarding a detected cyber security event - Response Planning - Communications - Analysis - Mitigation - Improvements Recover Appropriate activities to maintain plans for resilience and to restore any capabilities - Recovery Planning - Improvements - Communications

Tiers Tiers Title Description 1 Partial Organizational cyber security risk management practices are not formalized, and risk is managed in an ad hoc and sometimes reactive manner 2 Risk Informed Risk management practices are approved by management but may not be established as organization-wide policy; prioritization of cyber security activities is directly informed by organizational risk objectives, the threat environment, or business/mission requirements 3 Repeatable The organization’s risk management practices are formally approved and expressed as policy; organizational cyber security practices are regularly updated based on the application of risk management processes to changes in business/mission requirements and a changing threat and technology landscape 4 Adaptive The organization adapts its cyber security practices based on lessons learned and predictive indicators derived from previous and current cyber security activities

NIST Cyber Security Framework: Process STEP 3: Create a Current Profile STEP 1: Prioritize and Scope STEP 2: Orient STEP 7: Implement Action Plan STEP 5: Create a Target Profile STEP 4: Conduct a Risk Assessment STEP 6: Determine, Analyze, and Prioritize Gaps

CIS 20 Critical Security Controls CSC Control Title 1 Inventory of Authorized and Unauthorized Devices 2 Inventory of Authorized and Unauthorized Software 3 Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers 4 Continuous Vulnerability Assessment and Remediation 5 Controlled Use of Administrative Privileges 6 Maintenance, Monitoring, and Analysis of Audit Logs 7 Email and Web Browser Protections 8 Malware Defenses 9 Limitation and Control of Network Ports, Protocols, and Services 10 Data Recovery Capability CSC Control Title 11 Secure Configurations for Network Devices such as Firewalls, Routers, and Switches 12 Boundary Defense 13 Data Protection 14 Controlled Access Based on the Need to Know 15 Wireless Access Control 16 Account Monitoring and Control 17 Security Skills Assessment and Appropriate Training to Fill Gaps 18 Application Software Security 19 Incident Response and Management 20 Penetration Tests and Red Team Exercises

CIS – First 5 Critical Security Controls Good IT Management Inventory Configurations Basic Cyber Hygiene Vulnerability Assessment Admin Privileges Eliminates Vast Majority of Vulnerabilities CSC Control Title 1 Inventory of Authorized and Unauthorized Devices 2 Inventory of Authorized and Unauthorized Software 3 Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers 4 Continuous Vulnerability Assessment and Remediation 5 Controlled Use of Administrative Privileges

Cyber Security and Organization Resilience Risk Management Approach Focus on the Important Organizational Commitment At a Board and Senior Management Level Regular Relook