GACC MIDWEST LUNCHEON SERIES

Transcription

1

2 GACC MIDWEST LUNCHEON SERIES State of the Information Security July 12, 2017

3 With you today Jay Schulman Principal, Great Lakes Security & Privacy Leader Focused on helping companies build and improve their security Looked at the security in cars, pacemakers, welding machines and many applications. 3

4 THE LATEST STATISTICS

5 Security statistics Compiled from: - NetDiligence/RSM 2016 Annual Cyber Claims Study 5

6 Security statistics (continued) Compiled from: - NetDiligence/RSM 2016 Annual Cyber Claims Study 6

7 Security statistics (continued) Compiled from: - NetDiligence/RSM 2016 Annual Cyber Claims Study 7

8 Security statistics (continued) Compiled from: - NetDiligence/RSM 2016 Annual Cyber Claims Study 30% of breaches were due to insiders. Of those, 77% were unintentional. 8

9 Don t believe all stats Compiled from: - NetDiligence/RSM 2016 Annual Cyber Claims Study This is historically the number one metric used in breaches. While the average is $17k, the mean is $39 per record. There are a small number of records which had a $3mil per record cost which skewed the results. So don t believe all of the data! 9

10 THREAT OVERVIEW

11 Think differently Threats (how) Actors (who) Threat model Risk tolerance (why) Mitigations and assessment strategy Assets (what/where)

12 Actors (who) Who are the bad actors you re concerned with? Employee Contractor Customer Random attacker Focused attacker State-sponsored attacker Actors (who) Threat model

13 Threats (how) How are the bad actors going to attack you? From the Internet From your internal network From your wireless network In your databases In the cloud Via From USB keys From the phone Threats (how) Threat model

14 Assets (what/where) What data do they want? Customer records Employee records Money transfer Money laundering Ransomware Assets (what/where) What data elements are they trying to steal? Social Security numbers Credit card W2 ACH/account number Threat model

15 Risk tolerance (why) Every scenario has a cost. What is your risk tolerance? Financial risk Brand risk Operational risk Risk tolerance (why) Threat model

16 Mitigations The result is a set of scenarios that are most important to you. You use these scenarios to: Assess the likeliness of being impacted from them Build a strategy to protect yourself against them Hedge your losses against them with cyber-insurance Accept the risk Mitigations and assessment strategy Threat model

17 17

18 18

19 RSM US LLP 1 South Wacker Drive, Ste. 800 Chicago, Illinois This document contains general information, may be based on authorities that are subject to change, and is not a substitute for professional advice or services. This document does not constitute audit, tax, consulting, business, financial, investment, legal or other professional advice, and you should consult a qualified professional advisor before taking any action based on the information herein. RSM US LLP, its affiliates and related entities are not responsible for any loss resulting from or relating to reliance on this document by any person. Internal Revenue Service rules require us to inform you that this communication may be deemed a solicitation to provide tax services. This communication is being sent to individuals who have subscribed to receive it or who we believe would have an interest in the topics discussed. RSM US LLP is a limited liability partnership and the U.S. member firm of RSM International, a global network of independent audit, tax and consulting firms. The member firms of RSM International collaborate to provide services to global clients, but are separate and distinct legal entities that cannot obligate each other. Each member firm is responsible only for its own acts and omissions, and not those of any other party. Visit rsmus.com/aboutus for more information regarding RSM US LLP and RSM International. RSM and the RSM logo are registered trademarks of RSM International Association. The power of being understood is a registered trademark of RSM US LLP RSM US LLP. All Rights Reserved.