1. Current / Emerging Cyber Threats & Leadership Considerations June 2016

2. Bio Information Two companies focused on SCRM
CEO Leader in STEM
2014 AT&T Innovator of the Year
2014 SmartCEO Brava Award
2010 American Express Open Government Contractor of the Year
Two companies focused on SCRM
Interos Solutions (2005 – present)
Vigillence (2014 – present)
US Delegate to the W20/G20
President – WIPP International (2014 – present)
Virginia Governor’s Cybersecurity Commission
International Cyber Dialogue: Executive Committee
DHS IT-SCC Member
Open Group Member
Chairperson NDIA Cyber Division Co-chair ( )
DHS SSCA WG1 Co-chair ( )
ACT-IAC: Cyber Chair ( )

3. Agenda
Why is this Relevant?
The Threats We Face
Changes & Cyber Specific Concerns
A Question of Leadership
A Discussion
Cyber Expert? Listen and understand how to communicate with the rest of us!

4. Why is this Relevant To You?
Physical Safety is no longer your only – nor your most persistent - risk
Exponential technologies are revolutionizing industries – and introducing risks that never existed before
Cyber is not only a technical issue
If cyber is not one of the primary considerations in your leadership planning, you will get burned
With the increased convergence of cyber and physical worlds, attacks are no longer limited to office computers and networks

5. The Who - a range of cyber threats to any economy and national security
Any economy, government and society relies on a digital infrastructure.
That reliance creates vulnerabilities to cyber threats.

6. The How – Three Threat Vectors
Insider Threats – Malicious and Good but Dumb: Most numerous
Remote / Proximate Threats – Hacking: Most well known
Supply Chain Threats:
Requirements Development
Design
Assembly
Transit
Installation & Maintenance
POS system interaction
Partner access to networks
Verizon 2016 Data Breach Investigations Report

7. The What - Cyber Ecosystem
Supply Chain Threats
Remote & Proximate
Threats
IT Infrastructures
Supply chain threats are huge. Supply chain presents a long and inviting attack surface.
Data
Network
Facilities
Hackers shift exploit strategies & techniques as defenses improve.
- Air Gap Hoppers
Personnel
Insider Threats
Hardening systems & supply chains make the insider threat paramount

8. Changes We face
Change 1: The impact and visibility of recent breaches calls into of traditional security measures – w/ good reason.
(WikiLeaks, Stuxnet, RSA, Sony, Banks, Saudi ARAMCO, Target)
Change 2: Security challenges are impacting innovation adoption.
(Mobile, Cloud, Social Media, Business Intel)
Change 3: The surface for a typical network is growing at an exponential rate – Target Rich Environment
(People, Data, Infrastructure, Applications, BYOD, Others?!)
Change X: Snowden Disclosures

9. Other Issues Mobil Computing – Today’s biggest problem
Cloud Computing – The way of the future
Smart Grid – Ukraine attack brought this to the forefront
SCRM – Board and C-Suite Concern
Stuxnet / DuQu / Flame - Elegant
Conficker – Who Knows?
Shamoon - Brute force “warning”
U.S. Programs – Will they continue?
Legislative solutions – Open Issue

10. What Do We Do? Our Differentiator
Risk Category
Risk Factor
Description
Technical Risk
Quality Assurance
Vendor’s policies/standards, testing, and consumer reviews
Production & Manufacturing
Production/manufacturing strategy, plans, and implementation
R&D Innovation
Investments and plans for product/process improvements and advancements
Business Risk
Leadership & Organization
Foreign Ownership, Control and Influence (FOCI) and Foreign Intelligence Entity (FIE) concerns, company leaders, its associations, as well as person-to-person relationships.
Supplier Management
Current state, strategy, and plans on how the company manages external suppliers
Business Alliances
Current state, strategy, and plans relative to key joint ventures, partnerships, acquisitions, etc.
Market Risk
Industry Market Position
Financial status, sources of investment, and revenues by category/source, including United States government contracts
Revenue & Financial
Assessment of annual revenue and business profitability
Regulatory & Legal
Regulatory/legal trends, actions, issues and financial concerns
Security Risk
Socioeconomic Environment
Current state, trends, issues, and concerns relative to the geographical locations and socioeconomic conditions of the business/product
Cybersecurity
Technical vulnerabilities, instances of cyber breach or historic trends
Physical Security
Evaluation of physical security across the supply chain, to include security issues and concerns emanating from people involved

11. What is my Corporate Risk Posture?

12. How Do My Vendors Stack Up?

13. Who Is Hiding In My Supply Chain?

14. The Role of Leadership in a Holistic Solution
Cyber Personal Hygiene – Like Salt
Awareness, Education, and Training – The forgotten foundation
Everyone needs to understand the Cyber Issues, not just the Geeks
You must enforce the rules, even on yourselves
Do not blow off SCRM!
You must have the best tech solutions - but w/o leadership it will still fail
Our biggest strength / Our biggest Vulnerability
It is YOUR responsibility to know and to act

15. ‘We used to be a utility company that used technology….
The New T-Shirt
‘We used to be a utility company that used technology….
…now we’re a technology company [in the industry sector]’

16. Jennifer Bisceglie
CEO
Vigillence, Inc
1725 Duke Street
Suite 510
Alexandria, VA 22314