NYBA 2017 Technology, Compliance & CIS Top 20 NYBA 2017 Technology, Compliance &  Risk Management Forum 

INTRODUCTIONS Derek Boczenowski Nick Hnatiw Sr. IT Security Analyst for Compass IT Compliance, performing audits and risk assessments for multiple verticals. Prior to Compass, worked for a FI in Massachusetts in the IT department for 15 years. Nick Hnatiw Co-Founder and CEO of Loki Labs Inc., a managed security services provider located in NYC. Loki provides the LokiSOC, a scalable managed SOC platform as well as red team/pentest assessments. Prior to Loki Labs, Nick worked for the US DoD facilitating offensive on-net operations and as a technical director that coordinated research for 10 years.

AGENDA How are we doing? Why the CIS Top 20? The Top 20 

HOW ARE WE DOING? Cybercrime damage to exceed $6,000,000,000,000 by 2021 68% of funds lost as a result of a cyber attack were declared unrecoverable *Ponemon Institute study 90% of large organisations reported suffering a security breach in 2015 Online banking fraud increases 48% year-on-year

HOW ARE WE DOING? 53% - external notification of breaches 47% - internal notifications of breaches Source: Mandient M-Trends 2016

WHY THE CIS TOP 20?

If you did nothing, you would still be protected. PRIORITIZED LIST If you did nothing, you would still be protected.

RISK BASED “[The CIS Top 20] map directly to the CSF core requirements and provide a realistic and community-driven risk management approach for making sure your security program will be both effective and efficient against real-world threats.” Risk is a function of attack surface, vulnerability of the attack surface, and the impact it will have on business operations.

The focus of CIS Top 20 is consistent with other compliance standards: COMPLIANCE IS NOT AN AFTERTHOUGHT The focus of CIS Top 20 is consistent with other compliance standards:

COMMUNITY DRIVEN Community of experts votes on changes Anyone can apply to be a member

DYNAMIC Re-ordered so that Controlled Use of Admin Privileges is higher (moved form 12 to 5) Deletion of Control 19 – Secure Network Engineering  New Control: 7 Email and Web Browser Protections The top 4 controls have not changed: CIS still views these controls as their most important 

TOP 20 LIST 1. Inventory of Authorized and Unauthorized Devices 2. Inventory of Authorized and Unauthorized Software 3. Secure Configurations for Hardware and Software  4. Continuous Vulnerability Assessment and Remediation  5. Controlled Use of Administrative Privileges 6. Maintenance, Monitoring, and Analysis of Audit Logs 7. Email and Web Browser Protections 8. Malware Defenses 9. Limitation and Control of Network Ports 10. Data Recovery Capability

TOP 20 LIST 11. Secure Configurations for Network Devices 12. Boundary Defense 13. Data Protection 14. Controlled Access Based on the Need to Know 15. Wireless Access Control 16. Account Monitoring and Control 17. Security Skills Assessment and Appropriate Training to Fill Gaps 18. Application Software Security I9. Incident Response and Management 20. Penetration Tests and Red Team Exercises

Admins have the keys to the network – protect the keys. 05 – CONTROLLED USE OF ADMIN PRIVLEDGES Admins have the keys to the network – protect the keys. Technical: Limit User Inventory/Monitor admin accounts

Malware is the vehicle of hackers. Technical: 08 – MALWARE DEFENSES Malware is the vehicle of hackers.  Technical: AV/EDR, Firewalls, IPS/IDS

Your data is the treasure. Technical: Backup images and data 10 – DATA RECOVERY CAPABILITY Your data is the treasure. Technical: Backup images and data

Users are the keys for hackers to get in. Technical: 16 – ACCOUNT MONITORING & CONTROL Users are the keys for hackers to get in. Technical: Review all accounts Disable unknown/unused accounts

Prior proper preparedness prevents piss poor performance! 19 – INCIDENT RESPONSE & MANAGEMENT Hope is not a plan. Technical: The seven P’s: Prior proper preparedness prevents piss poor performance!

Derek Boczenowski dboczenowski@compassitc.com Questions? Nick Hnatiw nick@lokilabs.io Derek Boczenowski dboczenowski@compassitc.com