1. NYBA 2017 Technology, Compliance &
CIS Top 20
NYBA 2017 Technology, Compliance & 
Risk Management Forum 

2. INTRODUCTIONS Derek Boczenowski Nick Hnatiw
Sr. IT Security Analyst for Compass IT Compliance, performing audits and risk assessments for multiple verticals.
Prior to Compass, worked for a FI in Massachusetts in the IT department for 15 years.
Nick Hnatiw
Co-Founder and CEO of Loki Labs Inc., a managed security services provider located in NYC. Loki provides the LokiSOC, a scalable managed SOC platform as well as red team/pentest assessments.
Prior to Loki Labs, Nick worked for the US DoD facilitating offensive on-net operations and as a technical director that coordinated research for 10 years.

3. AGENDA
How are we doing?
Why the CIS Top 20?
The Top 20 

4. HOW ARE WE DOING?
Cybercrime damage to exceed $6,000,000,000,000 by 2021
68% of funds lost as a result of a cyber attack were declared unrecoverable *Ponemon Institute study
90% of large organisations reported suffering a security breach in 2015
Online banking fraud increases 48% year-on-year

5. HOW ARE WE DOING? 53% - external notification of breaches
47% - internal notifications of breaches
Source: Mandient M-Trends 2016

6. WHY THE CIS TOP 20?

7. If you did nothing, you would still be protected.
PRIORITIZED LIST
If you did nothing, you would still be protected.

8. RISK BASED
“[The CIS Top 20] map directly to the CSF core requirements and provide a realistic and community-driven risk management approach for making sure your security program will be both effective and efficient against real-world threats.”
Risk is a function of attack surface, vulnerability of the attack surface, and the impact it will have on business operations.

9. The focus of CIS Top 20 is consistent with other compliance standards:
COMPLIANCE IS NOT AN AFTERTHOUGHT
The focus of CIS Top 20 is consistent with other compliance standards:

10. COMMUNITY DRIVEN
Community of experts votes on changes
Anyone can apply to be a member

11. DYNAMIC
Re-ordered so that Controlled Use of Admin Privileges is higher (moved form 12 to 5)
Deletion of Control 19 – Secure Network Engineering 
New Control: 7 and Web Browser Protections
The top 4 controls have not changed: CIS still views these controls as their most important 

12. TOP 20 LIST 1. Inventory of Authorized and Unauthorized Devices
2. Inventory of Authorized and Unauthorized Software
3. Secure Configurations for Hardware and Software 
4. Continuous Vulnerability Assessment and Remediation 
5. Controlled Use of Administrative Privileges
6. Maintenance, Monitoring, and Analysis of Audit Logs
7. and Web Browser Protections
8. Malware Defenses
9. Limitation and Control of Network Ports
10. Data Recovery Capability

13. TOP 20 LIST 11. Secure Configurations for Network Devices
12. Boundary Defense
13. Data Protection
14. Controlled Access Based on the Need to Know
15. Wireless Access Control
16. Account Monitoring and Control
17. Security Skills Assessment and Appropriate Training to Fill Gaps
18. Application Software Security
I9. Incident Response and Management
20. Penetration Tests and Red Team Exercises

14. Admins have the keys to the network – protect the keys.
05 – CONTROLLED USE OF ADMIN PRIVLEDGES
Admins have the keys to the network – protect the keys.
Technical:
Limit User
Inventory/Monitor admin accounts

15. Malware is the vehicle of hackers. Technical:
08 – MALWARE DEFENSES
Malware is the vehicle of hackers. 
Technical:
AV/EDR, Firewalls, IPS/IDS

16. Your data is the treasure. Technical: Backup images and data
10 – DATA RECOVERY CAPABILITY
Your data is the treasure.
Technical:
Backup images and data

17. Users are the keys for hackers to get in. Technical:
16 – ACCOUNT MONITORING & CONTROL
Users are the keys for hackers to get in.
Technical:
Review all accounts
Disable unknown/unused accounts

18. Prior proper preparedness prevents piss poor performance!
19 – INCIDENT RESPONSE & MANAGEMENT
Hope is not a plan.
Technical:
The seven P’s:
Prior proper preparedness prevents piss poor performance!

19. Derek Boczenowski dboczenowski@compassitc.com
Questions?
Nick Hnatiw
Derek Boczenowski