Ron Woerner, CISSP, CEH, CHFI · 16 Sun Tsu – The Art of War "It is said that if you know your...
Transcript of Ron Woerner, CISSP, CEH, CHFI · 16 Sun Tsu – The Art of War "It is said that if you know your...
![Page 1: Ron Woerner, CISSP, CEH, CHFI · 16 Sun Tsu – The Art of War "It is said that if you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you](https://reader034.fdocuments.net/reader034/viewer/2022050600/5fa7704a92691c772a7eb19d/html5/thumbnails/1.jpg)
Ron Woerner, CISSP, CEH, CHFI
Licensed under the Creative Commons Attribution-Share Alike 3.0 License.
To view a copy of this license, visit http://creativecommons.org/licenses/by-sa/3.0/
![Page 2: Ron Woerner, CISSP, CEH, CHFI · 16 Sun Tsu – The Art of War "It is said that if you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you](https://reader034.fdocuments.net/reader034/viewer/2022050600/5fa7704a92691c772a7eb19d/html5/thumbnails/2.jpg)
Who is this guy?
Page 2
http://academic2.bellevue.edu/~rwoerner/
![Page 3: Ron Woerner, CISSP, CEH, CHFI · 16 Sun Tsu – The Art of War "It is said that if you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you](https://reader034.fdocuments.net/reader034/viewer/2022050600/5fa7704a92691c772a7eb19d/html5/thumbnails/3.jpg)
3
These are my
thoughts.
Use at your own risk.
![Page 4: Ron Woerner, CISSP, CEH, CHFI · 16 Sun Tsu – The Art of War "It is said that if you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you](https://reader034.fdocuments.net/reader034/viewer/2022050600/5fa7704a92691c772a7eb19d/html5/thumbnails/4.jpg)
4
Future of
Infosec…
![Page 5: Ron Woerner, CISSP, CEH, CHFI · 16 Sun Tsu – The Art of War "It is said that if you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you](https://reader034.fdocuments.net/reader034/viewer/2022050600/5fa7704a92691c772a7eb19d/html5/thumbnails/5.jpg)
5
![Page 6: Ron Woerner, CISSP, CEH, CHFI · 16 Sun Tsu – The Art of War "It is said that if you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you](https://reader034.fdocuments.net/reader034/viewer/2022050600/5fa7704a92691c772a7eb19d/html5/thumbnails/6.jpg)
6
Future of
Infosec…
![Page 7: Ron Woerner, CISSP, CEH, CHFI · 16 Sun Tsu – The Art of War "It is said that if you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you](https://reader034.fdocuments.net/reader034/viewer/2022050600/5fa7704a92691c772a7eb19d/html5/thumbnails/7.jpg)
Dilbert
7
![Page 8: Ron Woerner, CISSP, CEH, CHFI · 16 Sun Tsu – The Art of War "It is said that if you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you](https://reader034.fdocuments.net/reader034/viewer/2022050600/5fa7704a92691c772a7eb19d/html5/thumbnails/8.jpg)
8
Future of
Infosec…
![Page 9: Ron Woerner, CISSP, CEH, CHFI · 16 Sun Tsu – The Art of War "It is said that if you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you](https://reader034.fdocuments.net/reader034/viewer/2022050600/5fa7704a92691c772a7eb19d/html5/thumbnails/9.jpg)
9
![Page 10: Ron Woerner, CISSP, CEH, CHFI · 16 Sun Tsu – The Art of War "It is said that if you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you](https://reader034.fdocuments.net/reader034/viewer/2022050600/5fa7704a92691c772a7eb19d/html5/thumbnails/10.jpg)
2011 Worst Year Ever for
Security Breaches!
10
![Page 11: Ron Woerner, CISSP, CEH, CHFI · 16 Sun Tsu – The Art of War "It is said that if you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you](https://reader034.fdocuments.net/reader034/viewer/2022050600/5fa7704a92691c772a7eb19d/html5/thumbnails/11.jpg)
11
![Page 12: Ron Woerner, CISSP, CEH, CHFI · 16 Sun Tsu – The Art of War "It is said that if you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you](https://reader034.fdocuments.net/reader034/viewer/2022050600/5fa7704a92691c772a7eb19d/html5/thumbnails/12.jpg)
Attacks from (by):
12
Russia
China
![Page 13: Ron Woerner, CISSP, CEH, CHFI · 16 Sun Tsu – The Art of War "It is said that if you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you](https://reader034.fdocuments.net/reader034/viewer/2022050600/5fa7704a92691c772a7eb19d/html5/thumbnails/13.jpg)
Basically:
13
![Page 14: Ron Woerner, CISSP, CEH, CHFI · 16 Sun Tsu – The Art of War "It is said that if you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you](https://reader034.fdocuments.net/reader034/viewer/2022050600/5fa7704a92691c772a7eb19d/html5/thumbnails/14.jpg)
14
Future of
Infosec…
![Page 15: Ron Woerner, CISSP, CEH, CHFI · 16 Sun Tsu – The Art of War "It is said that if you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you](https://reader034.fdocuments.net/reader034/viewer/2022050600/5fa7704a92691c772a7eb19d/html5/thumbnails/15.jpg)
Dr. Carl Sagan
“You have to know the past
to understand the present
(and the future).”
15
![Page 16: Ron Woerner, CISSP, CEH, CHFI · 16 Sun Tsu – The Art of War "It is said that if you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you](https://reader034.fdocuments.net/reader034/viewer/2022050600/5fa7704a92691c772a7eb19d/html5/thumbnails/16.jpg)
16
Sun Tsu – The Art of War
"It is said that if you know
your enemies and know
yourself, you will not be
imperiled in a hundred
battles;
if you do not know your
enemies but do know
yourself, you will win
one and lose one;
if you do not know your
enemies nor yourself,
you will be imperiled in
every single battle."
![Page 17: Ron Woerner, CISSP, CEH, CHFI · 16 Sun Tsu – The Art of War "It is said that if you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you](https://reader034.fdocuments.net/reader034/viewer/2022050600/5fa7704a92691c772a7eb19d/html5/thumbnails/17.jpg)
17
Remember your history
The Protection of Information in Computer
Systems by Saltzer & Schroder
The Cuckoo’s Egg by Clifford Stoll http://pdf.textfiles.com/academics/wilyhacker.pdf
Practical Unix & Internet Security by Garfinkel
& Spafford.
How to Win Friends & Influence People by
Dale Carnegie
![Page 18: Ron Woerner, CISSP, CEH, CHFI · 16 Sun Tsu – The Art of War "It is said that if you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you](https://reader034.fdocuments.net/reader034/viewer/2022050600/5fa7704a92691c772a7eb19d/html5/thumbnails/18.jpg)
18
![Page 19: Ron Woerner, CISSP, CEH, CHFI · 16 Sun Tsu – The Art of War "It is said that if you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you](https://reader034.fdocuments.net/reader034/viewer/2022050600/5fa7704a92691c772a7eb19d/html5/thumbnails/19.jpg)
Data Breach Investigations
Report (DBIR) series
19
![Page 20: Ron Woerner, CISSP, CEH, CHFI · 16 Sun Tsu – The Art of War "It is said that if you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you](https://reader034.fdocuments.net/reader034/viewer/2022050600/5fa7704a92691c772a7eb19d/html5/thumbnails/20.jpg)
20
![Page 21: Ron Woerner, CISSP, CEH, CHFI · 16 Sun Tsu – The Art of War "It is said that if you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you](https://reader034.fdocuments.net/reader034/viewer/2022050600/5fa7704a92691c772a7eb19d/html5/thumbnails/21.jpg)
Drop in Data Loss – Why?
Random caseload variation
Huge global improvement in security posture
Prosecution and incarceration of “Kingpins”
Change in criminal tactics
Away from massive breaches to smaller, less
risky heists (Helps explain increase in breaches)
Market forces (law of supply and demand)
Targeting different (non-bulk) data types
Better at evading detection 21
![Page 22: Ron Woerner, CISSP, CEH, CHFI · 16 Sun Tsu – The Art of War "It is said that if you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you](https://reader034.fdocuments.net/reader034/viewer/2022050600/5fa7704a92691c772a7eb19d/html5/thumbnails/22.jpg)
22
Future of
Infosec…
![Page 23: Ron Woerner, CISSP, CEH, CHFI · 16 Sun Tsu – The Art of War "It is said that if you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you](https://reader034.fdocuments.net/reader034/viewer/2022050600/5fa7704a92691c772a7eb19d/html5/thumbnails/23.jpg)
Why Security?
We’re told to (Compliance)
We know we need to
(Mind)
We feel we need to
(Gut)
23
![Page 24: Ron Woerner, CISSP, CEH, CHFI · 16 Sun Tsu – The Art of War "It is said that if you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you](https://reader034.fdocuments.net/reader034/viewer/2022050600/5fa7704a92691c772a7eb19d/html5/thumbnails/24.jpg)
Society of Information Risk
Analysts
http://societyinforisk.org/
24
![Page 25: Ron Woerner, CISSP, CEH, CHFI · 16 Sun Tsu – The Art of War "It is said that if you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you](https://reader034.fdocuments.net/reader034/viewer/2022050600/5fa7704a92691c772a7eb19d/html5/thumbnails/25.jpg)
Future Thoughts
25
"We don't have a
silver bullet, but
we do have silver
buckshot."
Jay Jacobs
![Page 26: Ron Woerner, CISSP, CEH, CHFI · 16 Sun Tsu – The Art of War "It is said that if you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you](https://reader034.fdocuments.net/reader034/viewer/2022050600/5fa7704a92691c772a7eb19d/html5/thumbnails/26.jpg)
Future Thoughts
26
“The more
things
change, the
more they
stay the
same."
“What we’ve
got right now
is what we’ll
have
tomorrow."
![Page 27: Ron Woerner, CISSP, CEH, CHFI · 16 Sun Tsu – The Art of War "It is said that if you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you](https://reader034.fdocuments.net/reader034/viewer/2022050600/5fa7704a92691c772a7eb19d/html5/thumbnails/27.jpg)
Future Thoughts
27
![Page 28: Ron Woerner, CISSP, CEH, CHFI · 16 Sun Tsu – The Art of War "It is said that if you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you](https://reader034.fdocuments.net/reader034/viewer/2022050600/5fa7704a92691c772a7eb19d/html5/thumbnails/28.jpg)
Security is Risk Management
Information Security Magazine, Looking
Ahead (2005 & 2010)
The evolution from it's current series of
random incarnations to full, fledged
information risk management. (boB Rudis)
Prioritization based on risk using a battle
hardened framework with industry
benchmarks. (Phil Agcaoili)
28
![Page 29: Ron Woerner, CISSP, CEH, CHFI · 16 Sun Tsu – The Art of War "It is said that if you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you](https://reader034.fdocuments.net/reader034/viewer/2022050600/5fa7704a92691c772a7eb19d/html5/thumbnails/29.jpg)
Better Security Metrics
29
![Page 30: Ron Woerner, CISSP, CEH, CHFI · 16 Sun Tsu – The Art of War "It is said that if you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you](https://reader034.fdocuments.net/reader034/viewer/2022050600/5fa7704a92691c772a7eb19d/html5/thumbnails/30.jpg)
Security Silos
30
The transformation
of it being a solely a
dedicated discipline
to an attribute/skill
expected in all
information workers. Cylinders of
Excellence!
![Page 31: Ron Woerner, CISSP, CEH, CHFI · 16 Sun Tsu – The Art of War "It is said that if you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you](https://reader034.fdocuments.net/reader034/viewer/2022050600/5fa7704a92691c772a7eb19d/html5/thumbnails/31.jpg)
DEFENSE
Security is driven by what abusers and
misusers will do. (Donn Parker)
Engineer for resiliency, not for absolute
defense. (Ben Tomhave)
Fail-safe security
31
![Page 32: Ron Woerner, CISSP, CEH, CHFI · 16 Sun Tsu – The Art of War "It is said that if you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you](https://reader034.fdocuments.net/reader034/viewer/2022050600/5fa7704a92691c772a7eb19d/html5/thumbnails/32.jpg)
Compliance
SOX PCI
HIPAA
GLBA
State
Privacy Laws
ID Theft
Red Flag
Rule
Basel II
ISO 2700X
SEC Reg
S-P COBIT
![Page 33: Ron Woerner, CISSP, CEH, CHFI · 16 Sun Tsu – The Art of War "It is said that if you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you](https://reader034.fdocuments.net/reader034/viewer/2022050600/5fa7704a92691c772a7eb19d/html5/thumbnails/33.jpg)
Web 3.0 – New Technologies
33
![Page 34: Ron Woerner, CISSP, CEH, CHFI · 16 Sun Tsu – The Art of War "It is said that if you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you](https://reader034.fdocuments.net/reader034/viewer/2022050600/5fa7704a92691c772a7eb19d/html5/thumbnails/34.jpg)
What do we do?
34
![Page 35: Ron Woerner, CISSP, CEH, CHFI · 16 Sun Tsu – The Art of War "It is said that if you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you](https://reader034.fdocuments.net/reader034/viewer/2022050600/5fa7704a92691c772a7eb19d/html5/thumbnails/35.jpg)
What can we do?
35
![Page 36: Ron Woerner, CISSP, CEH, CHFI · 16 Sun Tsu – The Art of War "It is said that if you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you](https://reader034.fdocuments.net/reader034/viewer/2022050600/5fa7704a92691c772a7eb19d/html5/thumbnails/36.jpg)
7/28/2011
*From: Infotec 2004 – “Zen & The Art of Information Security
Administer the Obvious*
Enforce the policies, standards & guidelines
Find and fix holes
Control access
Know who has access to what
Know who the administrators are
Guide, assist & train
Managers, users and systems administrators
Know what to do when you have an incident
![Page 37: Ron Woerner, CISSP, CEH, CHFI · 16 Sun Tsu – The Art of War "It is said that if you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you](https://reader034.fdocuments.net/reader034/viewer/2022050600/5fa7704a92691c772a7eb19d/html5/thumbnails/37.jpg)
7/28/2011 Infotec 2004 – W8
Security Caveats
These tasks won’t close all of the holes.
Everyone needs to take responsibility for
information systems security.
The intent is to make your environment
much less inviting to those looking for
easy pickings.
This also establishes legal due diligence in
protecting your organization.
![Page 38: Ron Woerner, CISSP, CEH, CHFI · 16 Sun Tsu – The Art of War "It is said that if you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you](https://reader034.fdocuments.net/reader034/viewer/2022050600/5fa7704a92691c772a7eb19d/html5/thumbnails/38.jpg)
40
Conclusion
Understand the problem
Plan solutions
Be aware of what’s available
Go out and play
Security is all about percentages
Join a community & Share with others
Do no harm
![Page 39: Ron Woerner, CISSP, CEH, CHFI · 16 Sun Tsu – The Art of War "It is said that if you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you](https://reader034.fdocuments.net/reader034/viewer/2022050600/5fa7704a92691c772a7eb19d/html5/thumbnails/39.jpg)
41
Future of
Infosec…
![Page 40: Ron Woerner, CISSP, CEH, CHFI · 16 Sun Tsu – The Art of War "It is said that if you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you](https://reader034.fdocuments.net/reader034/viewer/2022050600/5fa7704a92691c772a7eb19d/html5/thumbnails/40.jpg)
42
Find your own
security future
![Page 41: Ron Woerner, CISSP, CEH, CHFI · 16 Sun Tsu – The Art of War "It is said that if you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you](https://reader034.fdocuments.net/reader034/viewer/2022050600/5fa7704a92691c772a7eb19d/html5/thumbnails/41.jpg)
43
By working together
and helping each
other, we all
become stronger
Ron Woerner Ronw2007(at)gmail.com
Twitter: @ronw123