® ® CLS and the CLS Logo are registered trademarks of CLS UK Intermediate Holdings Ltd © 2014 CLS UK Intermediate Holdings Ltd. Growing Challenges in Cyber Security AIBA Quarterly Meeting September 9, 2014

2 » Technology » Actors & Motivations » Regulatory Challenges » Industry Challenges Topics

Challenge 1: Technology » Offensive and Defensive security technologies continue to evolve at a blistering pace. » The hot tools of even just 1 or 2 years ago are as dated as your teenager’s favorite band from a year or two ago » Offensive technologies can have a faster deployment cycle than defensive technologies, especially for larger organizations that have a lot of work required for engineering and deployment » Trenches and Machine-guns » Much more investment going in to offensive technology research due to a change in the main threat actors » No private entity has put a man on the moon… » Examples that would have seemed like Hollywood Sci-Fi not so long ago… » Stuxnet » Major Retailers 3

Challenge 2: Actors & Motivations » Financial – Retail bank fraud, Treasury Accounts, ID Theft » Crime syndicates » Complex value chain » Combination of low and high tech techniques » Ideological – Denial of Service, Data Theft, Vandalism » Political: “Anonymous”, Izz ad-Din al-Qassam Cyber Fighters, Wikileaks » Personal: Disgruntled employee » Industrial Espionage – Data Theft » Defense technologies » Manufacturing » Strategies » Nation-State Sponsored – Data Theft, Denial of Service » S. Korean Banking Outages » Stuxnet » NASA? » Fun and Games – Vandalism, Data Theft, Data Manipulation » Lulzsec 4

Challenge 3: Regulatory Challenges » Regulations continue to evolve as the threats evolve » This means that regulated entities need to ensure that their security strategies and delivery roadmaps satisfy defensive needs AND regulatory requirements » The only way to do this is to include regulatory considerations while creating/refreshing your strategy » How can we do that if the we don’t know what the future regulatory requirements will be? » Don’t we…? » Look to the sources of guidance » NIST cyber-security framework » Industry standards that have been referenced » Remain agile and flexible! 5

Challenge 4: Legal Landscape » Evolving case law » Choice Escrow – found responsible for a $400k ATO loss in 2010 » PATCO Construction – Bank found responsible for $580k ATO loss in 2009 » Jurisdictional differences » Example: Breach notifications standards by state CA SB1386 MASS 201CMR17 » International Differences Privacy laws, e.g. UK Data Protection Act » Liability concerns » Questions over offensive operations 6

Challenge 5: Industry Challenges » Information sharing » The airline pricing game…you first! » Liability » Reputational risk » Collaboration mechanism » Law Enforcement » How to collaborate » Laying the groundwork ahead of time » Internal » Socializing the role of security internally in your organization » Awareness amongst management & Board » Response preparedness 7

8