Risks vs real life

Risks vs real life

• 1.
  RISKS VS. REALLIFE Mona Arkhipova Unit Manager of information security architecture and monitoring Acronis
• 2.
  PROPRIETARY AND CONFIDENTIAL2PROPRIETARY AND CONFIDENTIAL 2 About me Unit Manager of information security architecture and monitoring, Acronis Past: • Head of SOC and OPS monitoring, Lead information security expert at QIWI group; • Security analyst at General Electric (GE Capital); • independent security consultant at fintech start-ups; • *nix systems and network administrator
• 3.
  PROPRIETARY AND CONFIDENTIAL3PROPRIETARY AND CONFIDENTIAL 3 Traditional approach Risk is a function of the likelihood of a given threat-source’s exercising a particular potential vulnerability, and the resulting impact of that adverse event on the organization. - NIST 800-30 Risks management is the base for most part of security-related standards. But is it applicable to security in real life?
• 4.
  Prepare your perimeters
• 5.
  PROPRIETARY AND CONFIDENTIAL5PROPRIETARY AND CONFIDENTIAL 5 Physical security Most widely used state to argue about internal systems’ security: “Why should we harden this asset/application/device? It’s for internal users only, no one can enter our office! There’s no risk!” There are many ”unbelievable” ways to get inside: • Shared areas in your business center • ”Comfortable” ways to less secure areas for employees • Good old social engineering
• 6.
  PROPRIETARY AND CONFIDENTIAL6PROPRIETARY AND CONFIDENTIAL 6 Internal resources One more state to argue about internal systems security: “Why should we harden this asset/application/device? It’s for internal users only, everyone should be authorized to use those systems! The risk is low!” In many companies way inside is much easier than it could be imagined: • Lack of segmentation • Lack of controls on remote access • External-facing intranet portals • Oh, and one step back – physical security
• 7.
  PROPRIETARY AND CONFIDENTIAL7PROPRIETARY AND CONFIDENTIAL 7 Test environments ”There’s no sensitive data, it is not production” Common mistakes: • Not (properly) segregated from internal network • Passwords/keys reuse • Core management systems links • Often DOES CONTAIN production data
• 8.
  PROPRIETARY AND CONFIDENTIAL8PROPRIETARY AND CONFIDENTIAL 8 (Not so) good services Do you really rely on external services? • Had you ever reviewed information you send? • Aren’t you afraid to transfer your sensitive data to services with no formal background? • Do you believe to your security service providers’ employees like your own ones? • Do you have 3rd party security review?
• 9.
  Legacy systems
• 10.
  PROPRIETARY AND CONFIDENTIAL10PROPRIETARY AND CONFIDENTIAL 10 Mission-critical systems ”We can not patch the system, it’s too critical, update would ruin it” • Good start point for your BCM program • Vulnerability and patch management declared by standards • One day it may ruin your business not only for security reasons • Human mistakes • Lack of expertise (delayed issues)
• 11.
  PROPRIETARY AND CONFIDENTIAL11PROPRIETARY AND CONFIDENTIAL 11 Core Business Impact Code quality and less legacy directly affects business, especially based on in- house developed applications  Good code – stable and secure code  Stable code is the basic brick of overall service stability and availability  Stable HA service – good customer experience  Good customer experience brings more than just money.
• 12.
  Weakest link inyour security chain
• 13.
  PROPRIETARY AND CONFIDENTIAL13PROPRIETARY AND CONFIDENTIAL 13 Endpoints “I’m tired of all that weekly/monthly/quarter reboots” • Security is around data, not only a server somewhere • Old good software may be a great security risk • …as well as service tested on workstation for faster feedback/dev/PoC/whatever • What’s about lost devices, BYOD and remote access?
• 14.
  PROPRIETARY AND CONFIDENTIAL14PROPRIETARY AND CONFIDENTIAL 14 Employees ”Our employees are loyal, we believe them” • Prepare for a lot of disappointment after DLP installation • Not all loyal employees stay loyal in crisis situations (or just local conflicts) • Not all “oldboys” are playing on your side • Unspoken things about contracts bribery and its detection • Not all companies have employment pre-checks and proper conflict of interests detection • Do you really know your data flows?
• 15.
  Questions? Mona Arkhipova Unit Managerof information security architecture and monitoring [email protected] /monaarkhipova