World-Class Cybersecurity:Lessons from the Experts...World-Class Cybersecurity:Lessons from the...

World-Class Cybersecurity:Lessons from the Experts Johna Till Johnson

CEO, Nemertes Research

johna@nemertes.com, @johnatilljohnso

July 17, 2018

About Nemertes

Topics We Cover Research We Conduct Services We Provide• Contact Center & Customer Engagement

• Cloud and Networking

• Digital Transformation

• IoT

• Next Generation Endpoints

• Security and Risk Management

• Unified Communications & Collaboration

• Benchmarks: Live discussions with IT leaders

• Surveys: Industry-leading data integrity methodology

• Vendor discussions: Product, technology analysis

• Research advisory service

• Strategy & roadmap consulting

• Vendor & technology assessment

• Cost models

• Maturity models

• Annual conference

Global IT research and strategic consulting firm focusing on the business impact of emerging technology. Founded in 2002 by IT professionals, for IT professionals.

The Current State: July 2018

The World Today

New Breaches

The World Today

New Breaches New Vectors

Mobile

IoT“Shadow IoT”

Collaboration

Chips/Firmware

Blockchain

The World Today

Ransomware

New Threats

OSX Attacks

Industrial botnets

Cryptocurrency malware

The World Today

Russia

New Threats New Actors

North Korea

The World Today

June 13, 2017

“Russia’s cyberattack on the U.S. electoral system before Donald Trump’s election was far more widespread than has been publicly revealed, including incursions into voter databases and software systems in almost twice as many states as previously reported.”

“Red Blinking Lights”

Director of National Intelligence Dan Coats, 07/13/18

"The warning signs are there. The system is blinking… we are at a critical point. Today, the digital infrastructure that serves this

country is literally under attack.”

What Now?

Defining “World Class”

What Is “World Class” Cybesrsecurity?

Technology deployment?

Spending and investment?

Operational metrics?

Organization and governance?

Nemertes’ Security Benchmarking

• 2017-2018 Security and Risk Management Research Study

• Interviewed and surveyed during 2017 and 2018:

o 625 companies

o 12 countries

o 13% (80 companies) financial services

• Validated/invalidated range of hypotheses

Unprepared (Level 0)

Reactive (Level 1)

Proactive (Level 2)

Anticipatory (Level 3)

Success Metric 1: Nemertes Maturity Model

Have basic platforms and structures to react to business requirements; cannot proactively prevent problems from arising

Have platforms, structures, organizational processes to proactively address current issues and challenges

Have platforms, structures, organizational processes to proactively address futureissues and challenges

Lacking necessary information to take effective action; unaware or unable to respond to current or emerging issues

Success Metric 2: Operational Metrics

percentile

75th percentile

50th percentile

• Median time to detect incursion: 1 hour

• Two clusters of higher performers: 10 minutes and 30 minutes

• Cluster of lower performers requiring days to weeks

SecOps Metrics: Detection Time

Under 1 hr Hrs to weeks

• Median time to understand incursion: 180 minutes (3 hours)

• Higher performers understand in 30 minutes or less

• Lower performers requiring days to weeks

SecOps Metrics: Understanding Time

Under 3 hr Hrs to weeks

• Median time to resolve incursion: 6 hours

• Bimodal distribution: cluster around 2 hours, cluster around 2 days

• Highest performers resolve in half an hour or less

SecOps Metrics: Resolution Time

2 days +Under 2 hr 2 hr- 2 day

Success Metric 2: Operational Metrics

percentile

75th percentile

50th percentile

8 minutes

109 minutes

410 minutes

Budgeting Maturity

Ad-hoc

Framework

Benchmark

How Security Budget Set

Best practice: Risk-based budget setting

Second-best practice: Benchmarks from peers based on internal metrics Percentage of IT spend

Percentage of revenue

“I get whatever I ask for” is not good enough Ad-hoc is least successful,

even in an environment of perceived unlimited funding, and usually results in lower spending

0.0% 20.0%40.0%60.0%80.0%

Lessthan$100

$100ormorebutlessthan$500

$2000ormore

2018SecurityBudgetPerEmployee

Lesssuccessful

Moresuccessful

Annual Per-Employee Security Spend

Most successful more likely to spend more, and 10X more likely to spend more than $2000 per employee

Annual Per-Employee Security Spend

Mean spend by

financial services

firms in 2018

$3,361

More-successful companies are more likely to include as line item in infosec budget: Network security Mobile security Facilities DR/BCP IoT security AppSec/DevOps SecOps IAM Third-party risk Education/awareness training Cybersecurity Insurance Forensics Threat detection Governance Cloud security

What is Zero Trust Security and Why Does It Matter?

Zero Trust: All Assets Untrusted

• Originally developed by Google as part of BeyondCorp™ architecture

• Assumes all assets untrusted; inside the firewall is no safer than outside

• Impacts on all devices, applications, services:o Data-centric approach; requires detailed asset inventoryo Highly granular and scalableo Authentication, authorization, access control at every levelo Firewalls no longer delineate “safe” from “risky”o Encryption everywhere!

Zero Trust: All Assets Untrusted

Zero Trust: Classification is Key

Key Trends: State of Zero Trust Today

Havenow

Planningfor2018

Evaluating

Notplanning(assessedandrejected)

Notplanning

BTAAdoption

ZeroTrustNon-Adopters

ZeroTrustAdopters

Current State: by Success

Successful organizations 2X to 3X more likely to be deploying or planning

Enabling Practices for Zero Trust

Havenow

Planningfor2018

Evaluating

Notplanning

DataClassificationAdoption

ZeroTrustAdopters

Data Classification

Adopters 50% more likely to have implemented

Security Automation

Adopters up to 70% as likely to be automating security

Firewall Architecture

Nofirewalls

Centralized

Distributed

Virtualized

Cloud-based

FirewallArchitecture

ZeroTrustAdopters

Adopters almost twice as likely to have virtualized firewalls

Firewall Architecture

Nofirewalls

Centralized

Distributed

Virtualized

Cloud-based

FirewallArchitecture

ZeroTrustAdopters

Adopters more likely to have centralized firewalls

Enabling Technologies for Zero Trust

Bellwether Technology: Advanced Endpoint Security

• Software that protects endpoints from malware, using a variety of mechanisms (eg microsegmentation)

• Goes far beyond list-based protection offered by traditional anti-malwareWhat it Is

• Represents an architectural/technical “step function” increase over existing technology

• Aligns well with additional strategic initiatives (eg virtualization)

Why We Selected It

• Bromium, Crowdstrike, Invincea, Tanium, Carbon Black (also current versions of Trend Micro, McAfee, Symantec, some capability in Microsoft)

Example Providers

Havenow

Planningfor2018

Evaluating

Notplanning

AESAdoption

ZeroTrustAdopters

Advanced Endpoint Security (AES)

Adopters 2X as likely to have implemented AES

Bellwether Technology: Behavioral Threat Analytics

•Software that integrates multiple sources of data (logs, analytics platforms such as Splunk, SEIM) to capture and display anomalous behavior of users, devices, and systems

What it Is

•Effective use of BTS requires “table stakes” of solid analytics already in place; therefore characterizes more mature organizations

•UBA enables proactive protection against attacks

Why We Selected It

•Bay Dynamics, Gurucul, Exabeam, Splunk/CaspidaExample Providers

Havenow

Planningfor2018

Evaluating

Notplanning

BTAAdoption

ZeroTrustAdopters

Behavioral Threat Analytics

Adopters morelikely to have implemented BTA

Bellwether Technology: Network Access Control

• Tools that authorize devices on the network based on security policiesWhat it Is

• To deploy NAC, organizations need to have a solid authorization and authentication policy in place; that policy becomes the foundation of the zero-trust environment

Why We Selected It

• Cisco, Forescout, HP/Aruba, TrustwaveExample Providers

Havenow

Planningfor2018

Evaluating

Notplanning

NACAdoption

ZeroTrustAdopters

Network Access Control (NAC)

Adopters 2X morelikely to have implemented NAC

Bellwether Technology: Cloud DLP

• Premise or cloud based software that protects content stored on cloudsWhat it Is

• Critical to manage cloud use by employees

• Use implies a relatively mature cloud initiative, including defined policies

Why We Selected It

• Skyhigh, GTB, Cyphercloud, VormetricExample Providers

Havenow

Planningfor2018

Evaluating

Notplanning

CloudDLP

ZeroTrustAdopters

Cloud: Data Loss Prevention

Adopters 60% more likely to have implemented DLP for cloud

Bellwether Technology: CASB

• Premise or cloud based software that automatically detects cloud usage by employees, assesses business and technical risk, and enforces policies

What it Is

• Critical to manage cloud use by employees

Why We Selected It

• BitGlass, BlueCoat/Symantec, Microsoft, Netskope, Skyhigh

Example Providers

Havenow

Planningfor2018

Evaluating

Notplanning

CASBAdoption

ZeroTrustAdopters

Cloud: Cloud Access Security Brokers

Adopters 3X more likely to have implemented CASB

Bellwether Technology: Single Signon as a Service

• Cloud based software that enables single signon to cloud and on-premise resourcesWhat it Is

• Critical to manage cloud and on-premise use by employees

Why We Selected It

• Microsoft, Okta, PingExample Providers

Havenow

Planningfor2018

Evaluating

Notplanning

SSOaaSAdoption

ZeroTrustAdopters

Cloud: Single Signon as a Service

Adopters 2X morelikely to have implemented SSOaaS

What Else? “Shadow” Security

Special Focus: UC Security

• UCC suites may have a range of weaknesseso Lack of privacy (no end-to-end encryption)o Lack of integrated authentication/authorizationo Lack of DLPo Inadequate logging/auditing

• UCC suites are vulnerable to a range of attackso Man in the middle (MITM) attacks exploiting TLS/SSL interceptiono Other TLS/SSL vulnerabilitieso Session hacking

• More-successful companies are ahead of less-successful companies, but very few have effectively addressed all critical areas of UCC security

“Shadow IoT” Security

Planned IoT initiative: • Strategy, architecture, roadmap• Clear business goals• Defined security budget• Defined project team• Can be integrated into

overarching security strategy

Shadow IoT:• No strategy,

architecture,roadmap• No clear business goals or

operational processes• No defined project team

(responsibility split among facilities, lines of business, IT)

• No budgetBiggest IoT threat!!

Putting “Sec” Into DevSecOps

Configuration management

Continuous Delivery

MonitoringVersion Control

Test and Build

Security

Current State: Slouching Towards DevSecOps

InfoSec AppSec

DevOps AppSec

DevSecOps

AppSec Staffing: More is Better

More than one person (indicate

how many)

None; we don't have an infosec person

responsible for

AppSec

One person, and s/he has ONLY

AppSec

responsibility

One person, but s/he has other infosec

responsibilities in

addition

AppSec Staffing: More vs Less Successful

Less Successful

More Successful

Successful companies more likely to have larger AppSec team

Conclusions and Recommendations

• Benchmark SecOps metrics

• Assess cybersecurity maturity

• Develop roadmap for improvement

• Initiate project to assess ZTM

• Review “shadow” infosec areas; launch remediation projects if necessary

Additional Resources

Nemertes Security Strategic Support Program

• For Technology Users (IT, InfoSec, Marketing, other professionals): o Assistance developing policy, business cases, strategy, architecture, roadmap, vendor strategic selection o Data-based guidance on staffing, spending, budgeting, governance, operationso Success metrics for comparable organizations

• For Technology Providers (Vendors, Carriers, VARs):o Market trend and customer sentiment analysiso Data-based guidance on marketing, product strategy, and go-to-market strategieso Objective third-party marketing collateral

• As part of all Nemertes Services:

Ongoing support, telephone advisory service, written inquiries and access to all research

Thank you!

client-services@nemertes.com

sales@nemertes.com

@Nemertes

World-Class Cybersecurity:Lessons from the Experts...World-Class Cybersecurity:Lessons from the...

Documents

Nemertes Research Report

Introduction to Cisco Wide Area Application Services · BRKAPP-1016 Running Applications on the Branch Router ... -Source: Nemertes Research ... Managed) Core Fan-out

Razumijevanje odgoja u filozofiji Johna Deweya

Parcours experts / Experts' route maps

Govori predsjednika Johna F. Kennedyja

MDM! MIDMARKET! Summer’ 14’ - AirWatch · 2017-05-15 · ©Nemertes!Research2014!!PilotHouse!Program!!!!!!888C241C2685!!DN3954! 4! MDM! MIDMARKET!! Introduction’ The!Nemertes!Research!Mobility

Wp Nemertes Virt Security

Nemertes 2010 pilot house awards ip telephony 2 (4)

Let experts be experts

Differential Induction Tumor Necrosis Factor Alpha in ...iai.asm.org/content/59/9/3254.full.pdf · Corynebacteriumpseudotuberculosis, Pasteurella haemolytica, or Lentivirusest JOHNA

University Orchestra - Indiana University Bloomingtonserver1.variations2.indiana.edu/variations/programs/vac2264a.pdf · University Orchestra Violin I Anna Skalova Johna Smith Yu

VideoConferencing! ENTERPRISE! Avaya% · Title: Microsoft Word - Nemertes DN3434 - Video Conferencing Enterprise Top Provider Avaya (Working Copy).docx Author: Chris Zimmerman Created

ShoreTel Unified Communications Platform - Select …select-tele.com/.../shoretel/ShoreTel_UnifiedCommunications.pdf · managed and deployed through the ... Nemertes Research,Fall2009

Exploring and exploiting medical tourism opportunities in - Nemertes

DEEP FREEZE - 03088f8.netsolhost.com03088f8.netsolhost.com/images/OperationDeepFreeze_Part1.pdfOPERATION DEEP FREEZE - 1955-1998 - Aerographers & Meteorolgical Officers 040 JohnA

Everything we know. For You Norse Consulting Amanda Allen Scott Becker Max Colaner Johna Johns Christine Kohrs Ann Steward Terri Stickels

Terry Atkinson, East Carolina University Johna Faulconer, East Carolina University

DN2941 NEC UC Cost Data Project IP (Working Copy) · ©Nemertes!Research!2013! !!! !888624162685 DN2941!! 1" IPTelephonyCostsVaryWidelyAmongVendors;# SeveralFactors’toConsider’BeforeDecisions

NUCLEARCRITICALITYSAFETY: 5-DAYTRAININGCOURSE · NUCLEARCRITICALITYSAFETY: 5-DAYTRAININGCOURSE offered at TheLosAlamosNationalLaboratory EditedandCompiledby JohnA. SchIesser LosAlarms

Fabulous Salads - Johna Blinn