National Cyber Security Awareness Month

Who We Are Special Guest Zac Abdulkadir - CISSP, CISM, CRISC President / CISO Bert Goodrich Vice President - Sales Special Guest Mike Wylie - MBA, CISSP Director, Cybersecurity Services Richey May Technology Solutions Tony Lewis Technical Account Manager Senior Engineer Andy Nolan SOC Manager

Tony Lewis – CIS Controls Basic CIS Controls Inventory and Control of Hardware Assets Inventory and Control of Software Assets Continuous Vulnerability Management Controlled Use of Administrative Privileges Secure Configuration for Hardware and Software on Mobile Devices, Laptops, Workstations and Servers Maintenance, Monitoring and Analysis of Audit Logs

Tony Lewis – CIS Controls Foundational CIS Controls Email and Web Browser Protections Malware Defenses Limitation and Control of Network Ports, Protocols and Services Data Recovery Capabilities Secure Configuration for Network Devices, such as Firewalls, Routers and Switches Boundary Defense Data Protection Controlled Access Based on the Need to Know Wireless Access Control Account Monitoring and Control

Tony Lewis – CIS Controls Organizational CIS Controls Implement a Security Awareness and Training Program Application Software Security Incident Response and Management Penetration Tests and Red Team Exercises

Andy Nolan – Incident Response Incident Response Stats 206 days, on average, to detect a data breach. (Ponemon, 2017) 66 days, on average, to fully contain a data breach. (Verizon, 2017)

Andy Nolan – Incident Response Something something Preparation and planning in advance Identification of true security incidents Containment of threats to minimize impact Eradication of threats at their origin Recovery of systems, applications and data Analysis of the incident for process improvement

Andy Nolan – Incident Response Storytime – The Bad, and Ugly

Andy Nolan – Incident Response Storytime – The Good!

Michael Wylie, MBA, CISSP 2018 Penetration Testing Michael Wylie, MBA, CISSP 2018

About me: Mike Wylie, MBA, CISSP Director, Cybersecurity Services Richey may Technology Solutions Additional CEH CEI Project + Security + Certifications CCNA R&S CCNA CyberOps Pentest + CHPA

About Richey May Technology Solutions Richey May Technology Solutions is a results-driven consulting firm offering the full spectrum of technology solutions for your business. Led by technology experts with decades of cumulative experience in executive IT roles, our team is able to bring you pragmatic, real-world solutions that deliver value to your business. Cybersecurity Cloud Services Governance, Risk, Compliance & Privacy Technology Management Consulting Marketing Technology

Information Security Statistics 62% of cyber incidents are Small-Mid businesses (Verizon, 2013) SMBs saw a 14% increase in cyber attacks from prior years (SEC, 2018) “Cybercrime Represents a Very Real, and Very Serious Threat to SMBs” (SEC, 2018) http://www.verizonenterprise.com/resources/reports/rp_data-breach-investigations-report-2013_en_xg.pdf https://www.sec.gov/news/statement/cybersecurity-challenges-for-small-midsize-businesses.html

What is Penetration Testing? Ethical hacking with client authorization Using hacking tactics, techniques, and procedures for good Systematic testing of security controls Attempt to gain access to critical data

How Will Pen Testing Benefit Customers? Exposes weaknesses before hackers do Required by several regulatory organizations - PCI-DSS - FISMA - SOX - NYDFS.NYCRR.500 - HIPAA - GLBA Actionable items to remediate Better value over vulnerability scans Far less expensive than a breach

How Will Pen-Testing Benefit MSPs? Hundreds of vulnerabilities that need to be fixed Someone has to do the remediation work A breach would get you fired Customer sees you as proactive Learn to implement better security Increased IT & security budget

Pen Test Budget It depends on multiple factors Options: Vulnerability scan ($) Security assessment ($$) White box test ($$) Grey box test ($$) Black box test ($$$) Red Team engagement ($$$$)

Make Sure You’re Getting a Good Test Everyone does “security” now Balance between technical and business skills Clearly define a “penetration test” Discuss the scope, goals, and deliverable Understand what a penetration is not You get what you pay for

Thank You! Michael Wylie Twitter: @TheMikeWylie EMAIL: MICHAEL@richeymay.com www.richeymaytech.com

Thank you for attending! For further information, please contact Bert Goodrich Vice President of Sales Bert@NetreadyIT.com 805-299-2222 (Direct Line) Cyber Security Services Network Design Cloud Solutions Business Continuity Project Management Infrastructure Monitoring