Joe Oleksak, Plante Moran
•
Data Security Trends
•
Example Attacks
•
Industry Examples
•
An Answer
Targets - victims of opportunity:
Some will be a
target
regardless of what they do, but most
become a target
because
of
what they
don’t do
related to security.
Who Are The Victims?
2
Breaches – not rocket science:
Most
victims weren’t overpowered by unknowable and
unstoppable attacks.
we
know them well enough and we
Could This Be Prevented?
also
know how
Most Common Attack - Social:
Most
attacks began socially.
Employees
are your greatest asset, but often your weakest link to security.
How Are They Hacking?
4
Hackers
know
this, and have
developed social scams by the
thousands, hoping
but
one will
fall victim
.
Breaches in 2014 – went unnoticed:
Prevention is crucial, but we must accept the fact that no barrier is
impenetrable.
Detection/response
represents
an extremely critical
Why Can’t We Stop Them?
line of
defense
.
Ignorance is NOT bliss – what you don’t know
can hurt you!
6
9 7 % o f B r e a c h e s W e r e Av o i d a b l e
Most victims aren’t overpowered by unknowable and unstoppable attacks. For the most part, we
know them well enough and we also know how to stop them.
Verizon Data Breach Investigations Report
Weak Infrastructure
Weak design (firewalls, wireless routers)
Weak user authentication (users, passwords)
Encryption (VPN, secure portals)
Out-dated (patch management / anti-virus)
Lack of periodic testing
User Ignorance
Weak user passwords
Poor judgment
Social media
Phishing attacks
Third Party Vendors
Weak due diligence
Breach notification
Annual breach confirmation
Technology Advances
Mobile devices
9 7 % o f B r e a c h e s W e r e Av o i d a b l e
Most victims aren’t overpowered by unknowable and unstoppable attacks. For the most part, we
know them well enough and we also know how to stop them.
INFORMATION TECHNOLOGY SECURITY TRENDS, PLANTE MORAN
Not Always Hackers!
What Might it Cost?
Start with a Framework.
Different organizations view information security differently. Some of the differences are related to varied
risk and threat profiles impacting an organization — based on factors such as industry, location,
Assess Risk.
Secure the Network.
1. Data Classification – Public and Confidential (Sensitive/Private)
2. Perimeter Security - Firewalls, IDS/IPS
3. Wireless Security – SSID, Encryption, Default Password
4. Authentication – Users & Passwords
5. Encryption - Connectivity & Storage
6. Anti-virus
7. Patch Management
8. Remote Access
9. Network Monitoring
Secure the User.
18
•
Need to know basis/able to
perform job responsibilities
•
Segregation of duties
•
Administrative access
•
Super-user access
•
Internet vs. corporate system
access
•
Ad hoc vs. formal repeatable process
•
Single sign-on
•
User IDs/passwords
•
Use of technology (tokens, firewalls,
access points, encryption, etc.)
•
Full-time employees
•
Part-time employees and
contractors
•
Consultants and vendors
•
Customers
•
Visitors
•
Only when an issue is noted
•
User access logs
•
Annual review of access
•
Proactive review of user activity
•
Real-time monitoring of
Passwords Died in the 90s.
Secure the Vendor.
Due Diligence
•
Existence and corporate history, strategy, and reputation
•
References, qualifications, backgrounds, and reputations of company
principals, including criminal background checks
•
Financial status, including reviews of audited financial statements
•
Internal controls environment, security history, and audit coverage (SOC
Reports)
•
Policies vs. procedures
•
Legal complaints, litigation, or regulatory actions
•
Insurance coverage
Secure the Vendor.
22
Remote Access
•
Deploy a single central remote access solution for employees and vendors
to remotely access your network
•
Company should manage remote access tool and not the third-party vendor
•
Block access from any unapproved remote access tools used by third-party
vendors
•
Require each third-party vendor to use unique credentials to access your
network
•
Log and review third-party activities on your network
Breach Notification
•
Contract language should include breach notification requirement
In Summary… Simplified.
Joe Oleksak
