CYBER DEFENCE EAST AFRICA 2016

Transcription

1 27-29 September, Kampala, Uganda CYBER DEFENCE EAST AFRICA 2016 conference report

2 Let s work on Securing digital environment together! Content Executive Summary NRD Companies Participants Policy sessions Training Track 1 Training Track 2 NRD Cyber Security NITA-U Gold Sponsor - Synopsys Cyber Defence East Africa is annual cyber security conference organised by NRD Companies and their partners. It serves as a knowledge sharing and networking platform, aimed to address cyber security issues and bring together the Government, the ICT Industry and Academia in efforts to create a better and more secure digital environment for the states, governments, businesses and citizens in East Africa.

3 Executive Summary It s time for Actionable Cybersecurity! NRD Companies is a global information technology and consulting group of companies specialized in governance and economic digital infrastructure development with headquarters in Norway. Even though major data breaches have hit the More than 70 participants from various Ugandan Since our start in 1995, we have built NRD Companies is a part of INVL headlines worldwide, highlighting increased need institutions gathered to the conference, opened by more than 150 state-of-art registries, Technology, a NASDAQ Baltic listed ICT for skilled security professionals and service Hon. Tumwebaze Frank the Minister of ICT and information systems and delivered investment fund. providers, many organisations still rely on ad hoc, National Guidance. other projects of all imaginable types manual processes. Information security managers are confused about what to do, executive management often fails to recognise the impact of cyber security on business processes, and therefore risk damaging organisations data, assets and reputation. In order to assist East African organisations in overcoming these burdens and creating secure digital environment for states, governments, corporations and citizens, NRD companies have been organising annual Cyber Defence East Africa conferences for the last five years. A Welcome note was given by Mr Arnold R. Mangeni, Director Information Security at NITA- U, and a sponsor keynote was given by Mr Sindri Bjarnason, senior software engineer at Synopsys Gold sponsor of the conference. During the conference, participants attended practical trainings on Critical Security Controls and Incident response. Both trainings were delivered by a specialised cybersecurity technology consulting, incident response and applied research company NRD Cyber Security. across 4 continents and more than 50 countries worldwide. Over the years we have expanded our offering to secure maximum efficiency of ecosystems we build with solutions and services like digital signature, digital platforms for finance and retail sectors, information distribution and other economic digital infrastructure solutions. Our home markets are Nordics, Baltics NVL Technology owned companies with expertise in IT infrastructure, cyber security and e-government solutions, such as BAIP, NRD Cyber Security, Algoritmu sistemos and Andmevara to name a few, organically compliment NRD Companies offering and is a natural choice for a constant collaborations on various projects. NRD Cyber Security facilitates NRD Companies mission of creating secure digital environment. Cyber Defence East Africa 2016 was organized on September 2016 in Kampala, Uganda by NRD Companies and NITA-U to serve as a practical knowledge sharing, skills building & networking event. The course evaluation questionnaires revealed that the participants appreciated the practical nature of the trainings, thought that the presentations and discussions were relevant to their organisations and that the knowledge gained will be used in their work. and Frontier markets of Sub-Saharan Africa and South/Southeast Asia and our strategic growth is focused in the related areas of digital platforms for state taxes, banking, digital licenses, digital documents and other.

4 70+ PARTICIPANTS from various Ugandan institutions Attendees include representatives from the President s Office, Ministry of Finance, Uganda Police Force, Uganda Revenue Authority, National Identification and Registrations Authority, Ministry of Internal Affairs, Makerere University and many other organisations. The course evaluation questionnaires revealed that the participants appreciated the practical nature of the trainings, thought that the presentations and discussions were relevant to their organisations and that the knowledge gained will be used in their work. All participants noted they would like to attend again next year, and requested for more regular workshops, and more time to be allocated for such initiatives.

5 POLICY SESSIONS The conference was opened by Hon. Tumwebaze Frank the Minister of ICT and National Guidance who encouraged all participants to conduct risk assessments in their environments and implement controls to limit exposure to threats. He reiterated that The ministry is committed to providing the oversight and ensuring that we as a country are more resilient cybersecurity-wise and we continue increasing our uptake of ICT services. A sponsor keynote was given by Mr Sindri Bjarnason, senior software engineer at Synopsys Gold sponsor of the conference. Mr Bjarnason gave an in-depth presentation of a sustainable CSIRT Development Model, followed by analysis of examples from Island, Estonia and Finland. The Hon. Minister also invited the participants to applaud NRD Companies for selecting Uganda as the 2016 host and being consistent in delivering cyber security training within East Africa over the last three years and ensuring presence of skills, critical in order to build on our achievements and enhance our successes. A Welcome note was given by Mr Arnold R. Mangeni, Director Information Security at NITA-U who explained that there was an evident lack in the area of practical On day 1, the participants also had a chance to learn about Critical infrastructure protection from Dr Vilius Benetis, CEO NRD CS as well as IT governance policies, frameworks and standards, such as COBIT 5, presented by Mr Sebastian Marondo, CEO NRD East Africa. The participants expressed a special interest in an M- signature live demo, presented as the future of Uganda cyber security capacity building, and therefore NITA-U welcomed the initiative to host the CDEA in Uganda. We are all aware that successful achievement of our cyber security aspirations is greatly intertwined with the presence of skilled human resource capacity. As such, there is now a growing demand of cybersecurity professionals to ensure that our critical information technology infrastructure is secure and robust, based on a well-managed risk in a manner that is not only repeatable but continuous and consistent. This conference is one of the ways of meeting this demand and growing the culture of cybersecurity in our workforce, commented Mr Mangeni. by Dr Benetis, standing in for NRD Company ETRONIKA which is specialised in e-banking and m-signature solutions. A panel session, chaired by Mr Rimantas Zylius, Managing Director of Norway Registers Development AS, concluded the first day of the conference. The panelists Mr Arnold Mangeni, Mr Paul Serunkuma Manager Computer Forensics & Incident Management at NITA-U, Mr Vilius Benetis, Mr Sindri Bjarnason and Mr Noah Baalessanvu from Computer Forensics Consults provided their opinions and insights on the Cyber security situation in East Africa: issues and the way forward. During the next two days of the conference, participants attended practical trainings on Critical Security Controls and Incident response. Both trainings were delivered by a specialised cybersecurity technology consulting, incident response and applied Research Company NRD CS. A news report from the conference, including interviews with the Minister and Mr Mangeni, can be found here:

6 Training Track 1 Practicing CIS Critical Security Controls V6 for Cybersecurity There is no shortage of information available to security practitioners on what they should do to secure their infrastructure. An extraordinary array of security tools and technology, security standards, training and classes, certifications, vulnerability databases, guidance, best practices, catalogs of security controls, and countless security checklists, benchmarks, and recommendations has emerged in the recent years. To help us understand the threat, we have seen the emergence of threat information feeds, reports, tools, alert services, standards, and threat sharing frameworks. To top it all off, we are surrounded by security requirements, risk management frameworks, compliance regimes, regulatory mandates, and so forth. However, all of this technology, information, and oversight has become a veritable Fog of More : competing options, priorities, opinions, and claims that can paralyze or distract an enterprise from vital action. Trainer Dr Vilius Benetis Contributor to CIS CSC V6 development and CEO of specialised cyber defence company NRD CS During this training, participants were introduced to and practiced to apply the Critical Security Controls at their organisations. The CIS Critical Security Controls are a recommended set of actions for cyber defense that provide specific and actionable ways to thwart the most pervasive cyber attacks. To learn more about The CIS Critical Security Controls Please visit cisecurity. org/ criticalcontrols.cfm 10 11

7 Training Track 2 FIRST Trainings for Incident Response and Security Teams CSIRTs are as unique as the organizations/nations they serve. Therefore, as organizations begin to build their incident response capability, they are faced with a number of questions related to defining the range, levels of services, and organizational components of a CSIRT, hardware and software requirements, policies and procedures, and finally CSIRT operation and incident coordination. FIRST is the Forum of Incident Response and Security Teams. The idea of FIRST goes back until 1989, only one year after the CERT(r) Coordination Center was created after the infamous Internet worm. Back then incidents already were impacting not only one closed user group or organization, but any number of networks interconnected by the Internet. It was clear from then on that information exchange and cooperation on issues of mutual interest like new vulnerabilities or wide ranging attacks especially on core system like the DNS servers or the Internet as a critical infrastructure itself were the key issues for security and incident response teams. Trainer Marius Urkis Senior consultant and CIRT expert of specialised cyber defence company NRD CS, contributed to setting up of several National CERT teams FIRST brings together a wide variety of security and incident response teams including especially product security teams from the government, commercial, and academic sectors. Learn more about FIRST Please visit first.org 12 13

8 OUR PARTNERSHIPS NRD Cyber Security is a cybersecurity technology consulting, incident response and applied research company. The company focuses on services for specialized public service providers (law enforcement, national CERTs, telecoms, national communication regulators, national critical infrastructure), the finance industry and corporations with high data sensitivity. NRD Cyber Security roots go back to 2008 when Baltic Amadeus Infrastructure Services (now - BAIP) started developing cyber security expertise. As a separate company NRD Cyber Security was established in NRD Cyber Security is a facilitator of Norway Registers Development AS mission to create a secure digital environment for states, governments, corporations and citizens. In addition to specialized services, NRD Cyber Security through its own CIRT provides cyber security consulting, performs security audits as well as compliance and risk assessments, validates and promotes Critical Controls implementations, designs and implements technologies for cybersecurity defence and information system security, and provides training for corporate information security departments. NRD Cyber Security is controlled by INVL Technology, UTIB - Nasdaq Vilnius listed closed-end investment in IT businesses company. INVL Technology managed companies operate as a cluster and implement joint projects in more than 50 countries worldwide. RESEARCH PARTNERS KEY TECHNOLOGY FOR: CYBER SECURITY RESILIENCE KEY TECHNOLOGY FOR: LAW ENFORCEMENT NRD Cyber Security services are also available via our local partners in these countries: Lithuania, Latvia, Estonia, Moldova, Norway, Tanzania, Rwanda, Uganda, Bangladesh. Contacts: NRD Cyber Security, Gynėju str. 16 Vilnius, LT-01109, Lithuania, EU. KEY TECHNOLOGY FOR: CIRT/SOC & CYBER DEFENCE 14 15

9 CDEA 2016 SPONSORS GOLD SPONSOR SYNOPSYS The National Information Technology Authority-Uganda (NITA-U) is an autonomous statutory body established under the NITA-U Act 2009, to coordinate and regulate Information Technology services in Uganda. NITA-U is under the general supervision of the Ministry of Information and Communication Technology (MoICT). NITA-U is mandated with coordinating national information security. Synopsys, Inc. is the Silicon to Software partner for innovative companies developing the electronic products and software applications we rely on every day. As the world s 15th largest software company, Synopsys has a long history of being a global leader in electronic design automation (EDA) and semiconductor IP and is also growing its leadership in software quality and security solutions. Whether you re a system-on-chip (SoC) designer creating advanced semiconductors, or a software developer writing applications that require the highest quality and security, Synopsys has the solutions needed to deliver smart, secure products for the era of connected everything. As part of the Authority, the National Computer Emergency Response Team/Coordination Center (CERT.UG/CC) was setup to help to ensure the protection of the nation s Critical Information Infrastructure, assist in drafting the overall plan on the country s approach to cyber security related issues and thus can serve as a focal point for further building and implementing the National Culture of cyber security. CERT-UG/CC aims at providing the necessary services to handle incidents and support the affected parties to recover from breaches. The advice, services and support provided by the National CERT takes form of the website content provided for its audience in need. It is a trusted source of information and advice on cyber security issues in Uganda that provides advice, support and guidance in many forms from written advisories to sectoral briefs. CERT-UG/CC provides a variety of services including , hotline support, technical guidance on incident response support, mitigating cyber threats, information collaboration and capacity building. Their aim is to help and support all Ugandans in awareness of information on major issues on cyber security. Industry-Leading Solutions, from Silicon to Software Synopsys technologies and services are designed to help you speed time to market, achieve the highest quality of results, get the greatest value out of your investment, mitigate risk, and maximize profitability. From silicon design to software signoff, we ve got you covered. Silicon Design Our comprehensive portfolio of EDA tools addresses each phase of digital and mixed-signal design, for every process node down to 10nm. With robust support for silicon design, verification, prototyping, and manufacturing, you can quickly develop advanced chips and start software development earlier for a wide range of end markets from IoT and consumer to industrial and automotive. Silicon IP Synopsys is the leading provider of high-quality, silicon-proven IP solutions for complex SoC design and verification. Our broad DesignWare portfolio includes complete interface IP solutions, verification IP, security IP, analog IP, embedded memories and logic libraries, processor solutions, and IP subsystems to reduce integration risk and help you bring your chips to market faster. Software Signoff Synopsys is setting the standard for software security by maximizing risk-visibility across the cyber supply chain. We ll help you fix defects and vulnerabilities with unmatched depth, accuracy, and speed so you can avoid costly product crashes, unexpected behavior, security breaches, or catastrophic system failure. Our software security, quality, and compliance solutions are ideal for safety-critical industries such as medical and automotive

10 Norway Registers Development AS Løkketangen 20 B, 1337 Sandvika, Norway Web: Phone: