CSIRT capability building and enhancement
|
|
|
- Herbert Stewart
- 6 years ago
- Views:
Transcription
1 CSIRT capability building and enhancement CNCERT/CC 05 Conference March 2005 Guilin. Mark McPherson AusCERT The University of Queensland Brisbane, Queensland 4072 AUSTRALIA
2 Overview What is a CSIRT? Building Capability Enhancing Capability
3 What is a CSIRT? (1) Definition Types and examples
4 What is a CSIRT? (2) An Incident Response Team (IRT) concerned with Computer Security. +
5 But, how do IRTs respond? IR is the act of doing something when a computer security incident occurs IR can be an ad-hoc activity OR Can take-place according to a predefined IR plan Predefined IR plans: usually nominate an Incident Response Team (IRT) An IRT : has predefined roles and responsibilities acts when an incident occurs or when a precondition is met eg The CEO s PC is attacked..
6 IRT - Types and examples An Incident Response Team (IRT) can be: An Incident-handling team (aka CSIRT) On-site hands-on intervention team (eg Corporate or University IRT) A First Responder team (eg Law Enforcement - electronic Evidence Team [EET])
7 CSIRTs - types and examples (1) An Incident Response Team (IRT) can be: An Incident-handling team (aka CSIRT) What AusCERT does ie Receives reports, provides advice, acts as a liaison between involved parties, disseminates information
8 CSIRTs - types and examples (2) On-site hands-on intervention team (eg Corporate or University IRT) An emergency team who physically respond to confirmed or probable incidents Take a hands-on approach to mitigation
9 CSIRTs - types and examples (3) A First Responder team Forensic analysis teams (some Corporate IRTs do this ) Legal analysis by law enforcement eg Electronic Evidence Team (EET)
10 Building CSIRT capability (1) Establish the mandate or mission Determine constituents/clients Define services and scope Determine staff and other resources required Consider available financial models Study existing models/csirts Build a library
11 Building CSIRT capability (2) Attend conferences and training Existing staff Hire expertise Hire experienced staff or Train new staff Run in trial mode Liaise with other CSIRTs To ascertain performance Get client feedback
12 Enhancing capability Two example areas for enhancement: Capabilities of the CSIRT Capabilities of the IR team members
13 Enhancing capabilities of the CSIRT Adding value through enhanced member services Improvement of existing services Creation of new services
14 Enhancing capabilities of the IR team members Honing your teams skills using fire drills Role-playing Live Drills
15 Enhancing capabilities of the IR team members Other ideas Build a testing lab Basic research etc.. Take-on technical projects Work with other security organisations/agencies Eg Industry groups, Universities, Police
16 Enhanced member services Determining the work required Analysis of member satisfaction Surveys Feedback forums meetings, BOFs Membership churn Face-to-face member forums Conferences Industry groups and initiatives
17 Enhancing member services Improving existing services Examples: Member profiled information Advisories/bulletins Environment and OS-specific information FAQs / Best Practice guides Automated incident response Info-only or Member-driven reporting Extended Incident Response On-site or personalised services
18 Enhanced member services Creating new services Interactive services Member-only web-access Discussion groups/forums/mailing lists Monitoring/facilities management Networks (eg DoS) Websites (eg defacements) Early-warning services eg SMS
19 Fire drill role-playing (1) Purpose: Tests a team s theoretical knowledge/experience Improvement of current IR processes
20 Fire drill role-playing (2) The scenario Exterminate!!! Evaluation of answers Processing lessons-learned
21 Fire drill role-playing (3) Example scenario: Playing one side against the other Corporation s management announces a secret penetration test Informs IRT and asks to report actions of Site security team Site security team reports possible attack IRT logs the call Site security team deals with the attack and reports results IRT reports actions of Site security team to Management Corporation s management analyses security team s performance Site security team complains to IRT about a lack of responsible disclosure!
22 Purpose: Fire drill Live Drills (1) Test the teams effectiveness and practical application Improvement of current IR processes
23 Fire drill Live Drills (2) The Drill The actors The scenario The events and triggers Evaluation Critique of actions taken Processes lessons-learned Refresh policies and procedures
24 Summary CSIRT types: CSIRT, on-site IRT & First-responder (eg EET) Starting-up (Building Capability): Mandate, Scope, Resourcing, Finance, Models, Library, Conferences, Staff expertise, Trial, Liaison & Feedback. Continuing evolution (Enhancing Capability): CSIRT: Improved & new services Team Members: Fire drills role-playing & live tests
25 References Defining Incident Management Processes for CSIRTs: A work in progress Handbook for Computer Security Incident Response Teams (CSIRTs) Incident Response, Kenneth R. Van Wyk & Richard Forno, OReilly & Associates, 2001 AusCERT course (AUS-CSIRT-02) : Establishing a Computer Security Incident Response team (CSIRT) - for Technical Staff and IRT Managers, 2004
26 Questions?
27 Xie-Xie!
Building Global CSIRT Capabilities
Building Global CSIRT Capabilities Barbara Laswell, Ph.D. September 2003 CERT Centers Software Engineering Institute Carnegie Mellon Pittsburgh, PA 15213 Sponsored by the U.S. Department of Defense 1 2003
RFC2350 TLP1: WHITE. Έκδοση National CSIRT-CY RFC2350
Έκδοση 1.2-2018.02.14 TLP1: WHITE 1 TLP Sources may use TLP: WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release.
CSIRT in general CSIRT Service Categories Reactive Services Proactive services Security Quality Management Services CSIRT. Brmlab, hackerspace Prague
Brmlab, hackerspace Prague Lightning talks, November 2016 in general in general WTF is an? in general WTF is an? Computer Security in general WTF is an? Computer Security Incident Response in general WTF
Defining Computer Security Incident Response Teams
Defining Computer Security Incident Response Teams Robin Ruefle January 2007 ABSTRACT: A computer security incident response team (CSIRT) is a concrete organizational entity (i.e., one or more staff) that
Forensics and Active Protection
Forensics and Active Protection Computer and Network Forensics Research Project 2003 Work Update Yanet Manzano Florida State University manzano@cs.fsu.edu manzano@cs.fsu.edu 1 Outline CNF Project Goal
Incident Response Lessons From the Front Lines. Session 276, March 8, 2018 Nolan Garrett, CISO, Children s Hospital Los Angeles
Incident Response Lessons From the Front Lines Session 276, March 8, 2018 Nolan Garrett, CISO, Children s Hospital Los Angeles 1 Conflict of Interest Nolan Garrett Has no real or apparent conflicts of
Panel 1 National CSIRT Experience
Panel 1 National CSIRT Experience 2 nd Meeting of Government Cybersecurity Practitioners Sao Paulo, Brazil September 14-16, 2005 Andrew McAllister Senior Advisor, Cyber Security Public Safety and Emergency
COMPUTER EMERGENCY RESPONSE TEAM (CERT) INTRODUCTION
COMPUTER EMERGENCY RESPONSE TEAM (CERT) INTRODUCTION AfNOG 9 th June 2013 14 th June 2013 Lusaka, Zambia By Marcus K. G. Adomey OUTLINE Definition of CERT Acronyms of CERT Types of CERT History of CERT
Presentation to the ITU on the Q-CERT Incident Management Team. Ian M Dowdeswell Incident Manager, Q-CERT
Presentation to the ITU on the Q-CERT Incident Management Team Ian M Dowdeswell Incident Manager, Q-CERT 2 Q-CERT Mission The Mission of Q-CERT is to be a world-class center of excellence providing expert
Regional Workshop on Frameworks for Cybersecurity and CIIP Feb 2008 Doha, Qatar
Regional Workshop on Frameworks for Cybersecurity and CIIP 18 21 Feb 2008 Doha, Qatar A National Cybersecurity Strategy aecert Roadmap Eng. Fatma Bazargan aecert Project Manager Technical Affairs Department
CIRT: Requirements and implementation
CIRT: Requirements and implementation By : Muataz Elsadig Sudan CERT Joint ITU-ATU Workshop on Cyber-security Strategy in African Countries Khartoum, Republic of Sudan, 24 26 July 2016 There is no globally
Incident response in the energy
Incident response in the energy sector Margrete Raaum, Statnett SF and FIRST, Forum of Incident Response and Security Teams 4SICS, October 23. 2014 Incident response IR is more than just a characterization
An overview of the CERT/CC and CSIRT Community
An overview of the CERT/CC and CSIRT Community Jason A. Rafail October 2007 2007 Carnegie Mellon University Overview CERT/CC CSIRTs with National Responsibility Partnerships and Trust Training Conclusion
Creating and Managing Computer Security Incident Response Teams (CSIRTs)
Creating and Managing Computer Security Incident Response Teams (CSIRTs) CERT Coordination Center Networked Systems Survivability Program Software Engineering Institute Carnegie Mellon University Pittsburgh,
Current procedures, challenges and opportunities for collection and analysis of Criminal Justice statistics CERT-GH
Current procedures, challenges and opportunities for collection and analysis of Criminal Justice statistics CERT-GH International Workshop on Criminal Justice Statistics on Cybercrime and Electronic Evidence
MANAGEMENT OF INFORMATION SECURITY INCIDENTS
MANAGEMENT OF INFORMATION SECURITY INCIDENTS PhD. Eng Daniel COSTIN Polytechnic University of Bucharest ABSTRACT Reporting information security events. Reporting information security weaknesses. Responsible
IMPACT Global Response Centre. Technical Note GLOBAL RESPONSE CENTRE
Technical Note GLOBAL RESPONSE CENTRE INTRODUCTION IMPACT s Global Response (GRC) acts as the foremost cyber threat resource centre for the global. It provides emergency response to facilitate identification
UNCLASSIFIED. National and Cyber Security Branch. Presentation for Gridseccon. Quebec City, October 18-21
National and Cyber Security Branch Presentation for Gridseccon Quebec City, October 18-21 1 Public Safety Canada Departmental Structure 2 National and Cyber Security Branch National and Cyber Security
Be Secure! Computer Security Incident Response Team (CSIRT) Guide. Plan Establish Connect. Maliha Alam Mehreen Shahid
Computer Security Incident Response Team (CSIRT) Guide Maliha Alam Mehreen Shahid Plan Establish Connect Be Secure! CSIRT Coordination Center Pakistan 2014 i Contents 1. What is CSIRT?... 1 2. Policy,
Best Practices in Public Information Management in Sri Lanka. Presented by Nimal Athukorala D.C. Dissanayake
Best Practices in Public Information Management in Sri Lanka Presented by Nimal Athukorala D.C. Dissanayake Content Objectives Method of Information Management Case Study- GIC Call Center GIC Web Portal
Stakeholders Analysis
Stakeholders Analysis Introduction National Stakeholders ISP citizens CNIIP Media National CIRT Academia ONG, Public And Private Institutions sectoral CSIRTs Law enforcement 2 2 CIRT ISP A specialized
Integrating Cyber Security with Business Continuity Management to Build the Resilient Enterprise
February 11 14, 2018 Gaylord Opryland Resort and Convention Center, Nashville #DRI2018 Integrating Cyber Security with Business Continuity Management to Build the Resilient Enterprise Tejas Katwala CEO
IT Security Trends. The Australian Perspective. a presentation by. Viviani Paz, Security Assurance Manager
IT Security Trends The Australian Perspective a presentation by Viviani Paz, Security Assurance Manager Australian Computer Emergency Response Team The University of Queensland Brisbane, Queensland 4072
PTLGateway Data Breach Policy
1 PTLGateway Data Breach Policy Last Updated Date: 02 March 2018 Data Breach Policy This page informs you of our policy which is to establish the goals and the vision for the breach response process. This
The latest version of this profile can be found on the location specified in 1.3
FORTHcert Profile according to RFC 2350 1. About this document 1.1 Date of Last Update This is version 1, published 2012/02/1. 1.2 Distribution List for Notifications The latest version of this profile
Bradford J. Willke. 19 September 2007
A Critical Information Infrastructure Protection Approach to Multinational Cyber Security Events Bradford J. Willke 19 September 2007 Overview A framework for national Critical Information Infrastructure
INDONESIA S PERSPECTIVE ON CYBER TERRORISM
INDONESIA S PERSPECTIVE ON CYBER TERRORISM CYBER TERRORISM No generally acceptable definition Cyber terrorism is one form of terrorism that use computer resources to launch terror attacks on critical infrastructures
Co-operation against cybercrime CSIRTs LE private sector
Co-operation against cybercrime CSIRTs LE private sector Octopus Interface 2010 Kauto Huopio Sr. Infosec Advisor Finnish Communications Regulatory Authority CERT-FI Finnish national CSIRT authority { National
Springforward, Inc. Capability Statement Section 508 Compliance
Springforward, Inc. Capability Statement Section 508 Compliance Point of Contact: Springforward, Inc. Kimberly June, CEO 410.382.9302 (Mobile) kjune@springforwardtek.com www.springforwardtek.com Table
SANS 2017 SOC Survey. A Mile of Numbers and a Ton of Stats. Christopher Crowley All Rights Reserved All Wrongs Reversed
SANS 2017 SOC Survey A Mile of Numbers and a Ton of Stats Christopher Crowley twitter: @CCrowMontance All Rights Reserved All Wrongs Reversed Two Webcasts There are two webcasts covering additional aspects
New York Cybersecurity. New York Cybersecurity. Requirements for Financial Services Companies (23NYCRR 500) Solution Brief
Publication Date: March 10, 2017 Requirements for Financial Services Companies (23NYCRR 500) Solution Brief EventTracker 8815 Centre Park Drive, Columbia MD 21045 About EventTracker EventTracker s advanced
Incident Response Services
Services Enhanced with Supervised Machine Learning and Human Intelligence Empowering clients to stay one step ahead of the adversary. Secureworks helps clients enable intelligent actions to outsmart and
CSIRT SERVICES. Service Categories
CSIRT SERVICES One of the primary issues to be addressed in creating a computer security incident response team (CSIRT) is deciding what services the CSIRT will provide to its constituency. This process
ITU Regional Cybersecurity Forum for Asia-Pacific
ITU Regional Cybersecurity Forum for Asia-Pacific Incident Management Capabilities Australia Country Case Study Graham Ingram General Manager AusCERT July 2008 Copyright 2008 AusCERT Not for further distribution
Forensic analysis with leading technology: the intelligent connection Fraud Investigation & Dispute Services
Forensic Technology & Discovery Services Forensic analysis with leading technology: the intelligent connection Fraud Investigation & Dispute Services Forensic Technology & Discovery Services EY s Forensic
Incident Response Services to Help You Prepare for and Quickly Respond to Security Incidents
Services to Help You Prepare for and Quickly Respond to Security Incidents The Challenge The threat landscape is always evolving and adversaries are getting harder to detect; and with that, cyber risk
Position Description. Computer Network Defence (CND) Analyst. GCSB mission and values. Our mission. Our values UNCLASSIFIED
Position Description Computer Network Defence (CND) Analyst Position purpose: Directorate overview: The CND Analyst seeks to discover, analyse and report on sophisticated computer network exploitation
Bridging the gap: SOC and CSIRT
Bridging the gap: SOC and CSIRT Mitchell Webb, HP SIOC Anthony Polzine, Protiviti What is Incident Management? Incident Management involves preparing for, identifying and responding effectively to an incident
Workshop on Cyber Security & Cyber Crime Policies. Policies for African Diplomats
Workshop on Cyber Security & Cyber Crime Policies Policies for African Diplomats ROLE OF INTERPOL IN FIGHTING CYBERCRIME IN AFRICA SRIAU Office Augusto de CARVALHO 12-13 APRIL 2018 ADDIS ABABA OVERVIEW
Creating the Enterprise CSIRT: Building the ecrime Response Platform
Creating the Enterprise CSIRT: Building the ecrime Response Platform Lic. Julio C. Ardita, CISM jardita@cybsec.com May 2010 Counter-eCrime ecrime Operations Summit (CeCOS)) IV Sao Paulo, Brasil Agenda
European Union Agency for Network and Information Security
Critical Information Infrastructure Protection in the EU Evangelos Ouzounis Head of Secure Infrastructure and Services Regional Cybersecurity Forum Sofia, Bulgaria 29 th November 2016 European Union Agency
RFC 2350 CSIRT-TEHTRIS [CERT-TEHTRIS]
![RFC 2350 CSIRT-TEHTRIS [CERT-TEHTRIS]](/thumbs/74/71015564.jpg "RFC 2350 CSIRT-TEHTRIS [CERT-TEHTRIS]")
RFC 2350 CSIRT-TEHTRIS [CERT-TEHTRIS] 1 Document information... 2 1.1 Date of Last Update... 2 1.2 Distribution List for Notifications... 2 1.3 Locations where this Document May Be Found... 2 1.4 Authenticating
Incident Response. Is Your CSIRT Program Ready for the 21 st Century?
Incident Response Is Your CSIRT Program Ready for the 21 st Century? Speaker Bio Traditional Response Concepts Technical Incidents Requiring Technical Responses Virus/ Malware Network Intrusion Disaster
The rise of major Adversaries is the most relevant trend in 2014, targeting Government and Critical Services
The rise of major Adversaries is the most relevant trend in 2014, targeting Government and Critical Services Major Trends of 2014 And relevant changes in Threat Scenario Most Target Countries and Sectors
The Case for National CSIRTs
The Case for National CSIRTs ENOG 12 Yerevan 3-4 Oct 2016 What is a CERT (CSIRT)? A Computer Security Incident Response Team (CSIRT) is a service organization that is responsible for receiving, reviewing,
CYBER RESILIENCE & INCIDENT RESPONSE
CYBER RESILIENCE & INCIDENT RESPONSE www.nccgroup.trust Introduction The threat landscape has changed dramatically over the last decade. Once the biggest threats came from opportunist attacks and preventable
ITU-IMPACT Capacity Building for Least Developed & Developed Countries
ITU-IMPACT Capacity Building for Least Developed & Developed Countries Marco Obiso Cybersecurity Coordinator International Telecommunication Union (ITU) 30 January 2012 ITU and cybersecurity 2003 2005
6 CONCLUSION AND RECOMMENDATION
CONSTITUENTS OF THE DOMAIN SPECIFIC CYBER SECURITY MANDATE FOR THE INDIAN POWER SECTOR 6 CONCLUSION AND RECOMMENDATION 6.1 OVERVIEW This section reviews the recommendations for enhancing cyber security
Package of initiatives on Cybersecurity
Package of initiatives on Cybersecurity Presentation to Members of the IMCO Committee Claire Bury Deputy Director-General, DG CONNECT Brussels, 12 October 2017 Building EU Resilience to cyber attacks Creating
Directive on security of network and information systems (NIS): State of Play
Directive on security of network and information systems (NIS): State of Play Svetlana Schuster Unit H1 Cybersecurity and Digital Privacy DG Communications Networks, Content and Technology, European Commission
Cisco PSIRT Dario Ciccarone Incident Manager, Product Security Incident Response Team
1 Cisco PSIRT Dario Ciccarone Incident Manager, Product Security Incident Response Team 2005, Cisco Systems, Inc. All rights reserved. CISCO CONFIDENTIAL 2 What Is PSIRT? Cisco s Product
Chapter 4 After Incident Detection
Chapter 4 After Incident Detection Ed Crowley Spring 10 1 Topics Incident Response Process SANs Six Step IR Process 1. Preparation 2. Identification 3. Containment 4. Eradication 5. Recovery 6. Lessons
Eliminating the Blind Spot: Rapidly Detect and Respond to the Advanced and Evasive Threat
WHITE PAPER Eliminating the Blind Spot: Rapidly Detect and Respond to the Advanced and Evasive Threat Executive Summary Unfortunately, it s a foregone conclusion that no organisation is 100 percent safe
CYBER INCIDENT REPORTING GUIDANCE. Industry Reporting Arrangements for Incident Response
CYBER INCIDENT REPORTING GUIDANCE Industry Reporting Arrangements for Incident Response DfT Cyber Security Team CYBER@DFT.GSI.GOV.UK Introduction The Department for Transport (DfT) has produced this cyber
NEN The Education Network
NEN The Education Network School e-security Checklist This checklist sets out 20 e-security controls that, if implemented effectively, will help to ensure that school networks are kept secure and protected
Question 1: What steps can organizations take to prevent incidents of cybercrime? Answer 1:
Cybercrime Question 1: What steps can organizations take to prevent incidents of cybercrime? Answer 1: Organizations can prevent cybercrime from occurring through the proper use of personnel, resources,
NIS Directive : Call for Proposals
National Cyber Security Centre, in Collaboration with the Research Institute in Trustworthy Inter-connected Cyber-physical Systems (RITICS) Summary NIS Directive : Call for Proposals Closing date: Friday
July 31, University of Maryland Emergency Management Faculty Staff Essentials
July 31, 2015 University of Maryland Emergency Management Faculty Staff Essentials What is Emergency Management? 2 What is Emergency Management? The process of preparing for, mitigating, responding to
RFC 2350 YOROI-CSDC. Expectations for Computer Security Incident Response. Date 2018/03/26. Version 1.0
RFC 2350 YOROI-CSDC Expectations for Computer Security Incident Response Title RFC 2350 YOROI-CSDC Document Type Specification Date 2018/03/26 Version 1.0 Yoroi S.r.l. Parte del gruppo MAM www.yoroi.company
CCISO Blueprint v1. EC-Council
CCISO Blueprint v1 EC-Council Categories Topics Covered Weightage 1. Governance (Policy, Legal, & Compliance) & Risk Management 1.1 Define, implement, manage and maintain an information security governance
Global Security Advisor
Global Security Advisor Location: [North America] [United States] Category: Security *Preferred location: USA. Other locations will be considered globally where WVI is registered to operate. PURPOSE OF
Security Director - VisionFund International
Security Director - VisionFund International Location: [Europe & the Middle East] [United Kingdom] Category: Security Job Type: Open-ended, Full-time *Preferred location: United Kingdom/Eastern Time Zone
Session 5311 Critical Testing Programs for Security Operations
Session 5311 Critical Testing Programs for Security Operations Introduction Neil Lakomiak UL Rodney Thayer Smithee Spelvin Agnew & Plinge, Inc. Coleman Wolf Environmental Systems Design, Inc. Testing Programs
Directive on Security of Network and Information Systems
European Commission - Fact Sheet Directive on Security of Network and Information Systems Brussels, 6 July 2016 Questions and Answers The European Parliament's plenary adopted today the Directive on Security
Disaster Management and Security Solutions to Usher in the IoT Era
Disaster Management and Solutions for a Safe and Secure Way of Life Overview Disaster Management and Solutions to Usher in the IoT Era Takeshi Miyao Toshihiko Nakano, Ph.D. 1. The Bright and Dark Sides
Information Security Incident
Good Practice Guide Author: A Heathcote Date: 22/05/2017 Version: 1.0 Copyright 2017 Health and Social Care Information Centre. The Health and Social Care Information Centre is a non-departmental body
Regulating Cyber: the UK s plans for the NIS Directive
Regulating Cyber: the UK s plans for the NIS Directive September 2017 If you are a digital service provider or operate an essential service then new security and breach notification obligations may soon
Organizational Structure of the Toronto Environment Office
STAFF REPORT INFORMATION ONLY Organizational Structure of the Toronto Environment Office Date: April 20, 2007 To: From: Wards: Reference Number: Parks and Environment Committee Richard Butts, Deputy City
ISAO SO Product Outline
Draft Document Request For Comment ISAO SO 2016 v0.2 ISAO Standards Organization Dr. Greg White, Executive Director Rick Lipsey, Deputy Director May 2, 2016 Copyright 2016, ISAO SO (Information Sharing
OpenChain Specification Version 1.2 pc6 (DRAFT) [With Edit Markups Turned Off]
![OpenChain Specification Version 1.2 pc6 (DRAFT) [With Edit Markups Turned Off]](/thumbs/76/74078205.jpg "OpenChain Specification Version 1.2 pc6 (DRAFT) [With Edit Markups Turned Off]")
OpenChain Specification Version 1.2 pc6 (DRAFT) [With Edit Markups Turned Off] DRAFT: This is the near final draft of the 1.2 version of the OpenChain Specification. We have recently completed the final
2 ESF 2 Communications
2 ESF 2 Communications THIS PAGE LEFT BLANK INTENTIONALLY Table of Contents 1 Introduction... 1 1.1 Purpose and Scope... 1 1.2 Relationship to Other ESF Annexes... 1 1.3 Policies and Agreements... 1 2
Security of Information Technology Resources IT-12
Security of Information Technology Resources About This Policy Effective Dates: 11-28-2007 Last Updated: 10-23-2017 Responsible University Administrator: Office of the Vice President for Information Technology
ASD CERTIFICATION REPORT
ASD CERTIFICATION REPORT Amazon Web Services Elastic Compute Cloud (EC2), Virtual Private Cloud (VPC), Elastic Block Store (EBS) and Simple Storage Service (S3) Certification Decision ASD certifies Amazon
Cyber Resilience. Think18. Felicity March IBM Corporation
Cyber Resilience Think18 Felicity March 1 2018 IBM Corporation Cyber Resilience Cyber Resilience is the ability of an organisation to maintain its core purpose and integrity during and after a cyber attack
Reducing Cybersecurity Costs & Risk through Automation Technologies
Reducing Cybersecurity Costs & Risk through Automation Technologies Sponsored by Juniper Networks Independently conducted by Ponemon Institute LLC Publication Date: November 2017 Ponemon Institute Research
PERSON SPECIFICATION. Cyber PROTECT Officer. Job Title: Status: Established
PERSON SPECIFICATION Area: Crime and Intelligence Directorate Job Title: Cyber PROTECT Officer Weekly Hours: Section: CAID Scale: Grade 6 Version: 1.2 Post No: GI080 Status: Established Version Date: 37
Centre for cybersecurity Belgium : Role, Missions et future capacities
Centre for cybersecurity Belgium : Role, Missions et future capacities NLO meeting 30/01/2018 Phédra Clouner Deputy Director CCB 01 CCB mission & services Page 2 Legal Basis R.D. 10/10/2014 Contribute
IMF IT-Incident Management and IT-Forensics
IMF2007 - IT-Incident Management and IT-Forensics IT Incident Management and Structured Documentation - Company specific adoption Dipl.-Inf. Sandra Frings Fraunhofer IAO Competence Center Software-Management
CERT Development EFFECTIVE RESPONSE
CERT Development EFFECTIVE RESPONSE CERT Development: EFFECTIVE RESPONSE 2 Effective Response Effective Response Well funded, organized attackers threaten your network IT attacks can result in: Loss of
PROJECT RESULTS Summary
Project funded by the European Union Operational Programme Technical Assistance for Institutional Building - TAIB 2012 www.fighting-occ.mk Strengthening the National Capacities for the Fight Against Organised
The University of Queensland
UQ Cyber Security Strategy 2017-2020 NAME: UQ Cyber Security Strategy DATE: 21/07/2017 RELEASE:0.2 Final AUTHOR: OWNER: CLIENT: Marc Blum Chief Information Officer Strategic Information Technology Council
Overview. Handling Security Incidents. Attack Terms and Concepts. Types of Attacks
Overview Handling Security Incidents Chapter 7 Lecturer: Pei-yih Ting Attacks Security Incidents Handling Security Incidents Incident management Methods and Tools Maintaining Incident Preparedness Standard
ENISA & Cybersecurity. Dr. Udo Helmbrecht Executive Director, European Network & Information Security Agency (ENISA) 25 October 2010
ENISA & Cybersecurity Dr. Udo Helmbrecht Executive Director, European Network & Information Security Agency (ENISA) 25 October 2010 Agenda Some Definitions Some Statistics ENISA & Cybersecurity Conclusions
Moving from Prevention to Detection March 2017
www.pwc.com Moving from Prevention to Detection Le Tran Hai Minh Manager Cyber Security 29 Agenda Slide Cyber Security Statistics 3 How to Stay Confidence 8 Contact 19 2 Cyber Security Statistics 3 Cyber
Readiness, Response & Resilence:
Readiness, Response & Resilence: building out advance security operations Husam Al Saraf Solutions Principal Lead Turkey, Africa & Middle East #RSAemeaSummit 1 Traditional Security Operations Top Gaps
Cyber Security Incident Response Fighting Fire with Fire
Cyber Security Incident Response Fighting Fire with Fire Arun Perinkolam, Senior Manager Deloitte & Touche LLP Professional Techniques T21 CRISC CGEIT CISM CISA AGENDA Companies like yours What is the
Cyber Security Technologies
1 / Cyber Security Technologies International Seminar on Cyber Security: An Action to Establish the National Cyber Security Center Lisbon, 12 th September 2013 23 / Key highlights - Thales Group Thales
Louisiana Firefighter and Emergency Responder Certification System
Louisiana Firefighter and Emergency Responder Certification System Fire Service Instructor III (NFPA 1041, 2012 Edition) Louisiana State University Fire & Emergency Training Institute Entrance Requirements
APNIC s role in stability and security. Adam Gosling Senior Policy Specialist, APNIC 4th APT Cybersecurity Forum, 3-5 December 2013
APNIC s role in stability and security Adam Gosling Senior Policy Specialist, APNIC 4th APT Cybersecurity Forum, 3-5 December 2013 Overview Introducing APNIC Working with LEAs The APNIC Whois Database
Introducing ICANN and the Global Partnership approach Giovanni Seppia European Liaison e-stas conference, Seville, 12 May 2006
Introducing ICANN and the Global Partnership approach Giovanni Seppia European Liaison e-stas conference, Seville, 12 May 2006 What is ICANN? Non-profit company incorporated in California to coordinate,
FIRE REDUCTION STRATEGY. Fire & Emergency Services Authority GOVERNMENT OF SAMOA April 2017
FIRE REDUCTION STRATEGY Fire & Emergency Services Authority GOVERNMENT OF SAMOA April 2017 FIRE REDUCTION STRATEGY Fire & Emergency Services Authority GOVERNMENT OF SAMOA April 2017 2 1. Introduction The
Cybersecurity in Asia-Pacific State of play, key issues for trade and e-commerce
Cybersecurity in Asia-Pacific State of play, key issues for trade and e-commerce 5-8 September 2017 Yogyakarta, Indonesia Sameer Sharma Senior Advisor ITU Digital Infrastructure for Connectivity SDGs Evolution
EMERGENCY SUPPORT FUNCTION (ESF) 13 PUBLIC SAFETY AND SECURITY
EMERGENCY SUPPORT FUNCTION (ESF) 13 PUBLIC SAFETY AND SECURITY PRIMARY AGENCY: SUPPORT AGENCIES: Savannah-Chatham Metropolitan Police Department Armstrong-Atlantic Campus Police Department Bloomingdale
Effective Leadership, Role of Workers & Labor Organizations
Effective Leadership, Role of Workers & Labor Organizations International Regulators Offshore Safety Conference December 6, 2007 safety@usw.org 412.562.2581 Why is the USW involved in health & safety?
Information Governance, the Next Evolution of Privacy and Security
Information Governance, the Next Evolution of Privacy and Security Katherine Downing, MA, RHIA, CHPS, PMP Sr. Director AHIMA IG Advisors Follow me @HIPAAQueen 2017 2017 Objectives Part Part I IG Topic
Think Oslo 2018 Where Technology Meets Humanity. Oslo. Felicity March Cyber Resilience - Europe
Think Oslo 2018 Where Technology Meets Humanity Oslo Felicity March Cyber Resilience - Europe Cyber Resilience Cyber Resilience is the ability of an organisation to maintain its core purpose and integrity
COMPUTER HACKING Forensic Investigator
COMPUTER HACKING Forensic Investigator H.H. Sheik Sultan Tower (0) Floor Corniche Street Abu Dhabi U.A.E www.ictd.ae ictd@ictd.ae Course Introduction: CHFIv8 presents a detailed methodological approach
REPORT 2015/149 INTERNAL AUDIT DIVISION
INTERNAL AUDIT DIVISION REPORT 2015/149 Audit of the information and communications technology operations in the Investment Management Division of the United Nations Joint Staff Pension Fund Overall results
FTA 2017 SEATTLE. Cybersecurity and the State Tax Threat Environment. Copyright FireEye, Inc. All rights reserved.
FTA 2017 SEATTLE Cybersecurity and the State Tax Threat Environment 1 Agenda Cybersecurity Trends By the Numbers Attack Trends Defensive Trends State and Local Intelligence What Can You Do? 2 2016: Who
Policy Session 4 Identifying Risk: An abundance of Potential Shock Waves
Policy Session 4 Identifying Risk: An abundance of Potential Shock Waves Ray Stanton Interim Group CiSO & Director Digital Risk, National Grid &, Group CiSO/CiRO, Redwood Technologies Group 9 th May 2017