1. Leverage What’s Out There
How to create an Information Security Program
By Brian Collentine

2. I Can Sleep at Night Creating an information security program
It’s all about risk management and prioritization
Where to start?
NIST’s Cybersecurity Framework
20 Critical Security Controls

3. There are seldom technological solutions to behavior problems.
You have to do stuff. Cultural shifts need to happen if security is not taken seriously. No program, service or person will be the magic bullet

4. Information Security Program, what’s that?
Collection of
Policies
Procedures
Processes
Risk assessments
Audits
Reports
Forms

5. But First… Which sounds better?
We monitor the activity of remote access users.
We log, record and review each user and the user’s frequency of access.

6. Track how you are doing. Use this to report to management
Track how you are doing. Use this to report to management. Take credit for the work you are doing.

7. NIST’s Cybersecurity Framework
Created by Executive Order
Released in 2014
Used to communicate risk from Server Room to Board Room
30% of companies use it today
50% projected to by 2020
Developed for Critical Infrastructure Areas
16 areas
Sound familiar

8. How does it work Framework Core Framework Profile
Framework Implementation Tiers
Framework Core
Identify
Protect
Detect
Respond
Recover
Framework Implementation Tiers
How mature is your program
Partial
Formalized
Repeatable
Adaptive

9. Cybersecurity Framework Details
Relies on 2 profile states
Current and Target State
Gap between is security plan
Execs set mission priorities
Business process level focuses on activities to manage risk within budget

10. Risk Assessment Basics
Threat or Vulnerability =
Impact x Likelihood

11. 20 Critical Security Controls
Created in 2008
Updated version in 2016
Controls developed by industry experts

13. First 5 Controls
CSC 1: Inventory of Authorized and Unauthorized Devices
CSC 2: Inventory of Authorized and Unauthorized Software
CSC 3: Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers
CSC 4: Continuous Vulnerability Assessment and Remediation
CSC 5: Controlled Use of Administrative Privileges
If you do nothing else, review the first 5 controls and create repeatable processes for each.
Referred to as Foundational Cyber Hygiene

14. Give me some numbers Ability to measure current state
Measure is a concrete figure
X computers on network are fully patched
Unauthorized software is detected within X days.
Metric is an abstract, subjective attribute
How well a network is secured against external threats.
A metric can be assigned by collecting and analyzing groups of measures.

15. Developing the Program
Create a strategy
Start small
Excel works just fine for tracking
For each item create:
How To document
Report Template
Key is repeatable processes

17. Thanks for the “info”
How do I turn this into anything meaningful?

18. How about a freebie? CSC-1 Workstation Inventory
All PC’s, laptops, tablets
Everyone has a spreadsheet or database that they believe is the end-all-be- all list of computers
Audit that list
Export computer list from A/D
Compare to manual list

19. Let’s take it up a notch! Pull list from WSUS
Are all PC’s compliant (i.e. fully patched)?
Pull list from A/V console
Do all PC’s have current defs?
Have they had a virus scan recently?
Are any PC’s missing?
Do those have AV installed/running?
Pull list from WDE system
Are all PC’s encrypted?
Should they be?
How are you making the case to yourself that laptops don’t’ need to be encrypted?

20. Thank you
Brian Collentine