1. Albany Bank Corporation Security Incident Management Program

2. CONSULTANTS Taurus Allen Destiny Dyer Marta Pelyo Daniel Post Michele Reina Robert Warshauer 2

3. PROJECT OBJECTIVES 1.Create an effective security incident management program 2.Compliance with regulatory and industry standards 3.Identifying potential vendors 4.Implementation of roadmap 3

4. AGENDA Project Approach Bank Profile Purpose of Security Incident Management Program Industry Regulations and Standards Explanation of Proposed Program Workflow Vendor Recommendations Roadmap 4

5. PROJECT APPROACH 5 Objective: To assist ABC with creating and recommending a security incident management program. Research of Current Events, Weekly Status Report, Project Timeline, Peer Evaluations Phase 1 Planning and Content Research Phase 2 Content Development and Recommendations Phase 3 Final Presentation and Preparation

6. BANK PROFILE 6 Overview: 20 th largest bank in the United States Specializes in commercial, retail, investment banking Holds $50 billion of assets Problems Facing Albany Bank Corporation: Well known hacking group breached security records Approximately 20 million customer records compromised ABC did not have formal incident security program in place Reputational and financial losses

7. RECENT BREACHES These breaches occurred due to lack of: Adequate cyber security Detailed incident response procedures Efficient detection/analysis and containment strategies 7

8. SECURITY INCIDENT MANAGEMENT OBJECTIVE Process of monitoring and detecting threats to a network Encompasses integrating IT management systems Identifies and prioritizes incidents based on business impact Used to protect confidential data 8 NIST Cybersecurity Framework

9. INDUSTRY REGULATIONS: FFIEC Purpose: To develop and ensure uniformity of report forms, standards, and principles for financial institutions Incident Management Requirements: Periodic risk assessments Layered security controls Member awareness and education Ad-Hoc activity monitoring Defined escalation protocols 9

10. INDUSTRY STANDARDS: ISO 27001-27002 10 Purpose: To provide a model for Information Security Management System Incident Management Requirements: Management of information security risks Develop criteria for accepting risks and identifying level of risks Identify and evaluate options for treatment of risks Implement training and awareness programs

11. INDUSTRY STANDARDS: NIST 800-61 REV 2 Purpose: Computer Security Incident Handling Guide Incident Management Requirements: Procedure for performing incident handling and communication Incorporation of response teams in incident handling process Reduce frequency of incidents 11

12. INCIDENT RESPONSE LIFECYCLE 12 Steps: Preparation Detection Analysis/Classification Containment Eradication/Recovery Post-Incident Activity

13. INCIDENT RESPONSE LIFECYCLE: PREPARATION 13 Checklist to ensure that all pivotal functions and procedures of incident response program are being performed

14. INCIDENT RESPONSE LIFECYCLE: PREPARATION Establish escalation procedures and response teams Improve educational awareness Training sessions Document procedure checklist Implement a playbook system Install malware protection software Create a simulated attack program to test response teams 14

15. INCIDENT RESPONSE LIFECYCLE: DETECTION 15 C03 automated system Report incident: Ticketing System Open Ticket Here Triage Incident Significance of the constituency Experience of the incident reporter Severity of the incident

16. INCIDENT RESPONSE LIFECYCLE: ANALYSIS/CLASSIFICATION 16 Financial RangesUsers Critical Loss of more than $5 Million Affects 76%-100% High Loss between $3 – 5 Million Affects 51%-75% Medium Loss between $1 – 3 Million Affects 25%-50% Low Loss of less than $1 Million Affects 0-24% Impact: Measures the effect of an incident on the company

17. 17 Core Business Operations Critical Interferes with core business functions or loss of critical data High Interferes with non-core activities or functions that do not affect the entire company Medium Interferes with normal completion of work or tasks that are more difficult but not impossible to complete Low Interferes with non-business related use Urgency: Measures the effect an incident has on the core business functions INCIDENT RESPONSE LIFECYCLE: ANALYSIS/CLASSIFICATION

18. Incident PriorityTimeframe Critical Action within 1 hour Resolution within 1 day High Action within 2 hours Resolution within 2 days Medium Action within 1 day Resolution within 5 days Low Action within 2 days Resolution within 7 days 18 Response and Resolution Time for Incidents:

19. INCIDENT RESPONSE LIFECYCLE: ANALYSIS/CLASSIFICATION 19 Incident Classification Matrix Impact Matrix Key CriticalRed HighBlack MediumGray LowWhite

20. INCIDENT RESPONSE WORKFLOW 20

21. 21

22. INCIDENT RESPONSE LIFECYCLE: DETECTION/ANALYSIS 22 Detection / Analysis Checklist:

23. INCIDENT RESPONSE LIFECYCLE: CONTAINMENT 23 Sandbox method: Threat quarantined, assessed and monitored Freeze assets threatened Suspend network services Protect the chain of custody

24. INCIDENT RESPONSE LIFECYCLE: ERADICATION/RECOVERY 24 Checklist What information is recoverable What information is permanently lost Timeline of recovery Restore systems Change passwords Tighten network Replace compromised files Install patches

25. INCIDENT RESPONSE LIFECYCLE: ERADICATION/RECOVERY 25 Eradication/Recovery Checklist:

26. INCIDENT RESPONSE LIFECYCLE: POST-INCIDENT 26 Perpetual loop of improvement: Improve technology Follow up report Lessons learned meeting Trend analysis team Communicate incidents to affected users Post-Incident Checklist

27. 27 IDENTIFYING POTENTIAL VENDORS Vendor Checklist

28. IDENTIFYING POTENTIAL VENDORS 28

29. IDENTIFYING POTENTIAL VENDORS 29 Ticketing system Compliance of Security Incident Response Cycle Risk assessment Auditing Employee training Single user sign on Workflow Matrix Automatic response system Advanced layered security Risk management Compliance Major Solutions Offered:

30. SECURITY MANAGEMENT PROGRAM: ROADMAP 30 0-3 Months Preparation Step I 3-6 Months Implementation Step II 6-18 Months Finalization Step III

31. PHASE ONE: 0-3 MONTHS 31 Research of regulation and standards Finalize business function requirements Implement response teams: red, black, gray, and white Perform vendor selection Effective escalation process (via use of teams) Manual management for short term security incident response program

32. PHASE TWO: 3-6 MONTHS 32 Implement the selected vendor tools Implement the workflow Implement the tool for manual Define and document incident response plans Implement incident management and ticketing system Continuous management of any security incident

33. PHASE THREE: 6-18 MONTHS 33 Perform security response testing/training Initiate a communication plan for security incident management program for internal/external stakeholders Meets legal and regulatory tandards Employee education and training Customer awareness Vendor training: Roles and responsibilities Trend analysis capability

34. MEASURE OF SUCCESS 34 How fast was incident contained? How quickly did Albany Bank Corporation recover from the incident? How well did Albany Bank Corporation mitigate their losses? How effective was Albany Bank Corporation’s communication of incident?

35. Initiate Incident Response Program Quarterly assessment of risks Annual testing of response teams and procedures 35 We guarantee to help “Chase Risk Away” NEXT STEP RECOMMENDATIONS