1. National Cyber Security
Awareness Month

2. Who We Are Special Guest Zac Abdulkadir - CISSP, CISM, CRISC
President / CISO
Bert Goodrich
Vice President - Sales
Special Guest
Mike Wylie - MBA, CISSP
Director, Cybersecurity Services
Richey May Technology Solutions
Tony Lewis
Technical Account Manager
Senior Engineer
Andy Nolan
SOC Manager

4. Tony Lewis – CIS Controls Basic CIS Controls
Inventory and Control of Hardware Assets
Inventory and Control of Software Assets
Continuous Vulnerability Management
Controlled Use of Administrative Privileges
Secure Configuration for Hardware and Software on Mobile Devices, Laptops, Workstations and Servers
Maintenance, Monitoring and Analysis of Audit Logs

5. Tony Lewis – CIS Controls Foundational CIS Controls
and Web Browser Protections
Malware Defenses
Limitation and Control of Network Ports, Protocols and Services
Data Recovery Capabilities
Secure Configuration for Network Devices, such as Firewalls, Routers and Switches
Boundary Defense
Data Protection
Controlled Access Based on the Need to Know
Wireless Access Control
Account Monitoring and Control

6. Tony Lewis – CIS Controls Organizational CIS Controls
Implement a Security Awareness and Training Program
Application Software Security
Incident Response and Management
Penetration Tests and Red Team Exercises

8. Andy Nolan – Incident Response Incident Response Stats
206 days, on average, to detect a data breach. (Ponemon, 2017)
66 days, on average, to fully contain a data breach. (Verizon, 2017)

9. Andy Nolan – Incident Response Something something
Preparation and planning in advance
Identification of true security incidents
Containment of threats to minimize impact
Eradication of threats at their origin
Recovery of systems, applications and data
Analysis of the incident for process improvement

10. Andy Nolan – Incident Response
Storytime – The Bad, and Ugly

11. Andy Nolan – Incident Response
Storytime – The Good!

13. Michael Wylie, MBA, CISSP 2018
Penetration Testing
Michael Wylie, MBA, CISSP
2018

14. About me: Mike Wylie, MBA, CISSP Director, Cybersecurity Services
Richey may Technology Solutions
Additional
CEH
CEI
Project +
Security +
Certifications
CCNA R&S
CCNA CyberOps
Pentest +
CHPA

15. About Richey May Technology Solutions
Richey May Technology Solutions is a results-driven consulting firm offering the full spectrum of technology solutions for your business. Led by technology experts with decades of cumulative experience in executive IT roles, our team is able to bring you pragmatic, real-world solutions that deliver value to your business.
Cybersecurity
Cloud Services
Governance, Risk, Compliance & Privacy
Technology Management Consulting
Marketing Technology

16. Information Security Statistics
62% of cyber incidents are Small-Mid businesses (Verizon, 2013)
SMBs saw a 14% increase in cyber attacks from prior years (SEC, 2018)
“Cybercrime Represents a Very Real, and Very Serious Threat to SMBs” (SEC, 2018)

17. What is Penetration Testing?
Ethical hacking with client authorization
Using hacking tactics, techniques, and procedures for good
Systematic testing of security controls
Attempt to gain access to critical data

18. How Will Pen Testing Benefit Customers?
Exposes weaknesses before hackers do
Required by several regulatory organizations
- PCI-DSS - FISMA
- SOX - NYDFS.NYCRR.500
- HIPAA - GLBA
Actionable items to remediate
Better value over vulnerability scans
Far less expensive than a breach

19. How Will Pen-Testing Benefit MSPs?
Hundreds of vulnerabilities that need to be fixed
Someone has to do the remediation work
A breach would get you fired
Customer sees you as proactive
Learn to implement better security
Increased IT & security budget

20. Pen Test Budget It depends on multiple factors Options:
Vulnerability scan ($)
Security assessment ($$)
White box test ($$)
Grey box test ($$)
Black box test ($$$)
Red Team engagement ($$$$)

21. Make Sure You’re Getting a Good Test
Everyone does “security” now
Balance between technical and business skills
Clearly define a “penetration test”
Discuss the scope, goals, and deliverable
Understand what a penetration is not
You get what you pay for

22. Thank You! Michael Wylie

24. Thank you for attending!
For further information, please contact
Bert Goodrich
Vice President of Sales
(Direct Line)
Cyber Security Services
Network Design
Cloud Solutions
Business Continuity
Project Management
Infrastructure Monitoring