THANK YOU FOR INVITING ME

MANCHESTER BCS ELITE GROUP JULY 10TH 2014

YOUR SPEAKER – JAMES MCKINLAY • 2014 HEAD OF INFORMATION SECURITY, DATA PROTECTION AND PCIDSS – ATOS WORLDLINE

• 2014 CISO LEVEL SECURITY, RISK & COMPLIANCE CONSULTANCY ACROSS EUROPE

• 2013 INFORMATION SECURITY MANAGER AT WALMART FOR ASDA & GEORGE (LEVEL ONE MERCHANT)

• 2011 - 2013 INFORMATION SECURITY MANAGER MANCHESTER AIRPORTS GROUP (LEVEL THREE MERCHANT)

• 2006-2011 PCIDSS COMPLIANCE HOMELOAN MANAGEMENT LIMITED (LEVEL ONE SERVICE PROVIDER)

• 2006 ECOMMERCE SECURITY– THOMAS COOK SCHEDULED BUSINESS

EXEC SUMMARY –

• UNDERSTAND YOUR FORMAL RISK ASSESSMENT

AND RISK ACCEPTANCE PROCEDURES

• KEEP UP TO DATE WITH CHANGING THREATS

(INTERNAL AND EXTERNAL)

• UPDATE YOUR INCIDENT RESPONSE PROCEDURES

TO INCLUDE ANY NEW POSITIONS YOU ADOPT Hope for the best – Plan for the worst

BEFORE WE BEGIN

WHAT DO I MEAN BY . . . .

•INFOSEC RISK ASSESSMENT

•MOBILE WORKFORCE RISK

•MOBILE APP RISK

•CLOUD VPC RISK

•CLOUD PUBLIC SERVICE RISK

INFOSEC RISK ASSESSMENT

• IS USUALLY DIFFERENT TO CORPORATE RISK

REGISTER

• CAN BE BESPOKE OR FOLLOW A RECOGNISED

METHOD

• CAN ALREADY BE PART OF YOUR INFORMATION

SECURITY MANAGEMENT STRATEGY

• MIGHT WANT TO CONSIDER USING THE SAME

OUTPUT “SCALES” (5X5)

RMF – PROCESS DRIVEN METHODOLOGIES

• NIST / OCTAVE ALLEGRO / HMG-IS1 / FAIR / ISO27005 / STRIDE

THE TECHNICAL RISK ASSESSMENT

• PATTERNS FROM OPEN SECURITY ARCHITECTURE (OSA)

• TRA/RAR TEMPLATE

• HTTP://CSRC.NIST.GOV/GROUPS/SMA/FASP/DOCUMENTS/RISK_MGMT/RAR_TEMPLATE_07112007.DO

• HTTP://WWW.OPENSECURITYARCHITECTURE.ORG/CMS/LIBRARY/PATTERNLANDSCAPE/262-PDF-TEST-PATTERN

TRA EXAMPLE

IS THE CIA ENOUGH

GOVERNANCE RISK & COMPLIANCE IN INFOSEC

• ARCHER

• RIVOSOFTWARE

• CURASOFTWARE

• SURECLOUD

• HITECLABS/TENRISK

• WCK (TECHARBOUR)

WHAT DO I MEAN BY . . . .

•INFOSEC RISK ASSESSMENT

•MOBILE WORKFORCE RISK

•MOBILE APP RISK

•CLOUD VPC RISK

•CLOUD PUBLIC SERVICE RISK

CASE STUDY : ASDA STORE MANAGERS

• WANT ACCESS TO SENSITIVE COMPANY DATA FROM A COMPANY

OWNED MOBILE DEVICE

• ALLOW STORE MANAGERS TO TAKE DEVICE HOME

• PHASE 1 – USE MOBILE PROVIDERS NETWORKING

• PHASE 2 – USE INSTORE WIFI

THINGS TO CONSIDER

• DEVICE CHOICE (IPAD –V- ANDROID TABLET)

• PROTECT FROM DAMAGE

• LOGISTICS (DELIVER DEVICE – DELIVER LOGIN DETAILS)

• SERVICE DESK / SUPPORT – NEW PROCEDURES, NEW EXPERIENCE

• MDM / SANDBOX – ESSENTIAL , NOT FOOLPROOF !!!

• MOBILE DEVICES NOT DESIGNED WITH MULTI USER SECURITY IN MIND (APPLE OWNER IS KING)

MORE THINGS TO CONSIDER

• HACKERS CAN BEAT MDM ENCRYPTION CONTAINERS – BLACKHAT EUROPE CONFERENCE

• HACKERS CAN BEAT VENDOR SECURITY – IOS8 JAIL BEAKS ALREADY AVAILABLE

• HACKERS CAN ESCAPE FROM BROWSERS (SAFARI MOBILE)

• SECURITY AWARENESS OF USERS

• VALUE OF DATA IN WRONG HANDS

• NEW ATTACKS BEING THOUGHT UP ALL THE TIME – SEPTEMBER 2014 EXPECT TO SEE ATTACKS ON

TELECOMS INFRASTRUCTURE

WHAT DO I MEAN BY . . . .

•INFOSEC RISK ASSESSMENT

•MOBILE WORKFORCE RISK

•MOBILE APP RISK

•CLOUD VPC RISK

•CLOUD PUBLIC SERVICE RISK

DUTY OF CARE ?

• LOOK AFTER CUSTOMER DETAILS

• NO EXCESSIVE LOGGING

• DO NOT GIVE ATTACKERS AN EASY EXPLOIT

WATCH FOR LEAKS

https://www.owasp.org/images/9/94/MobileTopTen.pdf

EXAMPLES ARE EVERYWHERE

CALL THE (LOCAL) PROFESSIONALS

www.pentest.co.uk www.mdsec.co.uk

FOOD FOR THOUGHT . . . .

• AMONG THE MOST SIGNIFICANT SECURITY RISKS ASSOCIATED

WITH CLOUD COMPUTING IS THE TENDENCY TO BYPASS

INFORMATION TECHNOLOGY (IT) DEPARTMENTS AND INFORMATION

OFFICERS. ALTHOUGH SHIFTING TO CLOUD TECHNOLOGIES

EXCLUSIVELY IS AFFORDABLE AND FAST, DOING SO UNDERMINES

IMPORTANT BUSINESS-LEVEL SECURITY POLICIES, PROCESSES, AND

BEST PRACTICES. IN THE ABSENCE OF THESE STANDARDS,

BUSINESSES ARE VULNERABLE TO SECURITY BREACHES THAT CAN

QUICKLY ERASE ANY GAINS MADE BY THE SWITCH TO SAAS.

WHAT DO I MEAN BY . . . .

•INFOSEC RISK ASSESSMENT

•MOBILE WORKFORCE RISK

•MOBILE APP RISK

•CLOUD VPC RISK

•CLOUD PUBLIC SERVICE RISK

ARE YOU READY TO MOVE TO THE CLOUD

Amazon

Microsoft

Rackspace

Pro-Act

Exponential-e

ARE YOUR SECURITY TEAM ?

Jericho Forum -> CSA

Data Breaches

Data Loss

Account Hijacking

Insecure APIs

Denial of Service

Malicious Insiders

Abuse of services

Insufficient Due Diligence

Shared Technology Vulnerabilities

THE VENDORS WANT TO HELP

BUT THAT IS NOT ENOUGH -

• NEED TO UNDERSTAND HOW VPC EXTENDS YOUR ENVIRONMENT

AND HOW THAT WILL WORK WITH YOUR ISMS AND IS POLICIES.

• LOGICAL ACCESS POLICY

• INFORMATION SECURITY ASSET REGISTER

• PASSWORD POLICY

• CRYPTOGRAPHY POLICY

• THIRD PARTY SUPPLIER MANAGEMENT

• BACKUP AND RESTORE POLICY & PROCEDURES

• INCIDENT RESPONSE POLICY AND PROCEDURES

CASE STUDY : REPLACE THE SERVER ROOM

• VPN TO PRIVATE CLOUD

• GOOD STARTERS LEAVERS MOVERS PROCESS

• GOOD CHANGE MANAGEMENT PROCESS

• ENCRYPTING DATA AT REST AND DATA IN TRANSIT

• CENTRALISED LOG SHIPPING AND SIEM/CORRELATION/ALERTING

• SRC DST FIREWALL RULES IN ACROSS EVERY SUBNET

WHAT DO I MEAN BY . . . .

•INFOSEC RISK ASSESSMENT

•MOBILE WORKFORCE RISK

•MOBILE APP RISK

•CLOUD VPC RISK

•CLOUD PUBLIC SERVICE RISK

DATA GETS EVERY WHERE

• GOOGLE DRIVE , ONEDRIVE

• EVERNOTE

• GMAIL, HOTMAIL,

• SKYPE, YOUTUBE, SOUNDCLOUD

• MOZY BACKUPS , SALESFORCE.COM, OFFICE365, APPLE ICLOUD

DLP IN WEB CHANNELS

MSSP MANAGED SECURITY SERVICE PROVIDERS

• LOG MONITORING IN THE CLOUD

• SOC / CIRT OUTSOURCING

• THREAT INTELLIGENCE IN THE CLOUD

• VULNERABILITY MANAGEMENT IN THE CLOUD

• WHAT ABOUT VOIP IN THE CLOUD ?

WHERE DO THEY COME FROM . . . .

•EVOLVING THREAT LANDSCAPE

STAY UP TO DATE

• IMPORTANT FOR YOUR INFORMATION SECURITY STAFF TO STAY UP TO DATE

• UNDERSTAND THE REAL RISKS

• THREAT INTELLIGENCE

• INDUSTRY DISCUSSIONS AND NETWORKING

• BACKGROUND READING

THREAT INTELLIGENCE

DON’T FORGET TO AUDIT

BACKGROUND READING: BOOKS

DEEPER DIVE : BOOKS

YOU CAN’T HOLD BACK THE TIDE

• ACCENTURE-TECNOLOGY-VISION-2014.PDF”

• FIND ME ON LINKEDIN

• UK.LINKEDIN.COM/PUB/JAMES-MCKINLAY/16/A42/206/

TIME IS PRECIOUS – THANK YOU FOR YOURS