Cyber Protections: First Step, Risk Assessment Insert Practice Area Cyber Protections: First Step, Risk Assessment Presentation to: Presented to: Mark LaVigne, Deputy Director NYSAC November 21, 2017 500 Avery Lane Rome, NY 13441 315.338.5818 www.nystec.com

In this presentation Cyber Protection Business Strategy The importance of cyber protection Cyber protection strategy Products of NYSTEC risk assessment Leveraging NYSTEC Cyber Protection Services

Importance of Cyber Protection Data breach at an upstate New York hospital Hackers gain access to NYS county’s 911 system Data breach at an upstate New York hospital in 2017 Impacted operations at a major trauma center Complete shutdown of over 6,000 computers Six-week technology outage forcing a return to manual methods not used in 20 years Critical systems such as electronic prescribing were unavailable for one month Hackers gain access to NYS county’s 911 system 911 features, such as mapping, were disrupted County reported that all files and servers required rebuilding

Typical outcomes from a security incident Financial loss $154-$158 per Record* Regulatory penalties / contract issues Credit monitoring ~$40/person per year Cost of litigation and mitigation Productivity loss Reputation Damage Executive loses job Financial Revenue loss Cost of breach $154-$158/record (2016 Ponemon Institute*) Credit monitoring (~$40/person per year) HIPAA penalty up to $1.5M/year Cost of litigation and mitigation Other Productivity loss Legal/regulatory/contract issues Patient, community, and worker safety Damage to reputation Executive job loss * 2016 Ponemon Institute https://securityintelligence.com/media/2016-cost-data-breach-study/

Cyber Protection Strategy Begins with a comprehensive assessment of risk No quick-fix Must be baked in and not bolted on Full leadership commitment Holistic and multi-faceted approach Continuous process Begins with a comprehensive assessment of risk There is no quick-fix technology solution Must be baked into your strategic business planning (not bolted on at the end) Full leadership commitment and understanding Involves a holistic, multi-faceted application of trained personnel, business-process, and technology safeguards Is a continuous process that involves ongoing risk assessment, training, safeguard effectiveness testing, and involvement at all levels of the organization

Value of a Risk Assessment Helps to identify: Benefits: Threats to Systems Gaps in Defenses Likelihood of system compromise Business Impact Identifies: Bad actors that target your business and systems Gaps in business processes and technical defenses that could allow someone to steal data or harm your business Measures the possibility that an adverse event will to occur in your environment and potential impact to your business processes and systems Helps to optimize your organization’s security investments Helps to plan out the application of safeguards Helps to justify investments to organization and State sponsors Optimize Investment in Security Plan Implementation of Safeguards Justification for County and State Sponsors

NYSTEC Risk Assessment Results of the Risk Assessment: Value of the Risk Mitigation Plan: Detailed explanation of review CIS Top-20 Heat Map Prioritized mitigation plan Business Impact A completed risk assessment includes a detailed report that provides: Detailed explanation of what was reviewed, which threats were considered, and how risks were calculated Data-driven “heat map” gaging cyber readiness and revealing “hot spots” where defenses might be insufficient to address identified risks, against the CIS Top-20 Critical Controls A prioritized risk mitigation plan that includes risk mitigation recommendations for each identified area of concern Risk mitigation plan Valuable for petitioning County and State leadership for funding Identifies where limited funds should be invested to maximize return on investment Use to justify funding requests Identify where limited funds should be invested Maximize return on investment

NYSTEC Risk Assessment Product

NYSTEC Compliance Heat Map Control Control Description Explanation Artifacts % CSC 1 Inventory of Authorized and Unauthorized Devices 80 75 CSC 2 Inventory of Authorized and Unauthorized Software 73 67 CSC 3 Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers 69 57 CSC 4 Continuous Vulnerability Assessment and Remediation 87 83 CSC 5 Controlled Use of Administrative Privileges 60 25 CSC 6 Maintenance, Monitoring, and Analysis of Audit Logs 63 55 CSC 7 Email and Web Browser Protections CSC 8 Malware Defenses 40 CSC 9 Limitation and Control of Network Ports, Protocols, and Services 20 CSC 10 Data Recovery Capability 100 CSC 11 Secure Configurations for Network Devices such as Firewalls, Routers, and Switches 66 38 CSC 12 Boundary Defense 48 CSC 13 Data Protection 76 CSC 14 Controlled Access Based on the Need to Know CSC 15 Wireless Access Control 92 CSC 16 Account Monitoring and Control 30 CSC 17 Security Skills Assessment and Appropriate Training to Fill Gaps CSC 18 Application Software Security 4 CSC 19 Incident Response and Management 31 14 CSC 20 Penetration Tests and Red Team Exercises 43

Interpreting the Heat Map Control Control Description Explanation Artifacts % CSC 1 Inventory of Authorized and Unauthorized Devices 80 75 CSC 2 Inventory of Authorized and Unauthorized Software 73 67 CSC 3 Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers 69 57 CSC 4 Continuous Vulnerability Assessment and Remediation 87 83 CSC 5 Controlled Use of Administrative Privileges 60 25 CSC 6 Maintenance, Monitoring, and Analysis of Audit Logs 63 55 CSC 7 Email and Web Browser Protections CSC 8 Malware Defenses 40 CSC 9 Limitation and Control of Network Ports, Protocols, and Services 20 Risk Assessment will provide: Detailed explanation of scoring and business risks Recommended mitigation steps Recommended priority for implementing changes

NYSTEC Cyber Protections Services Menu Self-assessment Surveys CIS Top-20 Gap Assessment Worksheets System Characterization of Critical Assets In-Person and Phone interviews Review of Policies and Procedures Maturity Review of Docs and Artifacts Completion of NYSTEC Risk Assessment Matrix Review of Completed Risk Assessment Matrix Networked Device Vulnerability Analysis Web Application Scanning Small Smaller counties that have few critical assets or a small cyber presence Medium Medium-sized counties with critical assets and a significant cyber footprint Large Larger counties with significant cyber assets and a large footprint

Thank you Questions?