10/04/2016 David LaPlante, CISO Information Security & Cybersecurity Program Planning Critical Infrastructure Cyber Security Framework

2 David LaPlante, CISO City of Houston: A Microcosm of Business Sectors » Administration and Regulatory Affairs » Aviation » City Secretary » Emergency Management » Finance » Fire » Fleet Management » General Services » Health and Human Services » Housing and Community Development » Human Resources » Information Technology » Legal » Library » Municipal Courts » Neighborhoods » Office of Business Opportunity » Parks and Recreation » Planning and Development » Police » Public Works and Engineering » Solid Waste Management » Special Events

3 David LaPlante, CISO City of Houston – Scope Examples » Public Library - HPL » Served 7.2 million in-person and online visitors, answered over 667,546 reference questions, circulated more than 6.9 million books, magazines, and audio-visual materials and attracted nearly 189,050 participants to our programs. Notably, all services and privileges that accompany the Houston Public Library card are free to all residents in the state of Texas » Fire – HFD » HFD is the third largest fire department in the United States and is responsible for preserving life and property to a population of more than 2 million in an area totaling 654 square miles from 95 Fire Stations » Public Works and Engineering » Responsibilities include operation and maintenance of the City’s streets and drainage, production and distribution of water, collection and treatment of wastewater, and permitting and regulation of public and private construction spanning over Houston’s 640 square miles and 6,000 center lane miles of streets.

4 David LaPlante, CISO CyberSecurity Division - What We Do » Information Security Operations » Security Monitoring and Response » Vulnerability Management » Security Incident Response » Operational Management » Firewall Services » Compliance and Risk » Security Policy » Security Management

5 David LaPlante, CISO CyberSecurity Outreach » Mayor’s Office of Public Safety and Homeland Security – Assist as CyberSecurity SME for Cyber-related activities by participating in DHS Grant programs, member of Strategic Advisory Group, provide CyberSecurity presentations to external entities including Ship Channel Security District, Ft. Bend, Brazoria, Harris, Galveston and Montgomery Counties and Secured Cities conference. » Greater Houston Partnership – Member of CyberSecurity Taskforce – Generated content for Local Government CyberSecurity section of CyberSecurity and Business Vitality Guide. » Texas Tribune – Participated as panelist for Texas Tribune Cybersecurity and Privacy Symposium in San Antonio. » Texas Legislature – Provided testimony to Urban Affairs committee on CyberSecurity » Department of Homeland Security – Applied for and received Grant Funding as a qualifier for Urban Area Security Initiative (UASI) CyberTerrorism activities. This program, beginning its 3rd year in 2016 has benefited from $1.4 million from DHS allowing the City to implement the NIST CyberSecurity Framework and provide an implementation guidance tool, lessons learned, documentation and other artifacts allowing others in the Houston UASI region a method of assessing and improving their CyberSecurity Risk Posture. The tool created by the Division was also recently recognized with an Innovation award by CSO Magazine.

6 David LaPlante, CISO Challenges According to Verizon 2015 Data Breach Investigations Report for the Public Sector  Four out of five of the security incidents affecting public sector organizations involved:  Miscellaneous Errors – 36%  Insider & Privilege Misuse – 25%  Physical Theft and Loss – 19%

7 David LaPlante, CISO Challenges

8 Attack Vectors » While there are a number of attack vectors, attacks are still at the top of the list and continue to advance in sophistication through: ˃Malicious Attachments ˃The messages themselves +Deception – Phishing +Links +Scams and Fraud +Hoaxes

9 David LaPlante, CISO Challenges

10 David LaPlante, CISO Solutions? » CyberSecurity Awareness Training » Continued Phishing Tests » Additional Training » Tips

David LaPlante, CISO Point of Contact: Chief Information Security Officer David LaPlante Walker St. Houston, TX