National Council of County Association Executives Kristin Judge - PowerPoint PPT Presentation

National Council of County Association Executives Kristin Judge Executive Director Trusted Purchasing Alliance Center for I nternet Security William F . Pelgrin CIS President & CEO MS-ISAC Chair

Center for Internet Security CIS Trusted Security MS-ISAC Purchasing Benchmarks Alliance

We Are All Digitally Connected!

Cyber Security Challenges • Hacktivism • Mobile Devices • Social Netw orking • I nsider Threats & Hum an Error • Phishing • Old infrastructure

Hacktivism

Hacktivism “Attacking corporations, governments, organizations and individuals…to make a point” Sophos 2012 Hacktivist groups have attacked: • Private corporations • Federal Government • City.gov sites • Law enforcement groups

Mobile Devices

Mobile Device Deployment Will Continue to Increase Smart phones will surpass computers as web users' preferred vehicle for surfing the Internet

Smartphones -- Blackberries Security Risks -- Too Many Individuals Still… – don’t use encryption, passwords, time-out settings or any other security protection – store their sensitive corporate information on smartphones – lose one of these devices at some point

Leaving your laptop or PDA unattended can lead to big problem s… More than 1 0 ,0 0 0 laptops are reported lost every w eek at 3 6 of the largest U.S. airports, and 6 5 percent of those laptops are not reclaim ed. Ponemon Institute

Social Netw orks

Threats • 30,000 new malicious URLs every day…approximatel y one every three seconds Sophos Security Threat Report 2012 95% of comments to blogs, chat rooms and message boards are spam or contain malicious links. Websense

Danger In TinyURL Links...

Risk is growing Cyber attacks on social networks are up 70% Sophos, 2010 Just 19% of government agencies ban social media sites at work, down from 55% in 2010 Sophos, 2012

I nsider Threat and Hum an Error

Insider Threats are Real… Can be intentional or accidental • WikiLeaks – Hundreds of thousands of confidential documents leaked by military employee • Inadvertent posting of the Social Security numbers and birth dates of 22,000 government retirees on a state procurement website • Disgruntled city employee tampers with city network to deny access to top administrators

Human Error example– bad passwords! tomshardware.com

Phishing

Phishing scams entice email recipients into clicking on a link or attachment w hich is malicious. WELL WRITTEN APPEARS CREDIBLE ENTICING OR SHOCKING SUBJECT APPARENT TRUSTED SOURCE

Old I nfrastructure

 Old hardware and software that is beyond the end of its support life  No longer supported by the vendors  Using them after end of life places your organization at great risk since any security vulnerability will NOT be fixed, making it easy for hackers to launch a successful cyber attack

How Can You Be More Secure? • Create and follow organizational information security policies • Use strong passwords (minimum 8 characters and include upper and lower case, numbers and special characters) • Don’t click on links in emails • Don’t open attachments from unknown sources • Protect your mobile devices

The MS-ISAC is here to help!

MS-ISAC Member AK MS-ISAC MS-ISAC Member Member MS-ISAC MS-ISAC MS-ISAC Member Member MS-ISAC MS-ISAC Member Member Member MS-ISAC MS-ISAC MS-ISAC MS-ISAC Member Member MS-ISAC MS-ISAC Member Member MS-ISAC MS-ISAC Member Member MS-ISAC Member Member Member MS-ISAC MS-ISAC MS-ISAC Member Member Member MS-ISAC MS-ISAC MS-ISAC MS-ISAC Member Member MS-ISAC Member Member Member MS-ISAC MS-ISAC MS-ISAC MS-ISAC Member Member Member MS-ISAC MS-ISAC MS-ISAC Member Member Member Member MS-ISAC MS-ISAC MS-ISAC MS-ISAC Member Member Member Member MS-ISAC Member MS-ISAC MS-ISAC Member Member MS-ISAC MS-ISAC Member MS-ISAC Member Member MS-ISAC MS-ISAC MS-ISAC Member Member MS-ISAC MS-ISAC Member Member Member MS-ISAC Member MS-ISAC Member MS-ISAC HI Member MS-ISAC Member Am erican Sam oa A Trusted Model for Collaboration and Cooperation across All States, Local Governments and Several U.S. Territories—Built on over 8 years of Centralized Outreach, Awareness and Bidirectional Information Sharing.

MS-ISAC Security Operations Center 24x7x365 Operations Monitoring Situational Awareness Incident Response Advisory & Analysis Services

Multi-State Information Sharing and Analysis Center Products and Services • 24/7 Cyber Security Analysis • National Webcast Initiative Center • National Cyber Security • Cyber Security Alerts and Awareness Month Advisories • Monthly Conference Calls; • Public and Secure MS-ISAC Annual Meeting Websites • Ensuring collaboration with • Participation in cyber all necessary parties exercises • Common cyber alert level map

MS-I SAC Public W ebsite

Advisories & Daily Tips

Monthly New sletters The MS-ISAC distributes the newsletters in a template form so they can be re- branded and distributed broadly throughout states and local governments

Cyber Security Guides

Cyber Security Awareness Toolkit

Multi-State I nform ation Sharing and Analysis Center We’re Here To Help!! Kristin Judge Kristin.judge@cisecurity.org 518-368-8824 Cyber Security is our Shared Responsibility w w w .cisecurity.org