Cyber Security Audit and Network Monitoring P.D. Mynatt Doug Brown March 19 th 2015

Audit Details Worked with SecurIT360 in an interrogatory process to discover how IT, process / application, and physical security is handled at MED Once audit was complete, SecurIT360 presented their findings to MED’s management team with recommendations for mitigation / remediation Iterative process over 2 bi-yearly audits looking for improvements and fixes from the previous audit

Audit Details SecurIT360 documented process and procedures through staff interviews to discover levels of security risk at MED Risk levels are defined as high, medium, low and include areas such as physical, organization, policy, recovery, system access, IT operations, system changes, compliance, and HR

Network Monitoring MED contracts with LBMC Managed Security Services to monitor and block unwanted / malicious network traffic LBMC installed a server that monitors our network and DMZ network This service is manned 24/7 by a team of Intrusion Detection / Prevention Analysts and alerts them to any suspicious traffic MED worked with LBMC to establish a baseline of acceptable network traffic and then block everything else Server sits behind our firewall and monitors traffic that isn’t blocked by the firewall

Hackers are trying to get in everyday…

What are we trying to keep out?

Who are we trying to keep out?

Is this enough protection? Simple answer is no… None of this type of protection will help us if our organizations are lax in any other area of security Social Engineering - A term for non-technical or low- technology means - such as lies, impersonation, tricks, bribes, blackmail, and threats - used to attack information systems Physical Security – If hacker gains physical access to your facility, they don’t need to get past your firewall…they are already on the inside and assumed to be trusted

What can we do? The Top 3 Recommendations from Doug… Training Security, in all its forms, is everyone’s responsibility – from the janitor to the GM and everyone in between. We owe this to our customers and payment must be made everyday…

Questions? If you want any more information about specifics, please feel free to contact me My contact information is: Doug Brown