Teri Takai EXECUTIVE DIRECTOR, CENTER FOR DIGITAL GOVERNMENT

The Cyber World of DoD Nation States International Cyber Criminals THREAT ACTORS MOTIVATIONS Nation States Cyber-Espionage Harvesting PII for spear-phishing Platform for future exploitation Economic data indicators Competitive intelligence Intellectual property theft Cyber-Crime Harvesting PII for identity theft Supply chain manipulation Credit authorization manipulation Customer account manipulation Physical theft Cyber-Hacktivism Hacktivism for the Lulz (Thrill) Cyber-civil disobedience Political hacktivism Retribution hacking Terrorism China Russia Iran North Korea International Cyber Criminals Russia Eastern Europe Asia Americas Hacktivists and Terrorists Anonymous LulzSec Al Qassam Cyber Fighters Syrian Electronic Army Guardians of Peace (GOP) The Cyber World of DoD SOURCE: US DoD

Private Sector: Surrounded By Threats SOURCE: CDG

? BIG THE What Do We Do Now?

Risk management is a leadership issue 1. CISO – Do I need one? You need an owner – one leader Depends on size and scope of business Depends on size and scope of information But… Someone needs to do the following… Risk management is a leadership issue

Managing Risk for Present & Future 2. Cyber Strategy Not everything requires the same level of security. Make security a part of every business decision. Security is NOT about saying no. Managing Risk for Present & Future

Inspect, Don’t Just Expect 3. Insider Risk Cyber Security Training is the first step. Create a culture of cyber responsibility Ensure planning includes partners (e.g., outsourced IT, partners, etc.) Use audits and metrics to monitor implementation, effectiveness and impact. Inspect, Don’t Just Expect

Build Cyber Protection: Maintain the Technology Build cyber protection in phases – it’s not just the tools Build experience to implement and manage the controls. Maintain all the technology Manage technology contracts and procurement. Build Cyber Protection: Maintain the Technology

When Prevention is Not Enough 5. Disaster Recovery and Business Continuity Old Concept – Think in terms of Cyber. Know who is in charge when a breach occurs There is no “storm warning” for Cyber attack When Prevention is Not Enough

? BIG ANOTHER What Is Next?

Next Generation Solutions Identity Analytics Next Generation Cloud Security • Within • Between Systems designed with proactive and preventative detection Next Generation Solutions

The Internet of Things refers to the interconnection of computing devices across the Internet and includes devices as diverse as implanted heart monitors, cows and sheep with biochip transponders, smart buildings, and even the clothes we wear. The Next Big Threat SOURCE: WEARABLE

Beckstrom’s Law If it’s connected to the Internet it’s hackable. Everything is being connected to the Internet. Therefore everything is hackable. Rod Beckstom Beckstrom’s Law

Cybersecurity is a Journey, Not a Destination The cyber threat is evolving and it’s a moving target. Continuing investment is a new business reality. Cybersecurity is a Journey, Not a Destination

THANK YOU Teri Takai EXECUTIVE DIRECTOR, CENTER FOR DIGITAL GOVERNMENT