Leverage What’s Out There How to create an Information Security Program By Brian Collentine

I Can Sleep at Night Creating an information security program It’s all about risk management and prioritization Where to start? NIST’s Cybersecurity Framework 20 Critical Security Controls

There are seldom technological solutions to behavior problems. You have to do stuff. Cultural shifts need to happen if security is not taken seriously. No program, service or person will be the magic bullet

Information Security Program, what’s that? Collection of Policies Procedures Processes Risk assessments Audits Reports Forms

But First… Which sounds better? We monitor the activity of remote access users. We log, record and review each user and the user’s frequency of access.

Track how you are doing. Use this to report to management Track how you are doing. Use this to report to management. Take credit for the work you are doing.

NIST’s Cybersecurity Framework Created by Executive Order Released in 2014 Used to communicate risk from Server Room to Board Room 30% of companies use it today 50% projected to by 2020 Developed for Critical Infrastructure Areas 16 areas Sound familiar

How does it work Framework Core Framework Profile Framework Implementation Tiers Framework Core Identify Protect Detect Respond Recover Framework Implementation Tiers How mature is your program Partial Formalized Repeatable Adaptive

Cybersecurity Framework Details Relies on 2 profile states Current and Target State Gap between is security plan Execs set mission priorities Business process level focuses on activities to manage risk within budget

Risk Assessment Basics Threat or Vulnerability = Impact x Likelihood

20 Critical Security Controls Created in 2008 Updated version in 2016 Controls developed by industry experts

First 5 Controls CSC 1: Inventory of Authorized and Unauthorized Devices CSC 2: Inventory of Authorized and Unauthorized Software CSC 3: Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers CSC 4: Continuous Vulnerability Assessment and Remediation CSC 5: Controlled Use of Administrative Privileges If you do nothing else, review the first 5 controls and create repeatable processes for each. Referred to as Foundational Cyber Hygiene

Give me some numbers Ability to measure current state Measure is a concrete figure X computers on network are fully patched Unauthorized software is detected within X days. Metric is an abstract, subjective attribute How well a network is secured against external threats. A metric can be assigned by collecting and analyzing groups of measures.

Developing the Program Create a strategy Start small Excel works just fine for tracking For each item create: How To document Report Template Key is repeatable processes

Thanks for the “info” How do I turn this into anything meaningful?

How about a freebie? CSC-1 Workstation Inventory All PC’s, laptops, tablets Everyone has a spreadsheet or database that they believe is the end-all-be- all list of computers Audit that list Export computer list from A/D Compare to manual list

Let’s take it up a notch! Pull list from WSUS Are all PC’s compliant (i.e. fully patched)? Pull list from A/V console Do all PC’s have current defs? Have they had a virus scan recently? Are any PC’s missing? Do those have AV installed/running? Pull list from WDE system Are all PC’s encrypted? Should they be? How are you making the case to yourself that laptops don’t’ need to be encrypted?

Thank you Brian Collentine