i need 4000 words in exactly 4 hours will pay 150 no down payment
reemh
isys_2394_-_sem_2_2014_-_security.ppt
ISYS 2394 Business Globalisation and Business IT
Security in a Global Environment
Barry Cook
*
Index
*
Security in a Global Environment
Introduction
Introduction
My Background
Disclaimer
Security in a Globalised Environment
Impact of Data Breaches
Largest Data Breaches of All Time
Security Threat Basics
Emerging IT Trends Security Considerations
Defences and Best Practices
Summary
Security in a Global Environment
*
Introduction
- The objective of today is to:
Provide you an overview of the current major security threats, risks and impacts to individuals and businesses, in our globalised world
Provide you some high level best practices and defences to address security threats and risks
Get you to starting to think about security as an integral part of your development plans
- Today
Part 1: Lecture and Questions
Part 2: Practical Activity with 3 Minute Presentation Per Group
*
Security in a Global Environment
Security in a Global Environment
*
My Background
- Current Role:
J6, Defence Command Support Training Centre (DCSTC)
J = Joint (Army, Navy, Air Force),
6 = Communication Information Systems (CIS)
- Experience
National Security Focus
- Department of Defence & Federal Attorney-General’s Department
Management / IT Consultancy
- Current Research Interests
Cyber-Security & Cyber-Warfare
*
Security in a Global Environment
Security in a Global Environment
*
Disclaimer
Everything you hear today is based on material available in the public domain.
Nothing Specific, Unique or Classified to the Department of Defence, Australian Government or our Allies will be discussed or referenced.
*
Security in a Global Environment
Security in a Global Environment
*
Security in a Globalised Environment
- Technology has opened up Global Opportunities and Markets
- It has also lead to a significant increase in the Security Threats to Individuals and Businesses
Mobile Devices estimated to reach 10 Billion by 20161
Accumulated Digital Data to grow to 8 Zettabytes by 20152
- Distributed nature of the threats, makes it difficult for Law Enforcement to address root causes.
Threat often occur from multiple sovereignties each with differing laws and jurisdictional processes
You can’t just block all the traffic, as it is often mixed in with legitimate traffic
*
Security in a Global Environment
Source: 1. Cisco
2. IDC Worldwide Big Data Technology and Service 2012-2015 Forecast
Security in a Global Environment
*
Impact of Data Breaches
- Loss of Customer Confidence and Loss of Customers
- Loss of Competitive Advantage
- Fraud
- Fines
- Cost of Data Breaches on Business1
$188 per record stolen in 2013
- Cost of Identify Theft on Individuals2
Average Cost of $4,841 per person
Average Time to Repair Damage caused by Identify Theft is 330 Hours
*
Security in a Global Environment
Source: 1. 2013 Cost of Data Breach Study, Ponemon Institute
2. Identify Theft Resource Centre
Average Total Organisation Cost of Data Breach
for Large Business1
Security in a Global Environment
*
Largest Data Breaches of All Time
*
Security in a Global Environment
Source: 1. Nathan Yau, http://flowingdata.com
Security in a Global Environment
*
Index
*
Security in a Global Environment
Introduction
Security Threat Basics
Emerging IT Trends Security Considerations
Defences and Best Practices
Summary
Threat Motives
Threat Actors
Threat Vectors
Technical Threats
Non-Technical Threats
Security in a Global Environment
*
Threats Motives
- Financial Gain
- Competitive Advantage
- Disruption
- Political Advantage / Hacktivism
- Disobedience / Protest
- Showing Off / “THE CHALLENGE”
*
Security in a Global Environment
Security in a Global Environment
*
Threats Actors
- Organised Crime
Financial Gain
- State Sponsored / Foreign Government
Espionage, Disruption
- Terrorist Groups
Financial Gain, Disruption
- Individuals
Internal – Disgruntled Employee, Curious Insider, Ignorance
Outsider – Hackers, “Script Kiddies”, Competitors
*
Security in a Global Environment
Security in a Global Environment
*
Threats Vectors
- Web – Fake Sites
- Email – Attachments, Links
- Unsecure Devices – Wireless Hotspots, Physical Devices
- Removable Media (USB Thumb Drives)
- Social Media
- Social Engineering
*
Security in a Global Environment
Source: 1. Symantec Intelligence Report for Feb 2014
1
Security in a Global Environment
*
Technical Threats - Phishing
- Phishing
Fake Website designed to look like real one to obtain privilege information
Generic in Nature
Email / Social Networking Attack Vector
- Spear Phishing
Targets Individuals based on already known information about the target
May appear to come from a trusted source
*
Security in a Global Environment
Source: 1. Symantec Intelligence Report for Feb 2014
In Dec 2013, it was estimated 1 in every 1,053 emails was a Phishing attempt.1
Security in a Global Environment
*
Technical Threats - Malware
- Trojans
- Viruses
- Spyware
- Adware
- Worms
- Scareware
- Botnets
- Software Keyloggers
*
Security in a Global Environment
Source: 1. PandaLabs Annual Report 2013 Summary
2. Symantec Intelligence Report for Feb 2014
In Dec 13, it was estimated 1 in every 164 emails contained Malware2
1
Security in a Global Environment
*
Technical Threats - Hardware Keyloggers
*
Security in a Global Environment
Security in a Global Environment
*
Technical Threats – Zero-Day Attacks
- Zero-Day Attacks
Attacks that exploits a security vulnerability on the day or even before it becomes generally known
Type of Advanced Persistent Threat (APT)
- Famous Examples
Attack on Google in 2009 as a result of a Internet Explorer Zero-Day Flaw.
HEART BLEED OpenSSL Vulnerability
*
Security in a Global Environment
Source: 1. Symantec Elderwood Project
1
Security in a Global Environment
*
Technical Threats - Heartbleed Bug
*
Security in a Global Environment
Source: 1. LWG Consulting
1
Security in a Global Environment
*
Non Technical Threats – Passwords
- Poor Passwords
Lack Length and Complexity
Hard to Remember so written down
- Password Lengths
Any Password < 5 Characters can be cracked in 5 seconds
Any Password < 7 Characters can be cracked within 1 day
Even 8 Character Passwords with some complexity can be cracked in a few months
*
Security in a Global Environment
Security in a Global Environment
*
Non Technical Threats – Other
- Physical Security
Lack of Protection of Sensitive and Critical ICT Assets
Includes End User Device Protection when Mobile
- Improper Destruction
Paper and Electronic Assets
- Insufficient Backup and Recovery
Risk to Data Survivability and Integrity
- Inadequate Staff Identification Processes
Susceptibility to Social Engineering Attack Vector
*
Security in a Global Environment
Security in a Global Environment
*
Index
*
Security in a Global Environment
Introduction
Security Threat Basics
Emerging IT Trends Security Considerations
Defences and Best Practices
Summary
Cloud Computing
BYOD
Mobile Devices
Big Data
Security in a Global Environment
*
Cloud Computing
- What about my Data
Where is My Data stored?
Who has access to My Data?
- Data Segregation
How well is my Data Segregated from others Cloud Clients?
- Recovery
What are my Recovery Options?
- Compliance Requirements
Can I guarantee they are achieved if I don’t control the infrastructure?
*
Security in a Global Environment
Security in a Global Environment
*
Bring Your Own Device (BYOD)
- All Devices or Only Some?
What about Patching and Updates?
How will you deploy applications to all the devices?
- Data Ownership
What happens when the employee leaves?
- Device Loss or Theft
How do you maintain control?
What about User Rights?
*
Security in a Global Environment
Security in a Global Environment
*
Mobile Devices
- Mobile Devices are just as susceptible to threats
Malware
Bluesnarfing
Phone Hacking
Browser Security Issues
*
Security in a Global Environment
Source: 1. F-secure Mobile Threat Report Q1 2014
Mobile Device Malware Detected
Q1 20141
Security in a Global Environment
*
Index
*
Security in a Global Environment
Introduction
Security Basics
Emerging IT Trends Security Considerations
Defences and Best Practices
Summary
- Defence in Depth Cycle
- Layered Defence
- Security Measures
- Top 4 Mitigation Strategies
- Mobile / BYOD Security Control Framework
- Cloud Computer Security
Security in a Global Environment
*
Defence in Depth Cycle
- Context
Business Strategy in Play
- Risk Analysis
Identify Generic and Specific Risks to Business and its consequences
- Implement Defence in Depth
Employ a Multi-Layer Defence Strategy
- Review and Monitor
Ensure Defence Strategy is continuous reviewed and updated
*
Security in a Global Environment
AS43560 Risk Rating Levels
Source: 1. Trusted Information Sharing Network www.tisn.gov.au
Security in a Global Environment
*
Layered Defence
*
Security in a Global Environment
Source: 1. Trusted Information Sharing Network www.tisn.gov.au
Security in a Global Environment
*
Security Measures – Physical Security
- Secure Server Rooms
Restrict Access to only those that require and log/monitor access at all times
Keep Server Rooms neat and documented, so anomalies can be quickly detected
- Restrict Entry to Work Areas to only authorised personnel
- Secure Mobile Assets
In and Out of the Office
- Control Physical Assets that contain data and information at all times
From Creation to Destruction
*
Security in a Global Environment
Security in a Global Environment
*
Security Measures – Device Security
- Patch Operating System and Applications consistently and quickly.
Setup an Automatic Mechanism to update
- Install Suitable Security Software
Should include Anti-virus, Firewall, Anti-Spam, Anti-Malware, Web Site Threat Checker
Needs to check for updates multiple times per day
- Encrypt Data on Portable Devices
- Restrict Application Installation/Usage to Only Authorised Applications
- Disable Auto Run / Auto Load of Removal Media
*
Security in a Global Environment
Security in a Global Environment
*
Security Measures – Network/System Security
- Apply Multiple Levels of Network Defence
Firewalls / Routers / Gateways
Intrusion Detection Systems
- Monitor Network Continuously and Quickly Act to Protect
Know what devices are on your network at all times and what they are doing
- Apply comprehensive Access Controls to Data
Consider Multi-Factor Authentication such as Tokens, Smart Cards or Biometrics
Remove Access immediately upon personnel change (Staff Departure, Role Change)
- Implement Robust Change Management and Application Development SDLC Processes
*
Security in a Global Environment
Security in a Global Environment
*
Security Measures – User Security
- Security Awareness Training
Threat and Consequence Awareness Training
Anti-Phishing and Anti-Social Engineering Training
What to do if a “Breach” occurs
- Suitable Password
At least 10 Characters with mixture of Upper & Lower Case, Numbers and Special Characters.
However, the longer the password length the less complex it has to be.
Use different passwords for different types of systems. E.g. Social Media, Banking
Change Passwords Regularly
Don’t Share Passwords
*
Security in a Global Environment
Security in a Global Environment
*
Top 4 Mitigation Strategies
*
Security in a Global Environment
Source: 1. DSD Top 35 Strategies to Mitigate Targeted Cyber Intrusions
1
| Mitigation Strategy Effectiveness Ranking | Mitigation Strategy | Designed to Prevent or Detect an Intrusion | User Resistance | Upfront Cost | Maintenance Cost |
| 1 | Patch applications e.g. PDF viewer, Flash Player, Microsoft Office and Java. Patch or mitigate within two days for high risk vulnerabilities. Use the latest version of applications. | Prevent | Low | High | High |
| 2 | Patch operating system vulnerabilities. Patch or mitigate within two days for high risk vulnerabilities. Use the latest operating system version. | Prevent | Low | Medium | Medium |
| 3 | Minimise the number of users with domain or local administrative privileges. Such users should use a separate unprivileged account for email and web browsing. | Prevent | Medium | Medium | Low |
| 4 | Application whitelisting to help prevent malicious software and other unapproved programs from running e.g. by using Microsoft Software Restriction Policies or AppLocker. | Both | Medium | High | Medium |
Security in a Global Environment
*
Mobile / BYOD Security Control Framework
*
Security in a Global Environment
Source: 1. Trusted Information Sharing Network www.tisn.gov.au
1
| Security Controls | Preventive | Detective | Corrective |
| Access Control | Enforce strong passwords Use two-factor authentication | Extend existing auditing and monitoring controls around mobile device connections | Conduct regular reviews of devices connecting to corporate network |
| Data Protection | Encrypt business data Limit the sensitive data transferred to mobile devices, or implement least privilege access Implement remote device management Enable device-lockout function when the device is not in use | Perform technical security assessments on mobile devices and supporting infrastructure with emphasis on data stored on devices Monitor access and usage of high-risk data to identify potentially inappropriate usage | Implement appropriate measures to eliminate or reduce the risk impact - either by enhancements in technology or by updating the policies/procedures |
| Application Security | Allow only certified business applications | Regularly monitor installed applications to identify risks to corporate data | Remove applications identified to be untrustworthy or malicious |
| Fundamental Controls | Install anti malware software Install and manage personal firewall to permit only authorised traffic | Regularly monitor compliance reports Setup alerts to identify changes | Eradicate and/or repair any devices identified to be non-complaint from company defined policy |
| Governance and Compliance | Include mobile security into the organisations risk management program Add mobile security awareness to existing employee awareness programs Implement mobile device policies and include them in them in the Acceptable Use Policies | Add mobile devices in the organisations audit program Monitor and maintain logs of mobile device interactions with corporate network | Address and mitigate any non-compliance Incorporate mobile devices into incident response plan Regularly review mobile device acquisition and usage |
Security in a Global Environment
*
Cloud Computing Security
- Fully Understand the Cloud Providers Environment
Service Levels
Where you Data will be stored.
Access rights to Government under local laws where that data will be stored
Data Transfer Options should you want to move to another provider
Data Retention Periods
- Encrypt your Data
Particularly for Sensitive Data
Should be Independent of Current Cloud Provider
*
Security in a Global Environment
Security in a Global Environment
*
Index
*
Security in a Global Environment
Introduction
Security Basics
Emerging IT Trends Security Considerations
Defences and Best Practices
Summary
Key Points
Additional Resources
Security in a Global Environment
*
Key Points
- Understand the Threats and Consequences
General threats and those specific to your business
- Factor Security into your Development Plans
Engage with your Security Experts
- Patch your Operating Systems and Applications regularly
- Deploy and Maintain Security Software on your Devices
- Secure your Physical and Information Assets
- Regularly conduct Security Awareness Training
*
Security in a Global Environment
Security in a Global Environment
*
*
Security in a Global Environment
Security in a Global Environment
*
Additional Reading / Support
- Australian Signals Directorate http://www.asd.gov.au/publications/index.htm
- Trusted Information Sharing Network http://www.tisn.gov.au/Pages/default.aspx
- US-CERT http://www.us-cert.gov
- Symantec Intelligence Report http://www.symantec.com/theme.jsp?themeid=state_of_spam
- SANS Security
http://www.sans.org/reading_room/whitepapers/bestprac http://www.sans.org/tip_of_the_day.php
- Anti-Phishing Working Group http://www.antiphishing.org/
*
Security in a Global Environment
Security in a Global Environment
*
