Considerations for Cybersecurity and Data Security in Today’s World ACIL Education Series Presented by | Darrell Laffoon March 25 – 30, 2019 Washington, DC

Can you survive a breach? Do you know that you are in the ring What is your plan And then what?

Fundamental Questions What are cybersecurity and data-security risks? How can you protect your cyber and data assets

What are cybersecurity and data-security risks?

Information Security – Protecting your Most Valuable Asset MVA Workforce Data Second & Third party Customer Data Partner Data Research Data Company IP “Data is the new oil.” — Clive Humby Clive Humby – data scientist cybersecurity preventative methods used to protect digital information and assets from being stolen, compromised or attacked data-security is a set of standards and technologies that protect data from intentional or accidental destruction, modification or disclosure.

Cybercrime is BIG BUSINESS $1200 $300 $20 $11 $4 Black Market Value Personal Information What is your research and results worth? What about other IP? Visa or MasterCard Date of Birth Medical Insurance Bank Account Complete Identity

The New Oil Fields… 2018 Data Breaches 500 million Starwood guest reservation database was compromised, including name, address, phone number, date of birth, gender, email address, passport number, and Starwood’s rewards information. Under Armour confirmed a breach that impacted 150 million MyFitness Pal users. Usernames, email addresses and hashed passwords were among the information exposed. 92 million MyHeritage users were exposed in a data breach event after a data file containing MyHeritage user login credentials was found on a private server. Nearly 87 million Facebook user accounts were compromised after hackers took control of approximately 50 million accounts plus an additional 40 million accounts that may have been accessed. 60 million Email address, username, user ID, account number, street address, phone number, authorized users, mailing campaign data, real time tracking data. A hack by an unauthorized party lead to a data breach at Ticketfly that affected 26 million user names, addresses, email addresses and phone numbers. Government Payment Service leaked personal information of more than 14 million customers including names, addresses, phone numbers, and partial credit card data. Do you think these guys had a plan?

58% Don’t recognize they are a target Lower InfoSec Budgets SME’s are targets too Don’t recognize they are a target Lower InfoSec Budgets Lack cybersecurity skillsets Easier to infiltrate 58% Verizon – 2018 Data Breach Investigations Report

- Robert Mueller - FBI Director “ There are only two types of companies: those that have been hacked, and those that will be. - Robert Mueller - FBI Director

Accept and understand that you are at Risk Top Risks Human Error Hacker Extortion Hactivism Espionage https://www.travelers.com/resources/cyber-security/top-5-cyber-risks-for-businesses

How can you protect your cyber and data assets?

Information Security Hygiene CIA Triad Confidentiality Integrity Availability Constant & Evolving Threats Layered Security Continuous PDM Cycle Top level information protection and privacy controls are an absolute necessity

Layered Security – Prevent, Detect & Manage Data Application Host Network Physical/Enterprise PDM Controls Prevent Detect Manage Reduce the attack surface

Information Security Plan 4/3/2019 Information Security Governance The goal is to meet and exceed the strictest policies and controls Enterprise Wide Security Policies Security Committee Industry Standards/ Best Practices Compliance & Certification 3rd Party Auditing, Testing Strict Role Based Access Control Strict Change Management Disaster Recovery/BCP Training & Education Standards & Best Practices 3rd Party Certifications Job #1 - 24/7 x 365 Defense in Depth & Breadth Principle of Least Privilege Multi-Factor Authentication Secure Profile Triple Layer Encryption Independent Testing & Verification Threat Assessment & Response Independent Auditors & Testing Partner Security Assessments

“ Football is two things. It’s blocking and tackling. I don’t care about formations or new offenses or tricks on defense. You block and tackle better than the team you’re playing, you win. – Vince Lombardi

Protect yourself, your employees, your customers and your business Information Security 101 Protect yourself, your employees, your customers and your business Prevent Leverage cloud and vendor to reduce attack surface Detect – Practice good information hygiene and secure all digital assets - Proactively identify, monitoring, test, and verify – Mitigate risk, prepare and plan, and respond quickly Leverage cloud and vendor services to reduce your attack surface Seek guidance from cybersecurity experts to assess cyber risk and develop strategic plans to minimize exposures Manage Seek guidance from cybersecurity experts