1. Threat Assessment in a Logical Environment

2. 1865 U.S. Financial Infrastructure Physical to Logical environment Protection and Threat Assessment Safe School Initiative Modifying Threat Assessment Process

3. “No Silver Bullet”

4. Assessment starts with understanding Assets Company, System, Personnel, Product Where is the value loss? –Employees –Assets (what pays the check…?) –Clients –Company value Stock Share holders

5. Where are assets located, Who is responsible, Do the assets have known value or just perceived value? Physical assets, Logical Assets, both…. –Today modern companies value: intangible assets, intellectual property, sensitive information, client data, trademarks, copyrights, research and development, software applications, internal policies and procedures, human capital (who does what), customer data, vendor data, strategies (how you do what you do).

6. Where do you start? Historically what has triggered issues / concerns / panic … –Hacks, network intrusions, insider threat? –Dynamics of a “Secure Perimeter” Is it possible in a logical environment? “Circle the wagons” –“Spherical Approach / All encompassing”

7. Federal Trade Commission In the past year, 106 personal data losses were reported by companies and federal and state government totaling some 108 million identities. DATA SECURITY BREACHES – Technology, Job responsibilities, poor security practices.

8. Crises or Emergency ? Every crises is an emergency Every emergency is not a crises Know the difference Who determines the difference –Are you ready?

9. What Is a Threat? emergency? accident? external? self inflicted (disgruntled employee)? Time necessary to resolve? (Desk top exercise / practice, practice, practice) Plan of action …Triage.. keep the company going ….

10. Understand the damage Different plans for different problems Advance effort = fewer problems –Prepare a plan Practice plan Back up systems necessary to implement plan –Are they on company line? –How many people know the plan? –Who is accountable – let them do what they are paid to do!!!!!! –One voice to the media!!!!!!!!!!!!

11. Conduct a robust advance The tools / personnel necessary to do the job. Who, what, where, when, why, how –( Testing within the product (Plan ) development cycle) Keep out of the way of your Crises Manager “Chief Preparedness Officer (CPO)” Effective Disaster recovery …..

12. How long will the threat last? Infrastructures physical and / or logical Is it short term (real time)? Is it long term (domino effect)? Can the Chief Preparedness Officer tell? MAKE THE DECISION !!!!!!

13. Long term threat Company loss –Product Industrial espionage Intellectual property Production cycle Vital employee Building

14. Protect everything Company –Data storage –Access accountability Who has access? Employees –Workers –Executives –Co – company participants

15. When is the crises over? Implement (advance) security plan What was the goal that confirms the threat is resolved? Anything that doesn't kill you makes you stronger …. Get ready “ You will soon be surrounded by arm chair quarterbacks”.

16. Dealing with threat 1.Is it a threat 2.Which threat plan to implement 3.Let the plan manager work 4.Evaluate the progress / shift focus 5.Attain the resolution goal … get it fixed ! 6.Did the plan work? 7.How could the threat have been avoided 8.Reward and Recognize the effort

17. Questions, Comments, Observations Edwin (Eddie) Lugo U.S. Secret Service Baltimore, Maryland Edwin.Lugo@usss.dhs.gov Secret Service Web Site www.secretservice.gov/