thor: building a strong cyber defence · thor – building a strong cyber defence. gary hibberd -...

Gary Hibberd - [email protected] -(T) 0845 4133 666 : (M) 0744 7911 742

GARY HIBBERDManaging Director

THOR: Building a strong Cyber defence


Over to you…


• What does ‘Good’ cyber Security look like?

• Setting standards

• Identifying your own threats, vulnerabilities & risks

• THOR – Building a strong Cyber defence

THOR – Building a strong Cyber Defence


What does ‘Good’ look like?


Good Security is a journey.Not a destination.


Defend Deter Develop

Our Vision:We are secure and resilient to cyber threats, prosperous and confident in our digital world.

National Cyber Security Strategy 2016 to 2021


• People

• Premises

• Processes

• PC’s

• Providers

‘Good’


Strategy


Enabler


Remember: No such thing as 100% Secure


Awareness


Business buy-in; IT and Operations


Continual Improvement


• Clear Leadership

• There’s a Strategy

• Security Budget

• It’s an Enabler

• Risk Assessment

Do YOU have this?

• Risk Management

• ‘Some’ Awareness

• Business Buy-in

• Continually Improving


Score: 1 to 101 = Nothing in place10 = No further action required


• Clear Leadership

• There’s a Strategy

• Security Budget

• It’s an Enabler

• Risk Assessment

Do YOU have this?

• Risk Management

• Awareness in place

• Business Buy-in

• Continually Improving


Setting StandardsSetting Standards


Copyright © 2016 BSI. All rights reserved.

The Information Security Journey

CSA STARCertificationFor Cloud

Cyber Essentials

ISO/IEC 27001

Information Security Kitemarks

Above and beyond

Cyber Essentials PlusISO/IEC27018

PCI DSS

Not a sequential journey, but modular options basedon organisational needsLevels of complexity or specialism and requiredinputs by client increase from left to rightVulnerability scanning andpenetration testingBSI KitemarkTM Certification

System audits and certification


Increasing Requirements for Cyber /Information Security:

• From the 1st October 2014 all suppliersmust now be compliant with the newCyber Essentials controls if bidding forgovernment contracts which involve thehandling of sensitive or personal information.



• Secure Configuration• Boundary Firewalls and Internet Gateways• Access Control and Administrative Privilege

Management• Patch Management• Malware Protection



• A specification for an informationsecurity management system (ISMS).An ISMS is a framework of policies andprocedures that includes all legal,physical and technical controlsinvolved in an organisation'sinformation risk managementprocesses.



112 212 322 329 435 552 712 814 14451064 1432

21723563

4800 52896379

7952 8663

10446

42105550

5807

7394

87889665

10422

1011610414

11994

383

519

839

1303

1328

1497

1668

2002

2251

2569

71

128

206

218

279

332

451

511

606

,0

5,000

10,000

15,000

20,000

25,000

30,000

2006 2007 2008 2009 2010 2011 2012 2013 2014 2015

ISO/IEC 27001 - Worldwide total

Middle East

Central and South Asia

East Asia and Pacific

Europe

North America

Central / South America

Africa


Information Security Management SystemISO27001:Annex A

Security Policies Organisation of InformationSecurity Asset Management

Access Control Communications Security Physical & Environment

Operations Security Cryptography Supplier Relationships

System Acquisition, development & maintenance Business Continuity Management

Security IncidentManagementHuman Resources Compliance


ISO27001:2013It is not just about IT!

• IT

• People

• Information

• Intellectual Property

• Infrastructure and Buildings

Security Protection could include for:



Identifying your own threats, vulnerabilities & risksIdentifying your own threats, vulnerabilities & risks


We need to understand…

• What are we trying to protect?

• Where is the data?

• Who is the owner?

• Who has access to it?

• What are they doing with the data?


ACTION:Spend a few minutes reviewing these questions.


Your Business

What are we trying to protect?

Where is the data?

Who is the owner?

Who has access to it?

What are they doing with it?


THOR – Building your own plansTHOR – Building your own plans


THOR

Technical

Human

Operational

Regulatory

THOR


ACTION:Spend a few minutes considering the followingareas


Your Business

Technical

Human

Operational

Operational

Regulatory


Information security is not a technical issue

Finally…


People are our greatest threat

&

our greatest ally


• What does ‘Good’ cyber Security look like?

• Setting standards

• Identifying your own threats, vulnerabilities & risks

• THOR – Building a strong Cyber defence

THOR – Building a strong Cyber Defence


1. Understand your threats and vulnerabilities

2. Getting the basics right

3. Anti-virus, Anti-Spam, Firewall/s Vulnerability &

Penetration testing

4. Security patching for everyone

5. Password Security

6. What is Encryption and Why it’s important?

7. Incident Management and Contingency plans

8. Look at your 3rd parties Suppliers

9. Education, Education, Education

10. ISO27001, PCI DSS or Cyber Essentials

11. Cyber Insurance & how it helps

Cyber Self-Defence


GARY HIBBERDManaging Director

Shúkran.Any Questions?

thor: building a strong cyber defence · thor – building a strong cyber defence. gary hibberd -...

Documents