1. Thomas Levy

2. Agenda 1.Aims: Reducing Cyber Risk 2.Information Risk Management 3.Secure Configuration 4.Network Security 5.Managing User Access 6.Education & Awareness 7.Incident Management 8.Malware Prevention 9.Monitoring 10.Removable Media 11.Mobile Working 12.Summary

3. Aims: Reducing Cyber Risk Identify Monitor Maintain

4. Information Risk Management Adopt a framework Determine baseline level of risk for organisation Regularly discuss risk at board meetings Treat risk as a lifecycle

5. Secure Configuration Implement hardware / software asset register Baseline security builds for all network components Daily updates / patches Regularly scan for vulnerabilities

6. Network Security Protect Monitor Test

7. Managing User Access Limit admin accounts Monitor & audit users Establish account management process

8. Education & Awareness User security policy Staff security induction Refresher training on security threats Formal assessment of staff knowledge

9. Incident Management Incident response Disaster recovery Senior manager approval

10. Malware Prevention Anti virus throughout organisation Regular malware scans Regularly update anti virus

11. Monitoring Systems Network traffic

12. Removable Media Policies Scanning Encryption Corporate v Personal

13. Mobile Working Policy Awareness Security Baselines

14. Information Assurance Cuboid

15. Summary Choose a security framework Create policies Monitor