Thursday, January 23, :00 am – 11:30 am

Agenda  Cyber Security Center of Excellence  Project Phase  Implementation  Next Steps 2

State of Hawaii’s Transformation Programs 3

Cyber Security Center of Excellence Strengthen the ability to detect and respond to enterprise-wide cyber incidents/threats Design a formal enterprise-wide incident response plan Accelerate integration of tools to support SOC Security Operations Center Mission Statement: “To enhance the cyber security posture of the Hawaii State Government through continuous monitoring to proactively identify, isolate and manage security incidents thereby reducing the risks from potential cyber threats.” 4

Assess Plan Implementation Verify and Validate Project Phase 4 Phased Approach 5

6 Implementation - Security Devices

Lessons Learned Integration Process Training Detect AnalyzeRespond Recover Implementation 7 Enterprise-Wide Incident Response Plan

 Detection through ArcSight ◦ Detect intrusions at perimeter, internal network, hosts, applications Implementation - Detect 8

 Detailed Analysis with LiveAction ◦ Determine severity, scope, business impact Implementation - Analyze 9

 Initial Cyber Incident Report ◦ Notification to Business and Program Owners Implementation - Analyze 10

 Response Options ◦ Can stop attack at perimeter, access layer, host, or somewhere in between Implementation - Respond 11

 Recover systems to normal state ◦ Includes threat removal, damage assessment, forensics, reporting and lessons learned  Plan the Recovery  Collect Incident Data  Cleanup & Recovery of Incident  Forensics - Reconstruct  Damage & Cost assessment  Revise plan & response  Complete post-incident analysis and reporting  Reporting internally & to authorities Implementation - Recover 12

 Ensure mitigation efforts were successful ◦ Watch-list monitoring with multiple Cyber Tools ArcSight LiveAction Intrusion Prevention System Implementation – Verify and Validate 13

Next Steps  Continue Server Categorization  Defining use cases for Alerting, Reporting and Dashboards in ArcSight  Continue Adversary Hunting  Continued Ingestion of Devices (Servers, Databases, Routers, Switches, Security Systems)  Begin Enterprise-Wide Incident Response Program Development Thank You 14