HI MSS Cyb e rse c urity Co mmunity Spo nso r 1
Se c urity F unda me nta ls b a se d o n the NI ST Cyb e rse c urity F ra me wo rk 01.23.2020
Speaker I ntr oduction Ric k Spatafor e CPHI MS, GI SP, GCI H, HCI SPP Ma na g e r, Adviso ry Se rvic e s with Se ntine l T e c hno lo g ie s 15 ye a rs He a lthc a re I T 15 ye a rs c yb e rse c urity & c o mplia nc e 25 ye a rs in te c hno lo g y 3
What ar e c ybe r se c ur ity fundame ntals? 4
Se c ur ity Data & Re se ar c h 5
Atta c ks a re o n the rise (2017, 2018, 2019) • 2017-2018 inc lude d a sma ll inc re a se in b re a c he s • Da ta e xpo se d triple d ye a r o ve r ye a r Ra nso mwa re will c o ntinue AI wa s o ne o f the to p pre dic tio ns fo r 2019 • AI is a g a in a to p pre dic tio n fo r 2020 Clo ud mig ra tio n will inc re a se se c urity risk Clo ud se c urity is no t ma ture Se c ur ity Postur e 6
Threats Resources Capabilities Se c ur ity is no t o ne size fits all 7
Cybe r Kill Chain - Anatomy of an Attac k Re c onnaissanc e – r e se ar c h, ide ntify and se le c t tar ge ts c ommon use of we b site s, soc ial me dia, e ve nt listings, por t sc ans We aponization – pair ing ac c e ss to malwar e with de live r able payload (e .g. Adobe PDF , Mic r osoft Offic e F ile s) De live r y – tr ansmission of we apon to tar ge t (e .g. via e mail, attac hme nts, we bsite s, USB or othe r physic al me dia E xploitation – Onc e de live r e d, the we apon’s c ode is tr igge r e d e xploiting vulne r able applic ations or syste ms Installation – Onc e de live r e d the we apon’s c ode is tr igge r e d, e xploiting vulne r able applic ations or syste ms Command & Contr ol – Outside se r ve r c ommunic ate s with the we apons pr oviding ac c e ss inside the tar ge t’s ne twor k Ac tions on Obje c tive s – Attac ke r wor ks to ac hie ve the obje c tive of the intr usion – e xfiltr ation, data de str uc tion, or intr usion of anothe r tar ge t 8
NIST Cybe r Se c ur ity F r ame wor k IDE NT IF Y PROT E CT DE T E CT RE SPOND RE COVE R Asse t Ma na g e me nt Id e ntity Ma na g e me nt Ano ma lie s a nd E ve nts Re spo nse Pla nning Re c o ve ry Pla nning Busine ss E nviro nme nt Ac c e ss Co ntro l Se c urity Co ntinuo us Co mmunic a tio ns Impro ve me nts Go ve rna nc e Awa re ne ss & T ra ining Mo nito ring Ana lysis Co mmunic a tio ns Risk Asse ssme nt Da ta Se c urity De te c tio n Pro c e ss Mitig a tio n Risk Ma na g e me nt Pro c e ss & Pro c e d ure s Impro ve me nts Supply Cha in Risk Ma inte na nc e Ma na g e me nt Pro te c tive T e c hno lo g y 9
NIST CSF : Ide ntify Identify Asset Management ID.AM-1 ID.AM-1 : Physical devices and systems within the organization are inventoried ID.AM-2 ID.AM-2: Software platforms and applications within the organization are inventoried ID.AM-3 ID.AM-3 : Organizational communication and data flows are mapped 10
NIST CSF : Ide ntify 11
Protect Identity Management, Authentication and Access Control PR.AC-1 PR.AC-1: Identities and credentials are managed for authorized devices and users PR.AC-4: Access permissions are managed, incorporating the principles of least privilege PR.AC-4 and separation of duties PR.AC-7: Users, devices, and other assets are authenticated (e.g., single-factor, multi-factor) PR.AC-7 commensurate with the risk of the transaction (e.g., individuals’ security and privacy risks and other organizational risks) (1.1) NIST CSF : Prote c t Dig ita l E nro llme nt & Authe ntic a tio n & F e de ra tio n & I de ntity I de ntity L ife c yc le Asse rtio n Guide line s Pro o fing Ma na g e me nt 12
Password: x Password: Locu$t0% Passphrase: I like to vacation in Hawaii! 13
NIST CSF : Prote c t 14
NIST CSF : Prote c t Information Protection, Processes & Procedures PR.IP-1: A baseline configuration of information technology/industrial control systems is PR.IP-1 created and maintained (e.g. concept of least functionality) PR.IP-2 PR.IP-2: A System Development Life Cycle to manage systems is implemented PR.IP-12 PR.IP-12: A vulnerability management plan is developed and implemented PR.PT-3: The principle of least functionality is incorporated by configuring systems to PR.PT-3 provide only essential capabilities (1.1) 15
Protect Information Protection, Processes & Procedures PR.IP-12 PR.IP-12: A vulnerability management plan is developed and implemented Detect Security Continuous Monitoring NIST CSF : DE.CM-8 DE.CM-8: Vulnerability scans are performed Prote c t & De te c t 16
NIST Cybe r se c ur ity F r ame wor k 17
Q&A C o n ta c t In fo rm a tio n : Ric k Spa ta fore Ma na g e r, Advisory Se rvic e s Se ntine l T e c hnolog ie s Offic e : 630.786.8062 rspa ta fore @se ntine l.c om 18
Recommend
More recommend
