View
217
Download
3
Category
Preview:
Citation preview
DECEMBER 12, 2014
The State of the State of Cybersecurity
Agenda
• Global View• Headlines and the General State of the Falling Sky
• Texas View• What We Knew – Security Assessment findings• What We Now Can See
• Where Do We Go From Here• Preview of the 2015-2020 Statewide Cybersecurity
Strategy
2
When it rains…
3
The World Around Us
• 63% of victim organizations are made aware by external entities
• Attackers spend an estimated 243 days on a victim network before they are discovered (down 173 days from 2011)
4
Commonalities and Comparable Traits
5
TechnologySecurity CapabilitiesDataAttackersPeople
Industry
Commonalities and Comparable Traits
6
TechnologySecurity CapabilitiesDataAttackersPeople
Government
Commonalities and Comparable Traits
7
TechnologySecurity CapabilitiesDataAttackersPeople
Individual Agencies
Commonalities and Comparable Traits
8
Security Capabilities
Web Application Attack Detections- Financially Motivated
9
Web Application Attacks – Ideologically Motivated
10
Motivations, Targets and objectives
• Financial MotivationsCredit Cards – Direct ConversionIdentity Information (PII) – Indirect ConversionHealth Information (PHI) – Indirect Conversion
11
(Reuters) - Your medical information is worth 10 times more than your credit card number on the black market.
• Mayhem, Activism and Reputation
• Espionage
12
Let’s Talk About
Security Assessment Benchmark
13
Due Diligence StandardState of the State
App Security
Availability
Change Mgmt
Confidentiality
Endpoint Admission
Governance
Host Security
Access MgmtIntegrityMalware
Mobile Security
Monitoring
Network Perimeters
Network Zones
Physical Security
PKI - Encryption
Vulnerability Mgmt
1
2
3
4
5
Maturity Level DefinitionsLevel 1: Initial/Ad HocLevel 2: Developing/ReactiveLevel 3: Defined/Proactive Level 4: ManagedLevel 5: OptimizedSource: Gartner
Security Assessments Conducted 2011 through 2014*Approximately 40 Agencies – Over 80% of State FTEs
7 Trends Identified
14
Internal network segmentation
Consistent event monitoring and analysis
Security governance / awareness
IT staffing challenges
Security in software development
1
2
3
4
5
6
Data classification
7
Identity and access management standardization
The Texas Cybersecurity Framework
• Agency Security Plan Template Implemented in January 2014
• Vendor Product / Service Template Implemented in March 2014
• Updated Texas Administrative Code Ch. 202 Currently Draft - Publish February 2015
• Security Control Standards Catalog Currently Draft - Publish February 2015
• Guidelines and Whitepapers Ongoing effort
• Governance, Risk and Compliance Solution To be complete Fall 2015
15
Agency Security Plans
• 40 security objectives defined
• Aligned to “Framework for Improving Critical Infrastructure Cybersecurity” released by NIST in February 2014
• Responsive to SB 1134 (Ellis) and SB 1597 (Zaffirini)
16
FUNCTIONAL AREA SECURITY OBJECTIVE
Identify
– Privacy and Confidentiality– Data Classification– Critical Information Asset Inventory– Enterprise Security Policy, Standards and Guidelines– Control Oversight and Safeguard Assurance– Information Security Risk Management– Security Oversight and Governance– Security Compliance and Regulatory Requirements Management– Cloud Usage and Security– Security Assessment and Authorization / Technology Risk Assessments– External Vendors and Third Party Providers
Protect
– Enterprise Architecture, Roadmap & Emerging Technology– Secure System Services, Acquisition and Development – Security Awareness and Training– Privacy Awareness and Training– Cryptography– Secure Configuration Management– Change Management– Contingency Planning– Media– Physical Environmental Protection– Personnel Security– Third-Party Personnel Security – System Configuration Hardening & Patch Management– Access Control– Account Management– Security Systems Management– Network Access and Perimeter Controls– Internet Content Filtering– Data Loss Prevention– Identification & Authentication – Spam Filtering– Portable & Remote Computing– System Communications Protection
Detect
– Malware Protection– Vulnerability Assessment – Security Monitoring and Event Analysis
Respond– Cyber-Security Incident Response– Privacy Incident Response
Recover – Disaster Recovery Procedures
Agency Security Plans
• Objective-based• Uniform understanding of agency security program
maturity using traditional maturity model
MATURITY LEVEL DIR DESCRIPTION KEYWORDS
0 There is no evidence of the organization meeting the objective. None, Nonexistent
1 The organization has an ad hoc, inconsistent, or reactive approach to meeting the objective. Ad-hoc, Initial
2 The organization has a consistent overall approach to meeting the objective, but it is still mostly reactive and undocumented. The organization does not routinely measure or enforce policy compliance.
Managed, Consistent, Repeatable
3 The organization has a documented, detailed approach to meeting the objective, and regularly measures its compliance.
Compliant, Defined
4 The organization uses an established risk management framework to measure and evaluate risk and integrate improvements beyond the requirements of applicable regulations.
Risk-Based, Managed
5 The organization has refined its standards and practices focusing on ways to improve its capabilities in the most efficient and cost-effective manner.
Efficient, Optimized, Economized
17
Agency Security Plan Observations
18
Nonexistent Ad-hoc Managed Compliant Risk-Based Efficient0%
5%
10%
15%
20%
25%
30%
35%
40%
45%
50%Overview of Maturity
Per
cent
age
of A
genc
ies
Maturity Levels
Observations – Size Matters
19
Under 50 FTEs Medium Over 1000 FTEs0
0.5
1
1.5
2
2.5
3
Maturity by Entity SizeM
atur
ity
Size – FTE Count
Effect of External Regulations
20
1 2 3 4 5 6 7 80
0.5
1
1.5
2
2.5
3
Maturity by ArticleM
atur
ity
Article Description External Regulations
1 General Government Varies
2 Health and Human Services
HIPAA, CJIS, IRS, SSA
3 Education FERPA
4 Judicial CJIS
5 Public Safety and Criminal Justice
CJIS
6 Natural Resources Varies
7 Business and Economic Development
Varies
8 Regulatory Varies
Article Number
A Layer Below the Surface
21
Identify
Protect
DetectRespond
Recover
0.00
5.00 2.37
2.52
2.782.32
3.00
Statewide Average by Area
Highlights and Roadmap Improvements
Successes to Build Upon• Spam Filtering• Account Management• Disaster Recovery• Security Systems Management
22
Areas for Improvement• Data Loss Prevention• Secure System Services,
Acquisition and Development• Cloud Usage and Security
A Look to the Future
23
Framework Lifecycle
24
Security PersonnelIT Classifications IT Security Classifications New Security Classifications
Systems Analyst I, Network Specialist I
B16
Programmer I B17
Systems Analyst II, Network Specialist II, Web Administrator I
B18
Programmer II B19
Systems Analyst III, Network Specialist III, Web Administrator II
B20
Programmer III B21
Systems Analyst IV, Network Specialist IV, Web Administrator III
B22
Programmer IV B23 Information Technology Security Analyst I B23
Systems Analyst V, Network Specialist V, Web Administrator IV
B24
Programmer V B25 Information Technology Security Analyst II
B25 Cybersecurity Analyst I B25
Systems Analyst VI, Network Specialist VI, Web Administrator V
B26
Programmer VI B27 Information Technology Security Analyst III
B27 Cybersecurity Analyst II B27
Cybersecurity Analyst III B29
Information Security Officer / Cybersecurity Officer
B30
Chief Information Security Officer *B31
Education, Communication and Awareness
26
Objective 1 - Establish and expand the Texas Infosec Academy to provide the state’s security personnel the knowledge needed to deliver agency security programs.
NICCS Core Security Professionals Courses 6 Career Tracks
CISO Strategic Course Budget, Strategy, Executive Communication, Leadership
Certification Exam Preparation Courses CISSP, CISM, CEH, CISA
Texas Cybersecurity Framework Training TAC 202 and Security Control Standards
RSA Archer eGRC Training Incident Reporting and Analysis Agency Security Plans and Risk Management
Platform for exercises Tabletop Incident Response Scenarios Red Team / Blue Team - detection and active response Statewide coordination exercises Participation in national readiness such as Cyber Storm
Education, Communication and Awareness
27
Objective 2 - Deliver high quality communication products and events that provide valued information to security personnel, partners and stakeholders throughout the state.
X 5
28
Security Operations and Services
Objective 1 - Establish an Enterprise Managed Security Services Provider (MSSP) and Multisourcing Service Integrator (MSI) model to provide key security operations for statewide program and agency functions.
Objective 2 – Identify and protect from cybersecurity threats against Texas information resources (Identify / Protect).
Objective 3 - Detect cyber attacks and identify attack campaigns launched against Texas information resources and critical infrastructure (Detect).
29
Coordination – Collaboration – Outreach
Objective 1 - Establish a statewide cybersecurity coordination and collaboration platform (HSIN).
Objective 2 - Enable regional cybersecurity response coordination.
Objective 3 - Coordinate statewide cybersecurity exercises and preparedness.
Objective 4 – Coordinate the information sharing among the state’s key entities.
Objective 5 – Establish a competent and capable cybersecurity workforce supply.
Thank You
30
Recommended