1. © Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. Cyber Security: Now and in the Future Dr Rhodri Davies / Feb 25, 2015

2. © Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 2 Current State HP research with Economist Intelligence unit – Only 33% of CEOs had a single view of information risk across their organization – Only 28% able to attribute monetary value to information assets HP & Ponemon – 70% of senior business leaders said exec level involvement needed in incident response process – Only 44% rater their breach response plan as mature and proactive. Need for Constant monitoring Effective response but shortage of experience and resource

3. © Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 3 Still too many one size fits all compliance exercises Compliance requirements and proofs in a cloud/leveraged service world need to be different from those for in-house/dedicated service Understand what data you give to service providers and how important it is. – Is data about your operations the same as information on your customers. – Compliance audit is the wrong stage to introduce data handling requirements

4. © Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. Future: The digital dam has yet to burst.

5. © Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 5 Online growth 2010 32.7% online 2,270,000,000

6. © Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 6 77% online Online population growth = attack surface 2010 32.7% online 2,270,000,000 2020 60% online 4,800,000,000 0.25% = 1,000,000+ Potential new hackers 34% online 7.5% online

7. © Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. Generation curious

8. © Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. Generation now

9. © Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. Digital natives

10. © Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 10 Future – Near Term Major mobile exploits Open source vulnerabilities Supply chain as a critical attack route Industry sector attacks and malware Privacy concerns drive legislation

11. © Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 11 Major Mobile Exploits Ubiquity of devices – Typically 3-5 devices per person – Wearable Merging of commercial and personal Concentration of data – NFC – Geolocation – health Cloud backed applications Unified development Thousands of applications Dynamic object code defeats analysis Recommendations Understand how users want to use devices Do the basics – Awareness – Authentication Enterprise identity and access gateways

12. © Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 12 Open Source Vulnerabilities Last 12 months: Shellshock and Heartbleed – Ghost Nothing magic about open source – Ability to audit code does not mean it was done Widely used, even in commercial software – C.f. common commercial libraries with issues. Recommendations Know what you have – Including as elements of commercial software

13. © Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 13 Supply Chain as critical attack route Where is the weakest link? Breadth and interconnectedness of supply chain Target, AutoNation, Lowes & AT&T incidents all linked to 3 rd parties Some 3 rd parties concentrate critical information A breach in one supplier may give access to multiple organizations Expansion of PCI scope Recommendations Supplier assurance programmes Threat intelligence – What are your peers experiencing Joint incident response – Make it easy for suppliers – Test often

14. © Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 14 Industry sector attacks and malware Adversary specialization – 2014 Dragonfly compaign against western energy companies Long term specialization in banking Focus on intellectual property from particular industries – Healthcare Recommendations Threat intelligence – understand your peers Adopt from leading sectors (finance etc.) Continuous active monitoring

15. © Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 15 Privacy concerns drive legislation Nation state attacks (real or otherwise) are raising government interest Public mood changing? – Generation gap – Public examples of data breaches Contrasting government snoopers charters BBC report showing online privacy as high on political agenda for 1 st time voters 90% if Americans think consumers have lost control of their personal data Balkanisation of Internet Recommendations Asses/understand data you hold – Not just an exercise in current compliance

16. © Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 16 Internet of Things Consumer driven product life cycles Large number of devices to manage Kinetic impact Data mining Interconnected world – things outside your control can affect you. Recommendations Start thinking about it now Policy for connecting to your network Network isolation

17. © Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 17 Security Technologies to watch Listing known bad will never be complete – Process on the basis of known good – Behavior based Software defined infrastructure Information sharing buses Security intelligence – More an issue of culture and relationships than technology – Cooperation and collaboration La Brea style capabilities

18. © Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. Thank you