Presented by: Mike Gerdes Director, Information Security Center of Expertise Cybersecurity State of the Union

What are Media Saying? 80 Million Potentially Impacted By Anthem Security Breach February 5, 2015

Million records (so far) in 2015 Targets include all industries and geographies Healthcare shows a recent spike in breach activity Social engineering has replaced brute force hacking Victims include industry leaders with huge budgets What are Tracking Sites Saying?

What are Others Saying? ISACA/RSA Study Non-malicious insiders are #2 threat actors behind hackers Phishing, malware, hacking and social engineering are top attack types Loss of mobile devices is next most common “attack type” (44%) Over 82% provide mobile devices and 91% report loss of mobile devices Almost 80% report Board is concerned with security, but only 40% practice good security Source: of-Cybersecurity_Res_Eng_0415.pdf

What are Others Saying? (continued) PwC Global State Survey 91% or organizations have adopted risk-based security frameworks 91% use some form of advanced authentication Top issues are malware, provisioning, PII protection and end-user vulnerabilities Only half have a CISO and less than half have Board participation in security strategy Sources of compromise are current/former employees, followed by service providers Source: security/information-security-survey/download.html

What are Others Saying? (continued) Ponemon Global Megatrends Only 60% reported their cyber security would improve in the next 3 years 66% report senior leaders do not view cyber security as a strategic priority today 78% report their security leader does not brief the Board on cyber security strategy Only 14% of security leaders report to CEO 45% say a key issue is they will be unable to hire/retain experts Source:

What are Others Saying? (continued) Raytheon BoD Briefing Paper Key Tenets of Cyber Security Oversight Security is a risk management issue, not a technological one. Provide meaning behind the metrics – make cybersecurity real to the board. Board members must understand the legal aspects of cybersecurity regulations. Board members must identify acceptable cyber risk levels in business operations. Board of Directors must adopt a well- defined cyber risk management framework Source:

What are Others Saying? (continued) Target “Kill Chain” Analysis Target did not appear to follow broadly accepted information security practices. Target appears to have failed to respond to multiple automated warnings Target failed to properly isolate its most sensitive network assets. Attackers were able to update their malware multiple times prior to the actual event Report did not clearly identify inadequate management involvement as root cause Source: a3a67f183883/23E30AA955B5C00FE57CFD C target-kill-chain-analysis.pdf