Security challenges within an Information System Directorate Works of the RWG’s 5th meeting on Computer Development 25/04/2019 DGD/DSID/Pôle Sécurité 1
Security challenges within an Information System Directorate 29/04/2019 DGD/DSID/Pôle Sécurité 2
table of content CONTEXT VULNERABILITIES IS THREAT VECTORS HACKERS PROFILES CYBERATTACKS EXAMPLE CYBERSECURITY GOUVERNANCE 25/04/2019 DGD/DSID/Pôle Sécurité 3
Context (1/2) Strong IT Partnership dependency outreach Protection of the Digitalization economy Contribution to Trade security the State budget Business facilitation 25/04/2019 DGD/DSID/Pôle Sécurité
Context (2/2) RESPECT OF INTERNATIONAL COMPLIANCE AGREEMENTS AND TREATIES Legislation ( Customs Code, cyber criminality, personal data protection, Code of Telecoms, e ‐ transactions, etc ) Standards(ISO 270XX, 900X, PCI ‐ DSS, SANS, OWASP, NIST, CC, Bale II ‐ III ) 25/04/2019 DGD/DSID/Pôle Sécurité
IS VULNERABILITIES Technical Organizational Human ressources Vulnerabilities Vulnerabilities Vulnerabilities • Contremesures non • Lack of procedure (PSSI, • Lack of human ressources adaptés aux menaces GIS, audit, etc ) of unqualified human ressources • Obsolescence des • Lack of task separation technologies utilisées • Lack of staff awareness • Lack of rôle definition on cybersecurity • défaut ou mauvaise and responsabilities configuration • Misunderstanding of • No organization of the procedures • Défaut Conceptuel security • Etc.cf Mehari • Etc. cf base vuln Mehari, • cf base vulnérabilité vulnerabilities database, Ebios, 27005 Mehari vulnerabilities Ebios, 27005 database, Ebios, 27005 25/04/2019 DGD/DSID/Pôle Sécurité 6
Threath vectors (1/2) • The art to persuade someone to give away a confidential information une SOCIAL ENGINEERING personne de révéler une information confidentielle • Social Networks can contribute and facilitate the loss of control on strategic Social Networks information • Mail PHISHING •Links •Attachments • Injection: remote code execution WEB APPLICATION • Cross ‐ Site Scripting : attacks on the client’s side • Violation de Gestion d'Authentification et de Session: authorisation and authentification • USB, REMOVABLE DRIVES • keyboard, • CD, etc • Technology implementation ( applications, services, storage function and Shadow IT information sharing) within collaborators without the need of the CIO Physical intrusion • The hacker accesses the location of its victim so he directly connects. 25/04/2019 DGD/DSID/Pôle Sécurité/Team Pentest 7
Threat vectors2/2 29/04/2019 Verizon ‐ DBIR_2018 ‐ Main_report.pdf 8
HACKER PROFILES 1/2 PROFILES MOTIVATIONS � Financial Expert commissioned � Sabotage � Ideology Hacktivists � State interests Cyber ‐ soldiers � Financial Malicious user � None (nuisance by mistake) � Sabotage Malicious staff � Financial � Financial Furniture Provider � Financial Service provider � Espionnage partners � Renommée Cybercriminals � Financières 29/04/2019 DGD/DSID/Pôle Sécurité 9
HACKERS PROFILES 2/2 29/04/2019 Verizon ‐ DBIR_2018 ‐ Main_report.pdf 10
EXAMPLES OF CYBER ‐ ATTACKS Examples of cyber ‐ attacks in the intrnational transit sector Military Sealift Anvers’ Port IRISL (Islamic Republic MAERSK Command of Iran Shipping Lines) • The attack was detected in • The attack was detected June 2011 and were • The attack targetted a sailing by the end of June 2017 • The attack occured in commissioned by a drug squad shuttle of the Military Sealift and was done by a group august 2011 and all the trying to high ‐ jack containers Command : many systems of hackers. MAERSK a lost date the company had on and to circulate drug coming would have been compromised nearly 300 millions dollars from Latin America by stealing its cargos were deleted. by the chineses armyaccording because of this attack. agents’ passcodes. The commissioner remains to a report from the American unknown. Senate. 25/04/2019 DGD/DSID/Pôle Sécurité 11
Cybersecurity Governance (1/2) • Engagement from the Top Management • Organization ( rôles and responsability, institutions) • Ressources • Tools 25/04/2019 DGD/DSID/Pôle Sécurité 12
Cybersecurity Governance (2/2) 25/04/2019 cisecurity.org/controls 13
Thank you ‐ Jerejef Ressources humaines Process 29/04/2019 DGD/DSID/Pôle Sécurité 14
Recommend
More recommend
