cyber insecurity under attack cyber security past, present and future patricia titus chief...

Cyber InsecurityUnder Attack

Cyber Security Past, present and future

Patricia Titus Chief Information Security Officer Unisys Corporation

© 2008 Unisys Corporation. All rights reserved.

Discussion topics

• Global sector threats

• The global response

• Protection plan

• The future


Global Cyber Threats Impact Every Sector

• Electrical grid attacks – Brazil power sector attacks, 2003 US outage (Energy sector)

• The Morphing of the Mafia – slicing, spaming and phishing -Zeus (Financial Sector)

• Data extractions and data losses – loss of sensitive DoD data from Centcom and Estonia (Government Sector)

• Counterfeit equipment inserted into the supply chain (Manufacturing sector)

• Airline systems taken off line by a computer glitch crippling the air travel (Transportation sector)

• Hackers steal data pharmaceutical records of thousands of VA residents and encrypt it – holding it for ransom (Healthcare sector)

• Google hacked by the Chinese (Technology sector)


Keeping Pace

• The Public Sector needs better ways to protect assets and citizens

• Global criminal activity has increased the need for sophisticated tools to protect financial assets and avoid service interruptions

• Enterprises want cost effective solutions such as cloud and virtualization without giving up privacy and security

• Leaders must ensure continuity of operations for key infrastructure services and customer service, avoid negative economic impact

• The private sector needs to take a leadership role in securing their own infrastructure as well as their clients. We can’t wait for legislation and regulation. We need to act now.


US Leadership Direction

“Protecting this infrastructure will be a national security priority. We will ensure that these networks are secure, trustworthy and resilient.”

~Obama May 29, 2009

May 27, 2010 – White House releases a new National Security Strategy

© 2008 Unisys Corporation. All rights reserved. © 2009 Unisys Corporation. All rights reserved. Page 6

Our Cyber Dependency

• Today both public and private sector rely on information systems to perform their missions and business function

• Enterprise systems must be protected from cyber threats to ensure they are available

• Significant cyber attacks have overwhelmed security professionals

– Attacks are aggressive and targeted; many are extremely sophisticated

– Our adversaries are nation states, terrorist groups, hackers, and those with intentions of compromising critical systems

– Malicious software deployments making it nearly impossible to protect critical systems and information


Protection begins with planning

• Strong governance models and organizational structure critical to success

• Assessing your current risk posture based on proven frameworks

• Build a strategic plan integrated into the overall corporate model

• Security is a business enabler and must not appear to be stand alone

• Policies are critical however worthless without enforcement tools

• Auditing, assessments and continuous monitoring


Determine Your Risk Profile

Identify your assets

Determine the assurance level

Assess based on the risk level

Identify your vulnerabilities

Begin the remediation process

When connecting system or sharing data ensure you know the security vulnerabilities before you connect

The Objective: achieve visibility into your system security level, develop a plan to remediate and execute on those plans


Links in the security chain

Management, Operational, and Technical Controls

• Risk assessment

• Security planning, policies, procedures

• Configuration management and control

• Contingency planning

• Incident response planning

• Security awareness and training

• Security in acquisitions

• Physical security

• Personnel security

• Security assessments

• Certification and accreditation

• Access control mechanisms

• Identification & authentication mechanisms (Biometrics, tokens, passwords)

• Audit mechanisms

• Encryption mechanisms

• Boundary and network protection devices (Firewalls, guards, routers, gateways)

• Intrusion protection/detection systems

• Security configuration settings

• Anti-viral, anti-spyware, anti-spam software

• Smart cards

Adversaries attack the weakest link…where is yours?– NIST


Where are we heading

• Advanced persistent threats and vulnerability sophistication

• Cyber crime will increase

• Continued disruption in the supply chain

• Attacks on critical infrastructure

• Cyber defense options – who pushes the button first


Contact

Patricia Titus, CISO

[email protected]

703-439-5406 desk

703-895-1492 cell

cyber insecurity under attack cyber security past, present and future patricia titus chief...

Documents

private sector

public sector

information slide

future slide

global cyber threats

us outage energy sector

security professionals

security leaders