Security Agility: Creating a Multi-Disciplinary Framework Presented By: Joseph A Juchniewicz, CRISC

“Organizations must assume their networks will be breached by cyber criminals and hackers.” - Admiral Mike Rogers National Security Agency Director

Current Breaches

The Players Not deterred by normal barriers/non-opportunistic Out to prove a point Perhaps the most dangerous opponent Individuals/Groups Steal personal information Extort victims Financial Gain

The Players Steal proprietary information Personal financial gain Ideological reasons Nation state actors Steal sensitive state secrets (government) Steal propriety information (industry)

The Players Sabotage the computer systems Ideological reasons National state-actors Gain advantage over their enemy Could be against government or corporation

Handicapping Factors Factors that handicap most company The “bad guys” communicate better then us Stigma Brand name Consumer confidence Security is synonymous with the word “NO” Fines and credit monitoring Loss of jobs

Threat Vectors Threat vectors that affect the company Weakest Link - the User

“Weakest Link” User Phishing Voice Phishing Mobil devices Lack of education

Handicapping Factors Threat vectors that affect the company Weakest Link - the User Lack of Sophistication

“Weakest Link”

Handicapping Factors Threat vectors that affect the company Weakest Link - the User Lack of Sophistication Escalating number of zero-day attacks Complexity of attacks

“Defender Gap” Unchanged in 10 years.

Handicapping Factors Threat vectors that affect the company Weakest Link - the User Lack of Sophistication Escalating number of zero-day attacks Complexity of attacks Older Attacks still work

It’s Difficult to Keep Up

Strategic Vision Move away from prevention Technology irrelevance - Point solution Commoditization Vendor acquisition to create ‘solution sets’ The use of Multi-Disciplinary towards Detection and Elimination Integration of solutions – improved detection Identification and remediation focus Requires intelligence and rapid response Technology irrelevance - Point solution Commoditization Firewalls essentially commoditized by 2010 File sync/share commoditization now occurring

Execution – Create Agility Test, Validate, Exercise, Review (REPEAT!!!) True test of agility IT War Games Build team cohesiveness and responsiveness Continued education and training

“There are risks and costs to any program of action – but they are far less than the long range cost of comfortable inaction.” – John F. Kennedy

Questions?