David A. Brown Chief Information Security Officer State of Ohio Cybersecurity in Ohio David A. Brown Chief Information Security Officer State of Ohio

Threats Against Government Denial of Service Spear Phishing SQL Injection Web Defacements Malware (Keyloggers, Trojans,etc.) Theft of Devices Hacktivist Activity

Examples of the Threat February 2012 – Missouri’s Official Web Site Defacement April 2012 – Utah Department of Health –Medicaid System Hack October 2012 -South Carolina Department of Revenue Data Breach October 2012 – City of Burlington, Washington System Attack December 2012 – South Carolina Department of Employment & Workforce Web Defacement January 2013 – Florida Dept. of Juvenile Justice Device Theft Missouri Defacement – no data loss Utah – 780,000 records stolen South Carolina Data Breach – 6.4 million records stolen by a foreign hacker – spear phishing City of Burlington - $400,000 diverted to other accounts across the country. South Carolina Defacement – no data loss Florida Juvenile Justice– mobile device with 100,000 youth and employee records stolen from office – no encryption or password protection Several incidents have occurred in Ohio as well. All of the threats noted earlier have occurred here in state and/or local agencies.

State of Ohio Security Program Approximately 100 agencies, boards, and commissions under program Decentralized environment Chief Information Security Officer responsibilities under ORC 125.18: Coordinate the implementation of security policies and procedures in state agencies Assist each agency with the development of a security strategic plan

State of Ohio Security Program April 2011 – State sets IT Standard ITS-SEC-02 Establishes NIST 800-53 as state security framework Creates enterprise security controls that align with Consensus Audit Guidelines (SANS Top 20 Critical Controls) Agencies to be compliant with CAG by October 2012 Fall 2012 – Agencies required to submit strategic security plan to Office of Information Security & Privacy Leveraged CAG self-assessment in US Homeland Security CSET tool Explain value of CSET tool for local municipalities and county governments

State of Ohio Security Program SANS Top 20 Critical Controls (Consensus Audit Guidelines) Hardware Inventory Software Inventory Secure Configuration of Systems Secure Configuration of Network Devices Boundary Defense Security Audit Logs Application Software Security Controlled Use of Administrative Privileges Controlled Access/Need to Know Vulnerability Management Account Monitoring & Control Malware Defense Limiting Ports, Protocols, Services Wireless Device Control Data Loss Prevention Secure Network Engineering Penetration Testing Incident Response Capability Data Recovery Capability Security Training

State of Ohio Security Program Ohio is one of a few states who have adopted the SANS Top 20 Critical Controls The Consortium for Cybersecurity Action was established in 2012 Ensures that updated versions of the controls reflected the most relevant threat information Shares lessons learned from organizations that have implemented them. Ohio participates in this consortium. CISOs for Ohio and Colorado co-chair a state/local government workgroup for the Consortium. US State Department saw a 94% reduction in measured security risk by implementing these controls

State of Ohio Security Program Security Services Provided by OISP Today: Risk Assessments Security Assessments Security Architecture Security Consulting IT Security Policies/Standards Incident Response Vulnerability Assessments Penetration Testing (limited) Enterprise SIEM Security Awareness & Training Cyber Intelligence and Threat Management Agencies may provide other services as well.

State of Ohio Security Program Industrial Control Systems Assessments Began these assessments in February 2012 Partnered with US Homeland Security to conduct two pilot assessments Each assessment was completed within one day No cost to the State of Ohio

State of Ohio Security Program Securing the Human Began offering this training in 2011 Online training produced by SANS Institute 36 different modules of training Updated twice a year based on current threats Approximately 50,000 state employees will be trained this year Excellent reviews by our users

State of Ohio Security Program Enterprise SIEM Began offering this service in 2012 Collect security logs from systems 5 agencies participating today Extending to all cabinet agencies Over 100 Million event logs analyzed per day Both agencies and OISP monitor system

Challenges Facing Government Funding for security Cybersecurity authority and governance Attractive targets for cybercriminals and hacktivists Lack of skilled staff Sophistication of attacks According to the 2012 Deloitte – NASCIO Cybersecurity study, many governments fund security at 1-2% of overall IT budget. Some don’t fund it at all. While this study pertained to state governments, local governments have the same issue. In fact, many have little budget for IT as a whole and do not have dedicated IT staff and rely on vendors. 78% of the states saw their security budgets remain about the same or become reduced during 2010 and 2011. The study also pointed out that many CISOs operate in a highly distributed model with little direct authority over agency strategies, activities, and resources. The study also showed that government agencies host systems that contain a lot of personal information, making them attractive targets for cybercriminals and hacktivists.

What Can You Do? Assess and communicate security risks Consider shared security services Encourage user education in security awareness Explore alternative funding for cybersecurity Use the no-cost assessments provided by DHS Encourage IT personnel to use the DHS CSET Tool to do assessments and develop plan of action. Become a member of the MS-ISAC Leverage free cybersecurity training provided by various sources Develop an incident response plan Develop a disaster recovery plan

Cybersecurity Council The Cybersecurity, Education, and Economic Development Council was created under ORC 121.92 in 2012. Consists of 12 members appointed by Governor, Speaker of the House, and President of the Senate. Council is to conduct a study and make recommendations regarding: Improving the infrastructure of the state’s cybersecurity operations with existing resources and through partnerships between government, business, and institutions of higher education. Specific actions that would accelerate growth of the cybersecurity industry in the state.

Questions?

Contact Information David A. Brown State Chief Information Security Officer Ohio Department of Administrative Services 30 E. Broad Street FL 40 Columbus, OH 43215 Office: (614) 644-9391