Less Security Products, More Secured Products You are squinting if you can read this
Which is Worst? ERP system down for a week or Customer Data Hacked | slide 2
Less Security Products, More Secured Products You are squinting if you can read this
1. Introduction – Kin Kwan, TELUS Health Agenda 2. What is Cyber Security? 3. Recent News and Trends 4. What Business Analysts Should Know about Cyber Security Everything Can Be Hacked Data Sensitivity Cyber Security is Risk Management BA is a Technical Liaison Cyber Security Requirements TELUS Restricted
Exercise #1 https://vimeo.com/29985766 | slide 5
Presenter Security Officer TELUS Health Position Overview • Manage the Information/Cyber Security Program for TELUS Health * Responsibilities • Governance, Risk, and Compliance • Collaborate with TELUS CSO • Internal & External Communication • Don’t get hacked / Demonstrate due-diligence | slide 6 | slide 6
Cyber Threat World Map | slide 7
What is Cyber Security? | slide 8
Exercise #2 | slide 9
Exercise #3 https://www.youtube.com/watch?v=4gR562GW7TI | slide 10
What motivates Hackers? 1.Financial Gain (ransom) 2. Espionage (competition) 3. FIG (fun, ideology, and grudge) 4. Other (errors, glitches, etc.) | slide 11 | slide 11
Cyber Security – Most Targeted Industry 1.PHI/PII is very lucrative (10x) 2. Legacy Equipment (XP) 3. High Impact (Life or Death) 4. Very Connected | slide 12 | slide 12
Cyber Security – Recent News and Trends World’s Biggest Data Breaches | slide 13
Ransomware https://www.youtube.com/watch?v=2sNrhcVGbx0 | slide 14
Ransomware | slide 15
Equifax – 4 th Largest Hack in History What Happened? • Impact - 145.5 million records (8K Canadians) leaked (Full Name, SSN/SIN, BOD, Address, Driver’s License, Credit Cards, Bank Accounts, etc.) • Root Cause: Unpatched application bug (Apache Struts) • Company Impact: • 24% drop in stock price, Q3 earning TBD • CEO, CISO, CIO “retired” Core Lessons • Application security is critical • Layers of Defense is more critical and reinforcement of the “difficult basics” (patching, vulnerability scanning, incident management, etc.) • Compliance driven approach is not adequate - must go above and beyond • Accountability is becoming the new norm • We are all in this together | slide 16 | slide 16
Looking Back at 2017 and Looking Forward at 2018 • Large Data Breaches is becoming the New Norm • More Large Data Breaches •Equifax (145m) • $150 per record •Yahoo (3b) •Uber (57m) • Compliance – GDPR (May 2018), Fines •Nissan Canada (1.13m) and Notification rules •Deloitte •DNC (Trump won) •HBO (GoT) • Market Consolidation - M&A • Security market 50% growth (85m market • Ransomware continue to increase (1b) cap) • Poor security habits continues • Cloud Security remains a top risk • Poor passwords • Lack of patching • People are still the Weakest Link • Out-of-date anti-virus software • Lack of monitoring • Ransomware – “WannaCry” • Legacy systems and application • API • Perimeter is disappearing • IoT (11b) 2017 2018 2018 | slide 17 | slide 17
What BAs Should Know about Cyber Security? Everything Can Be Hacked Data Sensitivity Security is Risk Management BA is a Technical Liaison Cyber Security Requirements | slide 18
Everything Can Be Hacked Know Your Crown Jewels | slide 19 | slide 19
Data Sensitivity Not All Data are Equal | slide 20 | slide 20
Security is Risk Management Don’t Accept the Risk On Your Own!! | slide 21 | slide 21
BA is a Technical Liaison Consult with Privacy and Security Groups Business Cyber Security Ensuring Compliance with Internal Policies and External Regulations (PCI, PIPA) Business Cases and Budgeting | slide 22 | slide 22
Cyber Security Requirements | Secure-by-Design Similar to resilient-by-design or privacy-by-design, secure-by-design specifies that security must be included in the fundamental design of the system, application or solution from the ground up . This differs from current approaches that identify security later and treat it as a layer that can be added to an existing design to make it secure, or a technique that can be applied at a discrete point in the process. | slide 23 | slide 23
Exercise #3 Hawaiian Emergency Management Officials Hold Interview | slide 24
Contact • Kin.Kwan@Hotmail.com • https://www.linkedin.com/in/kinkwan/ | slide 25
Recommend
More recommend
