Why%Size%Doesn t%maaer%in%a%cyber%aaack% Brad%Luna% Senior%Vice%President,%N4Dimension%Solu8ons%Inc.%

Transcription

1 Why%Size%Doesn t%maaer%in%a%cyber%aaack% Brad%Luna% Senior%Vice%President,%N4Dimension%Solu8ons%Inc.%

2 Today s%agenda% A%bit%about%N4Dimension%Solu8ons% Cyber%security s%impact%on%our% industry% How%is%it%happening?% What%should%I%be%doing?% Risk%Mi8ga8on%Plan% Q&A% 2%

3 About&N(Dimension&Solu1ons &&Since&2002& Industry%% Associa8ons% Insurance% Companies% Tech%&%Vendor% Companies% Since%2002,%N4Dimension% Solu8ons%has%been%focused%on% cybersecurity%for%power%&%energy% Industry.% Provides%Managed%Cybersecurity% Services%for%u8li8es%helping%them% discover%and%protect%from%cyber% threats%and%vulnerabili8es.% Partnered%with%global%industry% leaders%and%associa8ons.% 3%

4 About&N(Dimension&Solu1ons & Cybersecurity% Groups% Awards%/% Recogni8ons% Working%with%cybersecurity%groups,%N4 Dimension%developed%and%co4wrote%different% documenta8on%to%help%u8li8es.% Strong%experience%in%providing%cybersecurity% services%such%as%cybersecurity%audits,% penetra8on%tes8ng%and%social%engineering,% and%others.%% Winner%of%many%awards%and%recogni8ons!% U.S.&Energy&Department&Announces&Up&to&$15&Million&to&Help&Improve& the&security&and&resilience&of&the&na1on s&public&power&grid& ***&&N(Dimension&is&the&Technology&selected&for&both.&&***& % 4%

5 4%5%4%

6 The&future&ain t&what&it&used&to&be. & "Yogi"Berra The%first% viruses %(malware)%actually%appeared% prior%to%1980% Prac8cal%jokes,%coworker%annoyances,%coder% wars% Computer%espionage%followed%crea8on%of% networks%circa%mid41980 s% ARPANET,%MILNET,%TYMNET% Why%is%Cybersecurity%a% new %issue%in%the%mid% 2000 s?% haps:// 6%

7 The&Cybersecurity&Buzz& &Really.& hap:// hap:// 7%

8 Cyber&Security&Issues&Affec1ng&U1li1es& RANSOMWARE haps:// 8%

9 Cyber&Security&Issues&Affec1ng&U1li1es& AMI hacked hap://bethanyclipper.com/2016/09/smart4meter4hacking4traced4to4china/% 9%

10 Cyber&Security&Issues&Affec1ng&U1li1es& IoT hacked hap:// hacked4iot4devices4launch4unprecedented4ddos4aaacks.html% haps://boingboing.net/2016/08/08/proof4of4concept4ransomware4fo.html% haps:// ransomware4a4lesson4in4iot4security/% 10%

11 11%

12 How&are&the&Breach's&Occurring?& 4%12%4%

13 Examples&of&Ac1vity& Port%Scans % CNC%Channels,%Exploit%Kits,%Black%Energy % Heartbleed,%Shellshock,% % NTP%Amplifica8on%AAacks % Cleartext%Passwords,%Cleartext%Credit%Card%Numbers% % dll,%pdfs,%images% %

14 Cyber&Threats&to&U1li1esats"to"U/li/es worms,%viruses% Morris%worm%1988% I%Love%You%2000% Nimda%2001% Code%Red%2001% SQL%Slammer%2003% Zotob%2005% state%level% Google%Aurora%2010% Opera8on%Shady%Rat%2011% DigiNotar%2011% Flame%2012% Snowden%2013% Targeted%Threats% Untargeted%Threats% financial% Sony%2011,%2014% Cryptolocker%2013% Target%2013% Unlimited%Opera8ons%2014% Carbanak%2015% IRS%2015% botnets%botnets%botnets% energy%sector% INL%Aurora%2007% Stuxnet%2010% Duqu%2011% Night%Dragon%2011% ARAMCO%2012% Telvent%2012% Energe8c%Bear%2014% Black%Energy%2015%%

15 How&Threats&OXen&Gain&Access&& Vendor s Cloud Grid Network ISO 3.%Internal% Breaches% 2.%Third%Party% Access% SCADA Operations Personnel SCADA Host Smart Meters Collectors SCADA Operations Servers 1.%AAacks%that% pass%through% firewall% Corporate Applications 4.%Communica8ons% Internet Engineering Applications AMI Head-End Server 5.%System% Vulnerabili8es%

16 Defense&in&Depth& Perimeter%Protec8on% Firewall,%IPS,%VPN,%AV% Host%IDS,%Host%AV% DMZ% Interior%Security% Firewall,%VPN,%AV% Host%IDS,%Host%AV% Applica8on%Whitelis8ng% NAC% Monitoring% Host%&%Network%IDS% Port%&%Vulner.%Scanning% Management% IDS Intrusion Detection System IPS Intrusion Prevention System DMZ DeMilitarized Zone VPN Virtual Private Network AV Anti-Virus (anti-malware) NAC Network Access Control 16%

17 Defense&in&Depth& Firewalls% SPAM%filters% Pop4up%Blockers% Protocol%Filters% Virus%Scanning%(Is%it%dead?%No!)% Server,%Desktop,%Laptop,%Tablets,%other% Intrusion%Detec8on%Systems% Intrusion%Preven8on%Systems% Network%Monitoring% Data%Encryp8on% Remote%Connec8on%Gateway/Monitoring% Updates/Patching/Service%Packs/IOS%Upgrades% Training% Cyber%Insurance?% 17%

18 The&Standards&Landscape&! IEEE! ETSI Cyber Security Technical Committee! NIST! Standard of Good Practice (Information Security Forum)! ISO and 27002! NERC (CIP)! U.S. Banking Regulations (PCI-DSS)! COBIT! ISO 15408! RFC 2196! C 2 M 2! ISA/IEC (formerly ISA-99)! IEC Conformity Assessment Program! IASME 18%

19 Risk&Mi1ga1on&Plan& 1.%Define%the% system% 2.%Iden8fy/classify% assets% Assign%Responsibility%to% Senior%Management% 8.%Monitor%and% assess% effec8veness% 7.%Select%security% controls% 3.%Execu8ve% Management% Sponsorship% 4.%Iden8fy%the% electronic%security% perimeter%(esp)% 5.%Conduct% vulnerability% assessments% 6.%Assess%risks% 19%

20 Brad%Luna% Senior%Vice%President% % Ques8ons?%