valuendo 25 things not to do (march 2009) handout

1

25 tips & tricks

Marc Vael InfoSecurity 2009Valuendo March 2009

© 2009 Valuendo. All rights reserved. 1INFORMATION CLASSIFICATION = PUBLIC

25 Examples of what you should not do

March 2009

Mr. Marc VaelManaging Director

Valuendo


Agenda

• Introduction• Concept• 25 Statements• Conclusion

2

25 tips & tricks



• Marc Vael• Managing Director Valuendo (“value & do”) since July 2001• Education

– Master Applied Economics (UAntwerp)– Master Information Management (UHasselt)– Master+ Applied Economics & ICT (KUL)

• Core Services– Enterprise Risk Management– IT Governance–– Information Security ManagementInformation Security Management– Data Privacy & Protection– Business Continuity / Disaster Recovery – Crisis Management– IT Audit & Compliance

• Certifications in good standing– CISA / CISM / CISSP / ITIL Service Manager

Introduction


• First : Statement

• Second : Voting on your current experience

Concept

3

25 tips & tricks



Test : The economic crisis has no impact on the way we handle security

• Fully Agree • Do not agree • Don’t know really


Lesson 1 : Security > Business needs

•Yes •Not always •No

4

25 tips & tricks



Lesson 2 : It is the CISO who is driving security in our organisation

•Of course. •No, the real driver is someone else •I’m not sure


Lesson 3 : Security budget is easy to calculate and to defend/present

•Absolutely •Difficult to calculate, but easy to defend / present •Not really

5

25 tips & tricks



Lesson 4 : The security vision is understood by everyone

•Yes and we even have checked this

•We hope so •No


Lesson 5 : Everybody understands security terminology used

•Yes we know and we even have a glossary •We hope so •No

6

25 tips & tricks



Lesson 6 : Security and risk management are two different professions

•Yes •No •Don’t know really


Lesson 7 : People recognize security incidents

•Yes and we even have tested this

•We hope so •No

7

25 tips & tricks



Lesson 8 : People know how to classify and secure their information


•We hope so •No


Lesson 9 : Security audits are essential to determine what’s wrong

•Yes •We hope so •No

8

25 tips & tricks



Lesson 10 : Security awareness posters are the most effective tool


•We hope so •No


Lesson 11 : People remember all passwords & pin-codes


•We hope so •No

9

25 tips & tricks



Lesson 12 : People always select a strong password

•Yes and we even enforce this

•We hope so •No


Lesson 13 : People lock their PC information via screen saver


•We hope so •No

10

25 tips & tricks



Lesson 14 : People respect clean desk policy


•We hope so •No


Lesson 15 : People always use the security tools we give them


•We hope so •No

11

25 tips & tricks



Lesson 16 : IT people give the good example of respecting security rules


•We hope so •No


Lesson 17 : People only use official authorized software


•We hope so •No

12

25 tips & tricks



Lesson 18 : Only naughty people get naughty spam mails



Lesson 19 : Only dumb people fall for phishing scams / mails


13

25 tips & tricks



Lesson 20 : People mention their backups in their OOO when unavailable



Lesson 21 : People suggest alternative communication channels when unavailable


14

25 tips & tricks



Lesson 22 : People know & respect security rules when at other companies



Lesson 23 : People need full internet access for professional reasons


15

25 tips & tricks



Lesson 24 : People know how to secure their wired & wireless network access



Lesson 25 : Security is still better on paper than on digital format


16

25 tips & tricks



Conclusion


Mr. Marc Vael, Mr. Marc Vael, CISA, CISM, CISSP, ITILCISA, CISM, CISSP, ITIL

Managing DirectorManaging Director

ValuendoValuendoKriebrugstraat 33Kriebrugstraat 331760 Roosdaal1760 RoosdaalBelgiumBelgium

T: +32 5 433 61 93T: +32 5 433 61 93M: +32 473 99 30 31M: +32 473 99 30 31M: M: mvael@[email protected]: W: www.valuendo.comwww.valuendo.com

Contact information

valuendo 25 things not to do (march 2009) handout

Business

information classification

public marc vaelinfosecurity

director valuendo value

public lesson

public marc vael infosecurity

tips trickslesson

thiswe hope sono

tips tricks lesson