Conostix S.A. Sensible defence

Conostix S.A. CIA and prevention/dectection/response Risk management and its pitfalls Economic incentives Liability/regulation/compliance Due care and due dilligence Technology Awareness Conclusion Introduction

Conostix S.A. To ensure the CIA triad we use: Detection Prevention Response How security works

Conostix S.A. Identification Identify the actual threat Impact factor The possible consequences of an attack Frequency The probable frequency of the occurrence of a threat Probability The extent of how confident we are a threat will happen Today’s risk management Identification of a threat

Conostix S.A. Identification of the current risks The cost/benefit justification of the countermeasures Influences the decision making process on hardware, etc Focus on security resources where they are needed most Today’s risk management Risk analysis goals

Conostix S.A. Threat Asset Vulnerability Safeguard Asset value (AV) Exposure factor (EF), value in percentage Single loss expectancy (SLE), dollar figure (EFxAV) Annualized rate of occurrence Annualized loss expectancy (ALE= SLExARO) Today’s risk management Risk analysis – key terms

Conostix S.A. Aims to assign tangible values Relies on qualitative data Process Estimate potential losses to the assets Analyze potential threats to the assets Define impact and frequency levels Define the ALE Today’s risk management Risk analysis – Quantitative

Conostix S.A. Scenario oriented approach Rank threats on a scale to evaluate their risks, costs and outcome In contrast to quantitative analysis a purely qualitative analysis is always possible High guess rating Today’s risk management Risk analysis – Qualitative

Conostix S.A. Misunderstanding between risk and certainty A risk is the anticipated frequency of losses Certainties are occurring with high frequency Reliance on probability, impact and frequency The unknown, controls the probability, frequency and the impact of a future incident. Today’s risk management Pitfalls

Conostix S.A. Benefits vs costs Economic pressure Sensible defence Economic incentives

Conostix S.A. Laws push standards Liability creates awareness Regulatory bodies motivate Sensible defence Liability, regulation, compliance

Conostix S.A. Due care is using reasonable care to protect the interests of an organization Due diligence is practicing the activities to maintain the due care efforts. Common sense security framework Sensible defence Due care and due diligence

Conostix S.A. Functionality vs security User friendly does not mean insecure Ease-of-Use + Common Sense = Security Privacy vs security Sacrifice privacy for security? Should security protect privacy or ignore it to enhance security? Sensible defence Technology

Conostix S.A. Human intelligence most important Reduce risk without technology Limit damage in case of an incident Give users insight in values of company assets and the usage of information systems Sensible defence Awareness

Conostix S.A. Sensible defence is balanced security Balance cost vs economic gain Balance liberty vs privacy Balance functionality vs security Liability, legislation and regulation Sensible defence security is a trade-off

Conostix S.A. Q & A Thanks to: My colleagues Donn Parker Bruce Schneier Rebecca Herolds Sensible defence Questions?