Microsoft Belgium Security Summit Georges Ataya S olvay B usiness S chool, ISACA Belux Detlef Eckert Microsoft EMEA

Agenda Introduction How could you discuss security with the business people in your organisation? What security solutions can help to grow the business? What about security and Microsoft technology? Risk Assessment: How to calcuate the "economic impact" of a security incident? Conclusions: Isn’t it all about complexity?

Agenda Introduction How could you discuss security with the business people in your organisation? What security solutions can help to grow the business? What about security and Microsoft technology? Risk Assessment: How to calcuate the "economic impact" of a security incident? Conclusions: Isn’t it all about complexity?

Introduction The Security of Inclusion “Enablement” The Security of Exclusion “Protection” Source: PricewaterhouseCoopers LLP

Challenge to meet conflicting requirements Security Availability Control Functionality Cost Finding the Right Balance

Agenda Introduction How could you discuss security with the business people in your organisation? What security solutions can help to grow the business? What about security and Microsoft technology? Risk Assessment: How to calcuate the "economic impact" of a security incident? Conclusions: Isn’t it all about complexity?

Management responsibility Security Objectives: Source : “IT Security Governance”, the IT Governance Institute (ITGI.org) “Protecting the interests of those relying on information, Business and the systems and communications that deliver the information, Assets from harm resulting from failures of availability, confidentiality and integrity.” risks

Security management activity Policy Development Roles and Responsibilities DesignImplementationMonitoring Awareness, Training and Education Source : the International Guidelines for Managing Risk of Information and Communications Statement #1: Managing Security of Information, issued by the International Federation of Accountants

Business enablers New technology provides the potential for dramatically enhanced business performance, Information security can add real value to the organization by contributing to: interaction with trading partners, closer customer relationships, improved competitive advantage and protected reputation. It can also enable new and easier ways to process electronic transactions and generate trust.

Security Enabled Business Reduce Security Risk Assess the environment Improve isolation & resiliency Develop and implement controls Increase Business Value Connect with customers Integrate with partners Empower employees Risk Level Impact to Business Probability of Attack ROI Connected Productive

Agenda Introduction How could you discuss security with the business people in your organisation? What security solutions can help to grow the business? What about security and Microsoft technology? Risk Assessment: How to calcuate the "economic impact" of a security incident? Conclusions: Isn’t it all about complexity?

Business Challenges Requiring Security Solutions eCommerce Electronic Contract Signing Electronic Contract Signing Non-Repudiation Non-Repudiation Digital Rights Management Digital Rights Management Compliance with Regulation Basel II Basel II Data Protection Regulation Data Protection Regulation E-Commerce Regulation (eSignature, eProcurment, eInvoice, …) E-Commerce Regulation (eSignature, eProcurment, eInvoice, …) Collaboration & Communication Confidentiality Confidentiality Authentication Authentication Availability Availability Secure Extranet Secure Extranet Mobile Workforce Remote Access, VPN Remote Access, VPN Wireless LAN Wireless LAN Protect Laptop Protect Laptop Single-Sign-On Single-Sign-On

Agenda Introduction How could you discuss security with the business people in your organisation? What security solutions can help to grow the business? What about security and Microsoft technology? Risk Assessment: How to calcuate the "economic impact" of a security incident? Conclusions: Isn’t it all about complexity?

What about security and Microsoft technology? How much to trust any technology, any business process and operations? Need for adequate risk management process Risk mitigation projects to be championed by management What is Microsoft’s track record in security and what are its perspectives Analyze how those could impact own critical business?

36 Days after availability Number of Bulletins 6 “Critical” & “Important” Security Bulletins Quality & Engineering Excellence

Common Criteria Certification Microsoft will certify all eligible products Stable Protection Profile available Demonstrated customer need Window Server 2000, Windows 2000 & Windows 2000 Certificate Server Certified EAL4+ ISA Certified EAL2 Windows Server 2003, Windows XP, ISA 2004 In evaluation SQL Server, Exchange In planning

Agenda Introduction How could you discuss security with the business people in your organisation? What security solutions can help to grow the business? What about security and Microsoft technology? Risk Assessment: How to calcuate the "economic impact" of a security incident? Conclusions: Isn’t it all about complexity?

Components of Risk Assessment AssetThreat Impact VulnerabilityMitigation Probability + + = = What are you trying to assess? What are you afraid of happening? What is the impact to the business? How could the threat occur? What is currently reducing the risk? How likely is the threat given the controls? Current Level of Risk What is the probability that the threat will overcome controls to successfully exploit the vulnerability and affect the asset? Operating Principles Mission and Vision Risk Based Decision Model Tactical Prioritization

“Economic impact" of a security incident? Business not a professional exercise Related to asset identification and valuation Impact should include various cost elements Loss of opportunity Reputation impact Replacement costs The value of integrity availability and confidentiality of information

Agenda Introduction How could you discuss security with the business people in your organisation? What security solutions can help to grow the business? What about security and Microsoft technology? Risk Assessment: How to calcuate the "economic impact" of a security incident? Conclusions: Isn’t it all about complexity?

A complexity issue Continuous complexity of systems, processes and number of involved stakeholders Stakeholders include business decision makers (BDM) Alignment is required between TDB and BDN on: Security requirements driven by enterprise requirements Security solutions fit for enterprise processes Investment in information security aligned with the enterprise strategy and agreed-upon risk profile

Resources General Consumers Security Guidance Center Tools How Microsoft IT Secures Microsoft E-Learning Clinics Events and Webcasts

Security Mobilization Initiative Security = People, Processes & Technology Training & Offerings Security Partners CTEC’s Microsoft Events Tools Security Guidance Kit

Next Events TechNet Evening: Application & Data Security 17, 18, 19 May Active Directory Security June 3 rd John Craddock MSDN Evening Chapter June 3 rd SharePoint Development TechNet Evening: Advanced Client & Server Security 22, 23, 24 June