1. Cybersecurity Trends for 2018
Greg Blake
Chief Information Officer
Idaho Housing and Finance Association

2. Governance, Risk, and Compliance (GRC)

3. Making a proper risk assessments is important

4. Cybersecurity Program
Develop and enterprise-wide data security governance program
Cybersecurity Program
It is the responsibility of every manger to know what assets are in use so they can manage the associated risks.
Average cost of Cybersecurity breach is $3.7 Million
A formal Cybersecurity program can reduce the cost of a breach $325K
Implementing a Cybersecurity program ranges from $50K - $300K
Annual Cybersecurity cost is $50K

5. Steps to implement a Cybersecurity Program

6. Cloud security should be your focus
Develop security guidelines for cloud vendors
Develop a cloud decision model
Create a robust vendor management program

7. We all have the same behavior patterns
Limbic region in the brain
“oh no” hands to their heads

8. Yeah! Raised their arms in celebration

9. CARTA – Continuous Adaptive Risk and Trust Assessment
Focus on protection to prevention
CARTA – Continuous Adaptive Risk and Trust Assessment
Deciding with certainty if an event is good or bad
Behavioral Firewall (Preempt)
Palo Alto
Fortinet
Checkpoint
CISCO
Juniper
Forcepoint
“All systems and devices must be considered potentially compromised and their behaviors continuously assessed for risk and trust.”
“Users once authenticated, are given just enough trust to complete the action being requested, and their behaviors are continuously verified and assessed for risk.”

10. UEBA – User behavior and advanced Analytics
Focus on protection to prevention
Balabit
Dtex
E8 Security
Exabeam
Forcepoint
Fortscale
Gurucul
Haystax Technology
HPE Niara
Interset
Microsoft
Palo Alto Networks
Preempt
RedOwl
Securonix
Splunk
Varonis
Veriato
ZoneFox
UEBA – User behavior and advanced Analytics
How UEBA solutions work
“UEBA solutions identify patterns in typical user behavior and then pinpoint anomalous activities that do not match those patterns and could correspond with security incidents.”

11. Software Development Lifecycle Changes
DevOps to DevSecOps
For its 2016 State of DevOps Report, Puppet Labs surveyed 4,600 technical professionals.
Three type of organization
High IT performers, which complete multiple deployments per day
Medium IT performers, which deploy between once a week to once a month
Low IT performers, which deploy once per month or less
Study found that high IT performers deploy 200 time more frequently than low IT performers. Their lead ties are 2,555 times faster

12. Software Development Lifecycle Changes
Implement an Agile Development Methodology
Add a security professional rol

13. Hack yourself first
Privacy is not real anymore – Assume your PII has been compromised
If a hackers want inside your system he will find a way
Find your vulnerabilities before the hacker does
Traditional way to attack cyber crime is outdated
Keep an eye our for future cyber crime strategies
Select the perfect team to do a penetration test

14. Test your defenses

15. Prince William at the Royal Air Force HQ
Prince William at a Royal Air Force Facility. Documentary was filmed and published online
This media photo was widely distributed before someone zoomed in on the posted notices above the Prince.

16. RAF hacked by a major security blunder
MilFlip is the UK Military Flight Information system. Not necessarily a top secret web site, but not for general public use either!