Notes accompany this presentation. Please select Notes Page view. These materials can be reproduced only with written approval from Gartner. Such approvals must be requested via Gartner is a registered trademark of Gartner, Inc. or its affiliates. Cyber Threat Preparedness Amos Auringer Gartner Executive Programs Colorado Government IT Summit, November 2008, Denver, Colorado Government systems make attractive targets for many reasons, but chief among them is the vast amount of private and confidential information stored - all of which can potentially be misused for criminal profit or just plain mischief. The challenge of keeping systems and data secure is a perpetually moving target and it is vital to have the right set of tools and safeguards. This session looks at the latest strategies and solutions being used in the public sector.

Life Is Dangerous, but Better Than the Alternatives New threats appear continuously, but not completely unpredictably. Most new threats will follow the introduction of new technologies, but the most-dangerous ones will come when the technology is mainstream. Old threats never die — the trick is to reduce the cost of dealing with them. Every threat can be mitigated or avoided — the question is always cost.

Internet Threat Hierarchy Experimentation Impact Frequency Vandalism "Hactivism" "Cybercrime" Information Warfare

n=50 Up to three responses allowed Top security threats that U.S. retailers worry about: Insider Threats Still the Most Worrisome Source: Gartner survey of 50 U.S. retailers, March 2008

Data Security Incidents Are Taking Some Toll on Consumers; Mainly on e-Commerce n=1590 Multiple responses allowed 8% 4% 9% 12% 20% 44% 53% 58% 59% 0%20%40%60%80%100% Your online payment behavior Your online shopping behavior Your level of trust in messages Your online banking behavior Your payment habits in stores Which stores you shop at in person Which financial institutions (banks) you use Other behaviors None of these Of which 23% spend avg. of 40% less Of which 84% delete suspect on arrival Base: 35% consumers who changed behavior due to security incidents “How has your behavior changed because of data security incidents?”

2008 Hype Cycle for Cyber Threats

Targeted Threat Growth Source: Microsoft Windows Malicious Software Removal Tool disinfections by category, 2H05-2H07

Old Threats Don't Disappear

Gartner Threat Projection Timeline

I&O Consolidation: Leave No Stone Unturned Storage Metro/Wide Area Networking Data Centers Branch Office Systems Client Devices Servers Security Middleware Mainframes Larger Office Systems Storage IT Operations Management Systems In-Building Networks /Messaging Consider the mainframe for computing consolidation. Standardize application server software, operating systems and programming languages; consider the enterprise service bus. "Maturize" processes before major automation initiatives. Consider relocating office system functionality to the data centers. Standardize/integrate with "multiple personality" device; make applications device-independent. Consolidate to fewer larger data centers.

Workloads Data Resources Identities Provisioning Optimization Availability 2010 to 2020 Policies Services Service levels and agility up Cloud enabled Infrastructure and Operations Modernization: From Silos to Clouds 2002 Sprawled Component-Orientation 2002 to 2012 Hardware costs down, flexibility up Virtualized Layer Orientation Automated Service Orientation

Shared Services Are More Than Centralization Clearly documented services Central management of services Mature, scalable processes Rationalized policies, assets and processes Financial management framework Service management, sales and marketing Sourcing model

Vulnerabilities 'R' Us Flawed Protection Attack Flawed Products Flawed System Admin. Flawed Procurement Flawed Education Flawed People

'Botnets' Continue to Grow and Morph BotArmy Name No. of Binaries No. of Distinct Compromised Hosts in Typical Enterprise Distinct Binaries per Compromise RAT-SZ-1 10, Sality IRC-VR IRC-SD Poebot RAT-DL Matcash IRC-SD RAT-SM Kraken Source: Damballa (2008)

Web Sites as the Leverageable 'Weakest Link' Vulnerabilities in Web sites are more popular because they enable more- sophisticated and multistage attacks. Site-specific vulnerabilities outnumber traditional vulnerabilities nearly 5-to-1 with much-lower patch rates — only 473 of the site-specific vulnerabilities had been patched at the time of reporting. Source: Symantec (2008)

Effective Management Reporting Current StatePlanned StateDesired State Gap Threat and Vulnerability Management Incident Response Identity and Access Management Process Process 5

The Program Maturity Assessment Map Governance Strategy and Planning Organization Process Maturity Communication ArchitectureIdentity and Access Management Threat and Vulnerability Management Risk and Controls Assessment Controls Framework Technology Management Green — strategic objective Blue — current state

Measuring Program Maturity

Security Fully Integrated in the EA Technology Architecture Information Architecture Business Architecture Security: Business security requirements Security organization Security policy framework Security processes Security: Technology security requirements Principles Security patterns Security services Security bricks Security: Data security requirements Data classification Application security templates Solutions Architecture Security solutions : Identity service Isolation service Physical ID service

New Acct Apps Detection Monitor Transaction Profiling Detection Monitor Cross-account Fraud Detection Cross Channel Fraud Detection Case Management Phone Online POS Branch Fraud data warehouse Common data stores Views, queries Account Customer Product External data feeds Shared Data Product 1 Product 2 Product 3 Product 4 Other Authenticate Fraud Detection Application Architecture

Fraud-Detection Framework Red Flag 1.Review; rules/score 2.Stop or 3.Verify transaction and user Enterprise Site App. AApp. B User Profiles Behavior Profiles BrowserPhone ATM Transaction Profile –Device &/or –Location &/or –Behavior Authenticate Location Profiles POS

Select the Right Monitoring System Network Activity – User System Activity – Privileged User Database Activity – Privileged User File Access Database Activity Application Activity SIEMNBADAMCMF Fraud Detection

Recommendation: Develop a Proactive and Layered Monitoring “System” Use Database Activity Monitoring (DAM) to monitor database administration activity and database user access, especially when native database auditing is not enabled. Use Content Monitoring and Filtering (CMF) to detect and prevent the inappropriate movement of sensitive data across the network — when well-defined data formats are present. Use fraud detection to monitor or stop suspect user activity at the access or transaction layer, within supported applications. Use Network Behavior Analysis (NBA) to monitor network traffic flows between applications and to discover anomalous traffic and associate it with a specific user. Use Security Information and Event Monitoring (SIEM) to monitor, correlate and analyze user activity across a wide range of systems and applications.

Notes accompany this presentation. Please select Notes Page view. These materials can be reproduced only with written approval from Gartner. Such approvals must be requested via Gartner is a registered trademark of Gartner, Inc. or its affiliates. Cyber Threat Preparedness Amos Auringer Gartner Executive Programs