1. Conostix S.A. koen@conostix.com Sensible defence

2. Conostix S.A. koen@conostix.com CIA and prevention/dectection/response Risk management and its pitfalls Economic incentives Liability/regulation/compliance Due care and due dilligence Technology Awareness Conclusion Introduction

3. Conostix S.A. koen@conostix.com To ensure the CIA triad we use: Detection Prevention Response How security works

4. Conostix S.A. koen@conostix.com Identification Identify the actual threat Impact factor The possible consequences of an attack Frequency The probable frequency of the occurrence of a threat Probability The extent of how confident we are a threat will happen Today’s risk management Identification of a threat

5. Conostix S.A. koen@conostix.com Identification of the current risks The cost/benefit justification of the countermeasures Influences the decision making process on hardware, etc Focus on security resources where they are needed most Today’s risk management Risk analysis goals

6. Conostix S.A. koen@conostix.com Threat Asset Vulnerability Safeguard Asset value (AV) Exposure factor (EF), value in percentage Single loss expectancy (SLE), dollar figure (EFxAV) Annualized rate of occurrence Annualized loss expectancy (ALE= SLExARO) Today’s risk management Risk analysis – key terms

7. Conostix S.A. koen@conostix.com Aims to assign tangible values Relies on qualitative data Process Estimate potential losses to the assets Analyze potential threats to the assets Define impact and frequency levels Define the ALE Today’s risk management Risk analysis – Quantitative

8. Conostix S.A. koen@conostix.com Scenario oriented approach Rank threats on a scale to evaluate their risks, costs and outcome In contrast to quantitative analysis a purely qualitative analysis is always possible High guess rating Today’s risk management Risk analysis – Qualitative

9. Conostix S.A. koen@conostix.com Misunderstanding between risk and certainty A risk is the anticipated frequency of losses Certainties are occurring with high frequency Reliance on probability, impact and frequency The unknown, controls the probability, frequency and the impact of a future incident. Today’s risk management Pitfalls

10. Conostix S.A. koen@conostix.com Benefits vs costs Economic pressure Sensible defence Economic incentives

11. Conostix S.A. koen@conostix.com Laws push standards Liability creates awareness Regulatory bodies motivate Sensible defence Liability, regulation, compliance

12. Conostix S.A. koen@conostix.com Due care is using reasonable care to protect the interests of an organization Due diligence is practicing the activities to maintain the due care efforts. Common sense security framework Sensible defence Due care and due diligence

13. Conostix S.A. koen@conostix.com Functionality vs security User friendly does not mean insecure Ease-of-Use + Common Sense = Security Privacy vs security Sacrifice privacy for security? Should security protect privacy or ignore it to enhance security? Sensible defence Technology

14. Conostix S.A. koen@conostix.com Human intelligence most important Reduce risk without technology Limit damage in case of an incident Give users insight in values of company assets and the usage of information systems Sensible defence Awareness

15. Conostix S.A. koen@conostix.com Sensible defence is balanced security Balance cost vs economic gain Balance liberty vs privacy Balance functionality vs security Liability, legislation and regulation Sensible defence security is a trade-off

16. Conostix S.A. koen@conostix.com Q & A Thanks to: My colleagues Donn Parker Bruce Schneier Rebecca Herolds Sensible defence Questions?