Formulating a Security Policy for the Modern IT Landscape

Founder L0pht Heavy Industries Creator Whacked Mac Archives Testified to Congress on “Weak Computer Security in Government” Blackhat, Defcon, HOPE – MTV, ABC, CNN Editor Hacker News Network Strategist Tenable Network Cris Thomas Space Rogue

How can you know if you are taking the right steps and if you are doing enough to protect your assets and business?

Will we be the next headline? Where are our Risks How effective is our security How do we measure success What to invest in next?

Best Practices The 20 Critical Security Controls from the SANS Institute and the Council on CyberSecurityCritical Security Controls The NIST Cybersecurity FrameworkNIST Cybersecurity Framework The National Campaign for Cyber Hygiene from the Center for Internet Security and the Council on CyberSecurityNational Campaign for Cyber Hygiene The PCI Data Security StandardPCI Data Security Standard

Best Practices The 20 Critical Security Controls from the SANS Institute and the Council on CyberSecurityCritical Security Controls The NIST Cybersecurity FrameworkNIST Cybersecurity Framework The National Campaign for Cyber Hygiene from the Center for Internet Security and the Council on CyberSecurityNational Campaign for Cyber Hygiene The PCI Data Security StandardPCI Data Security Standard

FUNDAMENTALS PRACTICE THE FIRST

TENABLE’S 5 CRITICAL CYBER CONTROLS

INVENTORY YOUR ASSETS 1 Software Hardware BYOD Virtual systems Cloud apps SoftwareHardwareBYOD Virtual systems Cloud apps

CONTINUOUSLY PATCH 2 Detect public vulnerabilities Find machines that are missing patches Operating systems Applications Infrastructure Detect public vulnerabilities Find machines that are missing patches Operating systems ApplicationsInfrastructure

SECURE THE NETWORK 3 Anti-virus Application white listing Intrusion prevention Access control Threat subscriptions Segment your network and data Anti-virus Application white listing Intrusion prevention Access control Threat subscriptions Segment your network and data

LIMIT USER ACCESS 4 No default accounts Enforce strong passwords Log all accesses Review which account have access to which resources Review which accounts have access to which resources Log all accesses Enforce strong passwords No default accounts

SEARCH FOR MALWARE 5 Malware Bad guys Insiders MalwareBad guysInsiders

The Modern Landscape Next Gen Vulnerability Management Malware Detection Compliance and Patch Monitoring Network Behavior Analysis Log Collection Forensic Analysis Incident Response Mobile, Virtual and Cloud Coverage