virginia manufacturers association 2019 …...• target stores hacked nov -dec 2013 • not a...
TRANSCRIPT
Virginia Manufacturers Association2019 Cybersecurity Trends and Ethics
Dr. Allen HarperExecutive Director
Center for Cyber Excellence
Introduction – Dr. Allen Harper
• Dr. Allen Harper, CISSP, PCI QSA, Liberty University • Previously: EVP and Chief Hacker, Tangible Security• PhD IT/SEC - dissertation dealt with security of the Internet of things (IoT)• Retired Marine Officer (2007), IT Officer and CISO MNF-W (Iraq), OIF (2007)• 30 years of seasoned experience in both public and private sectors• Public speaker, teacher, author, mentor of countless security professionals• Quoted in notable magazines and featured on federal news radio (2015)• Published author of 6 best selling security books, including:
• Gray Hat Hacking, the Ethical Hackers Handbook, 5th Edition (May 2018)• Security Information Event Management (SIEM), only published book on SIEM
Threats are Evolving (Then - 1983)
3
Threats are Evolving (Now - 2018)
4
Cybersecurity Threat Landscape
5
$ $$ $$$ $$$$
https://www.slideshare.net/craigmcgill/the-july-2017-cybersecurity-risk-landscape
Some “things” You Should Worry About
http://www.iotmakers.org/articles/roadmap_on_iot_technologies_evolution_3.png
Internet of things…to be hacked
Source: https://www.ottosolutions.sg/single-post/2017/10/06/TRUST-US-YOU-NEED-A-BUILDING-MANAGEMENT-SYSTEM
Risk Specific to Manufacturing• Safety (do you trust your robots?)• Worker’s Comp (due to cyber incident)• Loss of Production (for a day, for a week, for a month)• Product Recalls• Supply Chain Risk (do you trust your suppliers?)• Intellectual Property Theft
• Can you compete with someone/another country if they steal your IP?• What about Employee NDAs and Former Employees using IP…
• Manpower Shortfalls, staggering…we will come back to that
Shodan Fun…or not!
Shodan Fun…or not!
Shodan Fun…or not!
Shodan Fun…or not!
13
Shodan Fun…or not!
14
Shodan Fun…or not!
15
Shodan Fun…or not!
16
Shodan Fun…or not!
Shodan Fun…or not!
http://iotscanner.bullguard.com
Common Attack Scenarios
• Remote attack, through firewall• Insider attack, intentional or not• Vendor attack (You)
19
Remote Attack
• Social engineering – phishing/phone/USB• Shodan scan – google for hackers• Vulnerability scan – check locks/windows• Open firewall – it only takes one port!• Vulnerable device (software) - weakness• Foothold in network • Expansion –> theft –> damage -> loss
20
Insider Threat• Rogue employee, disgruntled • Unknowing user, surfing web – download malware• Unknowing user, opens and clicks on phishing email• Outsider is now inside network…Twix• Lack of proper network segmentation• Sensitive information found• Critical assets discovered and stolen• Expansion –> theft –> damage-> loss
21
Vendor Attack (You)• Why go through front door, back door is open?• Target stores hacked Nov-Dec 2013• Not a direct hack, a social engineering hack• 18 Months prior, mechanical service contractor hacked
(Fazio Mechanical)• Email phishing attack (accounts for 70-90% of breaches)• Found back door into Target – Invoicing System…• Target had weak password policies across company• Expansion –> theft –> damage -> loss
22
Deloitte Study: Cyber Risk in Manufacturing (1 of 2)
https://www2.deloitte.com/us/en/pages/manufacturing/articles/cyber-risk-in-advanced-manufacturing.html
Deloitte Study: Cyber Risk in Manufacturing (2 of 2)
https://www2.deloitte.com/us/en/pages/manufacturing/articles/cyber-risk-in-advanced-manufacturing.html
10 Questions CEOs Should Be Asking1. How do we demonstrate due diligence, ownership, and effective
management of cyber risk? Are risk maps developed to show the current risk profile, as well as timely identifying emerging risks we should get ahead of?
2. Do we have the right leadership and organizational talent? Beyond enterprise systems, who is leading key cyber initiatives related to ICS and connected products?
3. Have we established an appropriate cyber risk escalation framework that includes our risk appetite and reporting thresholds?
4. Are we focused on, and investing in, the right things? And, if so, how do we evaluate and measure the results of our decisions?
5. How do our cyber risk program and capabilities align to industry standards and peer organizations?
https://www2.deloitte.com/us/en/pages/manufacturing/articles/cyber-risk-in-advanced-manufacturing.html
10 Questions CEOs Should Be Asking6. How do our awareness programs create cyber-focused mindset and cyber-
conscious culture organization wide? Are awareness programs tailored to address special considerations for high-risk employee groups handling sensitive intellectual property, ICS, or connected products?
7. What have we done to protect the organization against third-party cyber risks?8. Can we rapidly contain damages and mobilize response resources when a
cyber incident occurs? How is our cyber incident response plan tailored to address the unique risks in ICS and connected products?
9. How do we evaluate the effectiveness of our organization’s cyber risk program?
10. Are we a strong and secure link in the highly connected ecosystems in which we operate?
Be a Hard Target
27
Be a Hard Target Tips: From Deloitte1. Set the Tone from the Top (CISO can’t do it all)2. Assess Risk Broadly (IT/OT/ICS/Cyber Manpower)3. Socialize the Risk Profile (share with leadership and board)4. Build in Security (15 times cheaper to bake it in, than bolt on)5. Remember, Data is an Asset (perhaps your most valuable)6. Assess 3rd Party Risk (supply chain security)7. Be Vigilant with Monitoring (be proactive, not reactive)8. Always be Prepared (Incident Response Drills, PR Statement)9. Clarify Organizational Responsibilities (prior to breach)10.Drive Increased Awareness (self phishing test, weekly)
https://www2.deloitte.com/us/en/pages/manufacturing/articles/cyber-risk-in-advanced-manufacturing.html
29
Closing Thoughts: There is a Shortage of Cyber Experts
Liberty University Cybersecurity Programs: liberty.edu/cyber
30
• Currently 301 thousand open Cybersecurity jobs1 (expecting 2 million by 2019)2
• 5 of 6 Cyber job postings require degree• One of highest paying jobs in Information Technology (IT) Field• There are 3 types of Cyber jobs: GRC, technology, development• Liberty’s Cyber programs prepare for all 3 types of Cyber jobs (differentiator)• Liberty graduates are prepared to meet today’s Cyber challenges
(IS/IT degrees) and those of tomorrow (CS degree)• The first year is mostly the same in all 3 degree paths, so path may be changed up to second year!
GRC
Development Technology
SecurityJobs
Cyber Job Types Job Examples Undergraduate Cyber Degrees Graduate Cyber Degrees
GRC Governance, Risk Management, and Compliance (GRC), Security Manager
B.S. Information Systems (IS) with Information Assurance Cognate
M.S. IS with Information Assurance Cognate
Technology Security Analyst, Penetration Tester, Security Engineer, Threat Hunter
B.S. Information Technology (IT) with DataNetworking and Security Cognate
M.S. IT with Network Design and Security Cognate
Development Software Security Engineer, Reverse Engineer, Malware Specialist
B.S. Computer Science (CS) with Cyber Security Cognate
M.S. Cyber Security
1. http://cyberseek.org/heatmap.html2. https://www.forbes.com/sites/jeffkauflin/2017/03/16/the-fast-growing-job-with-a-huge-skills-gap-cyber-security/#1ce24faf5163
Questions?
?