Cybersecurity Considerations by Michael Rosciam
undefined
By Michael Rosciam
CYBERSECURITY
CONSIDERATIONS
Interesting Facts
Interesting Facts
88% of the current breach methods were
identified back in 2014.
Version Data breach report stated 81% of the
hacks leveraged either stolen or weak
passwords.
Cybersecurity is a significant
business/entity risk
Cybersecurity needs to be
Identified
Assessed
Managed
Effective Cybersecurity program provides
Reasonable assurance to
Prevent, Detect and Mitigate Material breaches
All done in Timely Manner
Keys to Cyber security
strategy and policy
The strategy should note the “current state” of
security practices
Establish the value of this collected information
Documented Strategic Objectives
Common Cyber Threats Fall Under
Three General Categories
Attacks on confidentiality
Attacks on integrity
Attacks on availability
Conduct a cyber risk
assessment
Determine the Cyber Framework that is used
within the organization and determine if the
framework reaches down to the control level.
Is there complementary blend of education,
awareness vigilance and technology tools
K
e
y
A
r
e
a
s
o
f
C
y
b
e
r
A
s
s
e
s
s
m
e
n
t
Governance –Organization, Policies, Roles
and Awareness
Risk assessment - Understanding of the
business impact and risk
IT infrastructure - Controls and management
oversight to prevent and detect environment
Incident Response – manages a cybercrime
and limit reputational damage
Key Points of Governance
Enforcement of Security Policy
To prevent External threats must
develop policy and employ two factor
authentication.
Key Points of Governance
Third party providers controls
evaluated
Compliance monitoring
IT acceptable use policy for all
employees
Software update procedures
Incident Response Plan
Established policy and procedures for an incident
What is an incident
How to escalate it
Asset prioritization – mission critical to non-operational
Document roles and responsibilities
What breach laws are you under – Fla. Stat. § 501.171
Documentation of incident
Coordination with law enforcement
Corrective action and remediation
K
e
y
s
t
o
E
f
f
e
c
t
i
v
e
I
n
c
i
d
e
n
t
R
e
s
p
o
n
s
e
P
l
a
n
Perform a tabletop exercise
Time management of IT Department.
Have developed beforehand relationship with external
forensic resources.
Determine when the resources will be engaged.
Established remediation plans.
Update your incident response policies
Cybersecurity Statistics
Gartner report for Florida states that 48% of
data breaches are due to negligent employee
43% of the attack tactics are socially related
95% of the phishing attacks led to software
installation on to the Company networks
( ransomware, key loggers)
M
e
t
h
o
d
s
f
o
r
T
h
o
s
e
T
h
r
e
a
t
s
Social Engineering
Attacks the natural human desires
Trust
Desire to help
Desire to avoid conflict
Fear
Curiosity
Ignorance and carelessness
Why Employee Education
Employees need to know the importance of
security to your company and their individual
responsibilities.
“Practice Makes Perfect”
Accomplish that by performing simulated
phishing attacks on a regular basis
Employees should receive annual training on
the trends and techniques being performed by
hackers
A
w
a
r
e
n
e
s
s
–
h
o
w
e
n
d
u
s
e
r
s
c
a
n
r
e
d
u
c
e
C
y
b
e
r
s
e
c
u
r
i
t
y
A
t
t
a
c
k
s
?
Be suspicious of unsolicited phone calls,
visits, or email messages from individuals
asking about employees or other internal
information.
Never respond to requests for information via
hyperlinks; type the known web address in
your web browser.
Do not provide personal information or
information about your organization,
including its structure or networks.
Risk assessment - Understanding
of the Business Impact and Risk
Identify risk and vulnerabilities of
organization ensure incorporates a cyber
perspective
Ensure risk assessment routinely
performed and documented
Data classification and critical resource
listings
Communication between entity
management and IT
IT Infrastructure Controls
Identity management – privilege users and need
to know access
Server security
Mobile computing security
Database security
Network Perimeter security
Monitoring of key areas
Intrusion detection, help desk reports
Security event monitoring
Vulnerability assessment results
What do I fix first?
Not all vulnerabilities are created equal
The answer “ the vulnerabilities most likely to
be exploited for damage”
Focus on your critical data, devices it is stored
on and applications accessed by employees.
Most organizations start with servers and
network devices as they are mission critical to
company operations.
S
u
m
m
a
r
y
C
o
n
c
l
u
s
i
o
n
Quick Takeaways
Make people your first line of defense
Keep data on a need to know basis and
know what data is stored where
Patch promptly
Use Two factor authentication
Is your organization ready for the
new model law
Examiners handbook references a SOC 2 Type
II report provides regulators with comfort over
an insurer’s IT general controls and
cybersecurity exposure.
THF can help you assess these risks and
sufficiency of your policies, procedures and
controls over IT.
Contact
Michael Rosciam, CPA.CITP, CISA
T
h
o
m
a
s
H
o
w
e
l
l
F
e
r
g
u
s
o
n
P
.
A
.
2615 Centennial Boulevard, Suite 200
P: 850.668.8100
mlr@thf-cpa.com
www.thf-cpa.com
On state term contract
Management Consulting Services 973-000-14-01
Financial and Performance Audits 973-000-14-02
Questions?
Cybersecurity is a significant business risk that needs to be identified, assessed, managed, and effectively executed. A good cybersecurity program offers reasonable assurance in preventing, detecting, and mitigating material breaches in a timely manner. Key areas include cyber governance, risk assessment, IT infrastructure, and incident response management.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
CYBERSECURITY CONSIDERATIONS By Michael Rosciam
Interesting Facts 88% of the current breach methods were identified back in 2014. Version Data breach report stated 81% of the hacks leveraged either stolen or weak passwords.
Cybersecurity is a significant business/entity risk Cybersecurity needs to be Identified Assessed Managed Effective Cybersecurity program provides Reasonable assurance to Prevent, Detect and Mitigate Material breaches All done in Timely Manner
Keys to Cyber security strategy and policy The strategy should note the current state of security practices Establish the value of this collected information Documented Strategic Objectives
Common Cyber Threats Fall Under Three General Categories Attacks on confidentiality Attacks on integrity Attacks on availability
Conduct a cyber risk assessment Determine the Cyber Framework that is used within the organization and determine if the framework reaches down to the control level. Is there complementary blend of education, awareness vigilance and technology tools
Key Areas Key Areas of Cyber Assessment Assessment of Cyber Governance Organization, Policies, Roles and Awareness Risk assessment - Understanding of the business impact and risk IT infrastructure - Controls and management oversight to prevent and detect environment Incident Response manages a cybercrime and limit reputational damage
Key Points of Governance Enforcement of Security Policy To prevent External threats must develop policy and employ two factor authentication.
Key Points of Governance Third party providers controls evaluated Compliance monitoring IT acceptable use policy for all employees Software update procedures
Incident Response Plan Established policy and procedures for an incident What is an incident How to escalate it Asset prioritization mission critical to non-operational Document roles and responsibilities What breach laws are you under Fla. Stat. 501.171 Documentation of incident Coordination with law enforcement Corrective action and remediation
Keys to Effective Keys to Effective I Incident R Response Plan esponse Plan ncident Perform a tabletop exercise Time management of IT Department. Have developed beforehand relationship with external forensic resources. Determine when the resources will be engaged. Established remediation plans. Update your incident response policies
Cybersecurity Statistics Gartner report for Florida states that 48% of data breaches are due to negligent employee 43% of the attack tactics are socially related 95% of the phishing attacks led to software installation on to the Company networks ( ransomware, key loggers)
Methods for Those Threats Methods for Those Threats
Social Engineering Attacks the natural human desires Trust Desire to help Desire to avoid conflict Fear Curiosity Ignorance and carelessness
Why Employee Education Employees need to know the importance of security to your company and their individual responsibilities. Practice Makes Perfect Accomplish that by performing simulated phishing attacks on a regular basis Employees should receive annual training on the trends and techniques being performed by hackers
Awareness Awareness how end users can how end users can reduce Cybersecurity Attacks? reduce Cybersecurity Attacks? Be suspicious of unsolicited phone calls, visits, or email messages from individuals asking about employees or other internal information. Never respond to requests for information via hyperlinks; type the known web address in your web browser. Do not provide personal information or information about your organization, including its structure or networks.
Risk assessment - Understanding of the Business Impact and Risk Identify risk and vulnerabilities of organization ensure incorporates a cyber perspective Ensure risk assessment routinely performed and documented Data classification and critical resource listings Communication between entity management and IT
IT Infrastructure Controls Identity management privilege users and need to know access Server security Mobile computing security Database security Network Perimeter security Monitoring of key areas Intrusion detection, help desk reports Security event monitoring Vulnerability assessment results
What do I fix first? Not all vulnerabilities are created equal The answer the vulnerabilities most likely to be exploited for damage Focus on your critical data, devices it is stored on and applications accessed by employees. Most organizations start with servers and network devices as they are mission critical to company operations.
Summary Conclusion Summary Conclusion
Quick Takeaways Make people your first line of defense Keep data on a need to know basis and know what data is stored where Patch promptly Use Two factor authentication
Is your organization ready for the new model law Examiners handbook references a SOC 2 Type II report provides regulators with comfort over an insurer s IT general cybersecurity exposure. controls and THF can help you assess these risks and sufficiency of your policies, procedures and controls over IT.
Contact Michael Rosciam, CPA.CITP, CISA Thomas Howell Ferguson P.A. 2615 Centennial Boulevard, Suite 200 P: 850.668.8100 mlr@thf-cpa.com www.thf-cpa.com On state term contract Management Consulting Services 973-000-14-01 Financial and Performance Audits 973-000-14-02
