SlideShare uma empresa Scribd logo

Proactive Counterespionage & Business Continuity / Resiliency

•
•
Dr. Lydia Kostopoulos
Dr. Lydia Kostopoulos

The session will discuss means in which information assets and business continuity is protected and propose an additional layer of defense with a human counterespionage focus. The proposed proactive counterespionage plan includes operational security audits, reverse open source intelligence and classification of employees who are prime targets for disruptive espionage. - See more at: http://www.rsaconference.com/events/ad15/agenda/sessions/2219/proactive-counterespionage-as-a-part-of-business#sthash.JUipJ0BR.dpuf

Tecnologia
1 de 20
Baixar para ler offline
SESSION ID: #RSAC Lydia Kostopoulos, PhD Proactive Counterespionage as a Part of Business Continuity and Resiliency SOP-R06 Intelligence & Cybersecurity Professor / Institute of International and Civil Security (IICS) International Engagement Coordinator / Cyber Security Forum Initiative (CSFI) @LKCYBER
#RSAC @LKCYBER Silkroad
#RSAC @LKCYBER (Economy) Business Innovation Espionage National Security • Economic Prosperity • National Defense • Geopolitical Interests • Socio-Cultural Values • Competitive Intellectual Property • Business Growth: Financial, Service & Product • Innovation Capacity & Capability • Reputation Management • Criminal • Industrial • Nation-State • Non-state Political Cybersecurity Scope: Focus: Human Factor
#RSAC @LKCYBER We set up network defenses… Intrusion Detection System Defense in Depth Firewall We set up data defenses… Destruction What about human defenses? Encryption Data in Use At Rest In Motion Classification Internal Use Public Confidential Secret We set up malware defenses… Anti-Virus Spam Filter? Data Leakage Prevention Data Loss Prevention Identity & Access Management Phishing
#RSAC @LKCYBER Why are human defenses important?  Roles in an organization that are instrumental in achieving the desired goals and fulfilling aspirations set forward in the business strategy and vision. * Business Critical Roles can also be viewed as: High Value Targets, Key People Terrain, (Single) Points of Failure, or Nodes of Compromise.  Should people in these roles be compromised it would constitute a point of failure with potentially serious to detrimental repercussions for business continuity and operations. Business Critical Roles (BCR)
#RSAC @LKCYBER - Tangible and intangible - Internal knowledge of organization structure and operations - Trade secrets - Business intentions - Data, networks, servers, people, proprietary ideas, trade secrets, money, internal strategy and intent - Innovative ideas, insight and perspective - Intellectual capacity and capability - Motivation and aspiration Information Access Intellect What form of assets do BCR roles have? What happens when people in Business Critical Roles are Compromised? 2030 205020402020 Internal divides, issues, problems Org structure: official vs reality
#RSAC @LKCYBER Attacks: Human Factor & Intellectual Property (IP)  91% of cyberattacks begin with spear phishing email – TrendMicro Research IP Intensive Businesses in the US • Support at least 40 million jobs • $5 trillion to US GDP  28%  $445 billion – annual cost of cybercrime and economic espionage to the world economy - 2014 CSIS & McAfee report How much does it cost the world? What’s the most common attack vector?
#RSAC @LKCYBER Get Cyber Safe
#RSAC @LKCYBER "Never underestimate the impact of user behavior on a defensive strategy" Admiral Rogers Director of US Cyber Command/NSA
#RSAC Proactive Counter-Espionage Roadmap
#RSAC @LKCYBER Proactive Counter-Espionage Roadmap Phase 1: Identification of Business Critical Roles & Espionage Risk Proactive Counter-Espionage Phase 2: Policy Creation Phase 3: Communication Protocol Phase 4: Operationalize Whole of Enterprise Approach
#RSAC @LKCYBER Categories of Business Interests • Define levels of espionage risk from low (1) to high (5). Collaboration with Business Strategists, Business Intelligence and Security Operations. • Risk levels should be defined as per impact to business interests, incorporate business intelligence and reflect organization’s risk appetite. Proactive Counter-Espionage Roadmap Phase 1: Identification of Business Critical Roles & Espionage Risk Identify Business Critical Roles (BCR) Levels of Espionage Risk • Map business critical roles on top of categories of business interests. Use business strategy as guidance. • Identify people who represent business continuity points of failure in these goals should they be compromised. • Determine areas that are business critical to identified business continuity goals. Reflective of Business strategy, interests, goals, aspirations and continuity plan. • Define BCR roles within categories and risk levels specifically as they pertain to the respective business. • Definitions should clearly indicate criticality of role responsibilities and the value the people in these roles bring to achieving desired business goals, as well as the risk for business continuity should they be compromised. • Prepare tailored risk profiles of business critical roles to be delivered for situational awareness, policy creation and need based use by: - Business Strategists - Human Resources - Business Intelligence - Security Operations - Information Security Enterprise Risk Risk Profile
#RSAC @LKCYBER Proactive Counter-Espionage Roadmap Phase 2: Policy Creation Human Resources Information Security Policy Creation Business Intelligence Inter-Departmental Collaborative Effort • Establish BCR related policies to preserve, protect and maintain operational security (OPSEC) • Establish policies for reverse open source intelligence (OSI) hunting and information sanitization • Create policy for identity and access management • SIEM policies for life-cycle of employee and role type • Establish defined ‘need to know’ events relating to employee • Internal classification of high espionage risk roles/responsibilities • Establish hiring policies for different roles and risk levels
#RSAC @LKCYBER Hardening Human Assets (HHA)  Be proactive not reactive  Cross departmental teamwork Security Culture People: High Espionage Risk  OPSEC Awareness  Social Engineering Awareness  Specialized SIEM Settings (Cross-departmental collaboration)  Espionage Threat Awareness  Data Protection Awareness  Social Media Use Awareness  Travel Security Awareness Proactive Counter-Espionage Roadmap Phase 2: Policy Creation - Awareness Human Assets Whole of Enterprise Approach Hardening of Human Assets (HHA) – The process of elevating security awarenessof a human asset in efforts to reduce and eliminate as many risks as possible.
#RSAC @LKCYBER Proactive Counter-Espionage Roadmap Phase 3: Communication Protocol
#RSAC @LKCYBER Proactive Counter-Espionage Roadmap Phase 4: Operationalize TimelinePrioritize DelegateMethodPhase 4 • Determine the best method for implementing the roadmap. • Identify chain of command for operationalizing the roadmap with key stakeholders. • Assess impact of unique organizational culture, operations and resources of the organization in question. • Detail a list of tasks to be done. • Prioritize identified tasks into essential tasks, primary and secondary tasks. • Prioritization decided by those at the top of the chain of command for operationalizing the roadmap. • Agree on a suitable timeline for operationalizing the roadmap. • Delegate people who will be responsible for task completion and oversight. Monitoring Reporting KPI
#RSAC @LKCYBER “The only thing constant in life is change.” - Ancient Philosopher Heraclitus Be agile and adapt to constantly changing circumstances!
#RSAC @LKCYBER Our adversaries are relentless in acquiring our data, we should be relentless in protecting it. @LKCYBER
#RSAC Questions?
#RSAC @LKCYBERImage reference for images used in this presentation 20 http://apworldhistory2012-2013.weebly.com/uploads/9/9/9/6/9996001/8757598.jpg?696 http://www.firstpointit.com/wp-content/uploads/2014/03/business-icon1.png http://www.iftr.in/attachments/Image/rd1.jpg?1430157298948 https://www.sanjuancollege.edu/Images/HR/people.jpg http://d1du5om4ehlar1.cloudfront.net/wp-content/uploads/2015/02/product.png?529770 http://www.mobot.net/writer/wordpress/wp-content/uploads/2012/08/light-bulb.jpg http://www.strategy4seo.com/wp-content/uploads/2012/11/unique-content.jpg http://www.medical-billing.com/img/revenue-cycle-management.jpg http://bloximages.chicago2.vip.townnews.com/alligator.org/content/tncms/assets/v3/editorial/9/84/98428ba2- d08d-11e2-a775-0019bb2963f4/51b3b501c96e7.image.jpg https://www.ase.org/sites/ase.org/files/styles/featured_blog/public/broken_link.jpg?itok=uNpj5vWL http://prajwaldesai.com/wp-content/uploads/2013/11/firewall_man.png http://www.cloneguard.com/images/firewall-network.png http://www.teach-ict.com/images/stk/network_firewall.jpg http://www.liquidtechnology.net/img/layout/icon-data-destruction.png https://plannetplc.files.wordpress.com/2010/12/tech_55.jpg https://portal.utpa.edu/portal/page/portal/utpa_main/daa_home/hshs_home/pasp_home/imagesfiles/email.png http://svmtinc.us/wp-content/uploads/2013/11/Document-Management.png http://beandesoftware.com/img/DB-DEV-3.png http://true-hire.com/wp-content/themes/truehire/images/credentials_icon.jpg https://www.isheriff.com/img/icon_analysis_db_250.png http://www.iconshock.com/img_jpg/BETA/networking/jpg/256/spam_icon.jpg http://niiconsulting.com/checkmate/wp-content/uploads/2013/01/DLP.png http://www.immunitynetworks.com/images/identity-protection-and-management.jpg http://noticias.automoveis-online.com/wp-content/uploads/2012/07/Sabe-o-que-%C3%A9-Phishing.jpg https://cdn0.iconfinder.com/data/icons/financial-3/500/Financial_phishing-512.png http://www.defense.gov/News-Article-View/Article/616569/rogers-outlines-cyber- challenges-facing-dod-us https://manunicareersblog.files.wordpress.com/2015/04/istock_000013296501small- network-of-people.jpg http://knowledgecafe.care2share.wikispaces.net/file/view/sna2.jpg/30810569/sna2.jpg https://www.manageengine.com/network-monitoring/images/network-mapping.jpg https://www.deksoftware.com/dna/images/window.png http://www.2020spaces.com/wp- content/uploads/2014/05/Depositphotos_2077697_original3.jpg http://www.slidehunter.com http://weinspirefutures.com/wp-content/uploads/vacay.png https://c1.staticflickr.com/3/2385/2073251155_0451f31674.jpg http://precisemgmt.net/wp-content/uploads/2015/07/24x7-monitoring1.jpg http://www.paydiddy.com/gallery/cisco-cdr-reporting-software-is-the-provider- important-pic/Cisco-CDR-reporting-software-is-the-provider-important.jpg http://jerryching.no-ip.org/Software/Photo/Icon/Windows%207%20Blue%20Icons%20& %20Cursors/PNG/Folders/Documents.png http://www.getcybersafe.gc.ca/cnt/rsrcs/nfgrphcs/nfgrphcs-2012-10-11-en.aspx

Recomendados

Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligence
Syed Peer
 
GCC Operational Technology Security Forum & Exhibition, 21-23 March 2017, Doha
GCC Operational Technology Security Forum & Exhibition, 21-23 March 2017, DohaGCC Operational Technology Security Forum & Exhibition, 21-23 March 2017, Doha
GCC Operational Technology Security Forum & Exhibition, 21-23 March 2017, Doha
Syed Peer
 
Global Cyber Threat Intelligence
Global Cyber Threat IntelligenceGlobal Cyber Threat Intelligence
Global Cyber Threat Intelligence
NTT Innovation Institute Inc.
 
Threat Intelligence in Cyber Risk Programs
Threat Intelligence in Cyber Risk ProgramsThreat Intelligence in Cyber Risk Programs
Threat Intelligence in Cyber Risk Programs
Rahul Neel Mani
 
6 Steps for Operationalizing Threat Intelligence
6 Steps for Operationalizing Threat Intelligence6 Steps for Operationalizing Threat Intelligence
6 Steps for Operationalizing Threat Intelligence
Sirius
 
Cyber Threat Intelligence | Information to Insight
Cyber Threat Intelligence | Information to InsightCyber Threat Intelligence | Information to Insight
Cyber Threat Intelligence | Information to Insight
Deep Shankar Yadav
 
How to build a cyber threat intelligence program
How to build a cyber threat intelligence programHow to build a cyber threat intelligence program
How to build a cyber threat intelligence program
Mark Arena
 
Cyber threat Intelligence and Incident Response by:-Sandeep Singh
Cyber threat Intelligence and Incident Response by:-Sandeep SinghCyber threat Intelligence and Incident Response by:-Sandeep Singh
Cyber threat Intelligence and Incident Response by:-Sandeep Singh
OWASP Delhi
 

Recomendados

Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligence
Syed Peer
 
GCC Operational Technology Security Forum & Exhibition, 21-23 March 2017, Doha
GCC Operational Technology Security Forum & Exhibition, 21-23 March 2017, DohaGCC Operational Technology Security Forum & Exhibition, 21-23 March 2017, Doha
GCC Operational Technology Security Forum & Exhibition, 21-23 March 2017, Doha
Syed Peer
 
Global Cyber Threat Intelligence
Global Cyber Threat IntelligenceGlobal Cyber Threat Intelligence
Global Cyber Threat Intelligence
NTT Innovation Institute Inc.
 
Threat Intelligence in Cyber Risk Programs
Threat Intelligence in Cyber Risk ProgramsThreat Intelligence in Cyber Risk Programs
Threat Intelligence in Cyber Risk Programs
Rahul Neel Mani
 
6 Steps for Operationalizing Threat Intelligence
6 Steps for Operationalizing Threat Intelligence6 Steps for Operationalizing Threat Intelligence
6 Steps for Operationalizing Threat Intelligence
Sirius
 
Cyber Threat Intelligence | Information to Insight
Cyber Threat Intelligence | Information to InsightCyber Threat Intelligence | Information to Insight
Cyber Threat Intelligence | Information to Insight
Deep Shankar Yadav
 
How to build a cyber threat intelligence program
How to build a cyber threat intelligence programHow to build a cyber threat intelligence program
How to build a cyber threat intelligence program
Mark Arena
 
Cyber threat Intelligence and Incident Response by:-Sandeep Singh
Cyber threat Intelligence and Incident Response by:-Sandeep SinghCyber threat Intelligence and Incident Response by:-Sandeep Singh
Cyber threat Intelligence and Incident Response by:-Sandeep Singh
OWASP Delhi
 
Actionable Threat Intelligence
Actionable Threat IntelligenceActionable Threat Intelligence
Actionable Threat Intelligence
OWASP Delhi
 
IOCs Are Dead—Long Live IOCs!
IOCs Are Dead—Long Live IOCs!IOCs Are Dead—Long Live IOCs!
IOCs Are Dead—Long Live IOCs!
Priyanka Aash
 
Practical and Actionable Threat Intelligence Collection
Practical and Actionable Threat Intelligence CollectionPractical and Actionable Threat Intelligence Collection
Practical and Actionable Threat Intelligence Collection
Seamus Tuohy
 
Cyber intelligence for corporate security
Cyber intelligence for corporate securityCyber intelligence for corporate security
Cyber intelligence for corporate security
G3 intelligence Ltd
 
Threat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - SubmittedThreat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - Submitted
Steve Lodin
 
Effective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceEffective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat Intelligence
Dhruv Majumdar
 
The Making of a simple Cyber Threat Intelligence Gathering System
The Making of a simple Cyber Threat Intelligence Gathering SystemThe Making of a simple Cyber Threat Intelligence Gathering System
The Making of a simple Cyber Threat Intelligence Gathering System
Niran Seriki, CCISO, CISM
 
Threat Intelligence Workshop
Threat Intelligence WorkshopThreat Intelligence Workshop
Threat Intelligence Workshop
Priyanka Aash
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligence
Marlabs
 
The Cyber Threat Intelligence Matrix
The Cyber Threat Intelligence MatrixThe Cyber Threat Intelligence Matrix
The Cyber Threat Intelligence Matrix
Frode Hommedal
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligence
Prachi Mishra
 
Cyber Intelligence Vision Information Sheet 20Nov2013
Cyber Intelligence Vision Information Sheet 20Nov2013Cyber Intelligence Vision Information Sheet 20Nov2013
Cyber Intelligence Vision Information Sheet 20Nov2013
Dave Eilken
 
The Cybercriminal Underground: Understanding and categorising criminal market...
The Cybercriminal Underground: Understanding and categorising criminal market...The Cybercriminal Underground: Understanding and categorising criminal market...
The Cybercriminal Underground: Understanding and categorising criminal market...
Mark Arena
 
Cyber threat intelligence: maturity and metrics
Cyber threat intelligence: maturity and metricsCyber threat intelligence: maturity and metrics
Cyber threat intelligence: maturity and metrics
Mark Arena
 
STIX, TAXII, CISA: Impact of the Cybersecurity Information Sharing Act of 2015
STIX, TAXII, CISA: Impact of the Cybersecurity Information Sharing Act of 2015STIX, TAXII, CISA: Impact of the Cybersecurity Information Sharing Act of 2015
STIX, TAXII, CISA: Impact of the Cybersecurity Information Sharing Act of 2015
Priyanka Aash
 
Threat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep SinghThreat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep Singh
OWASP Delhi
 
Cyber Threat Intelligence: What do we Want? The Incident Response and Technol...
Cyber Threat Intelligence: What do we Want? The Incident Response and Technol...Cyber Threat Intelligence: What do we Want? The Incident Response and Technol...
Cyber Threat Intelligence: What do we Want? The Incident Response and Technol...
Albert Hui
 
Why_TG
Why_TGWhy_TG
Why_TG
TOP GUN
 
The Cybercriminal Underground: Understanding and categorising criminal market...
The Cybercriminal Underground: Understanding and categorising criminal market...The Cybercriminal Underground: Understanding and categorising criminal market...
The Cybercriminal Underground: Understanding and categorising criminal market...
Mark Arena
 
Cybersecurity: Cyber Risk Management for Lawyers and Clients
Cybersecurity: Cyber Risk Management for Lawyers and ClientsCybersecurity: Cyber Risk Management for Lawyers and Clients
Cybersecurity: Cyber Risk Management for Lawyers and Clients
Shawn Tuma
 
Rkil it,security & corporate presentation
Rkil it,security & corporate presentationRkil it,security & corporate presentation
Rkil it,security & corporate presentation
Rajendra Sheth
 
Cozen o'connor interview questions and answers
Cozen o'connor interview questions and answersCozen o'connor interview questions and answers
Cozen o'connor interview questions and answers
AlanWright789
 

Mais conteúdo relacionado

Mais procurados

Practical and Actionable Threat Intelligence Collection
Practical and Actionable Threat Intelligence CollectionPractical and Actionable Threat Intelligence Collection
Practical and Actionable Threat Intelligence Collection
Seamus Tuohy
 
Threat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - SubmittedThreat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - Submitted
Steve Lodin
 
The Cyber Threat Intelligence Matrix
The Cyber Threat Intelligence MatrixThe Cyber Threat Intelligence Matrix
The Cyber Threat Intelligence Matrix
Frode Hommedal
 
Cyber Intelligence Vision Information Sheet 20Nov2013
Cyber Intelligence Vision Information Sheet 20Nov2013Cyber Intelligence Vision Information Sheet 20Nov2013
Cyber Intelligence Vision Information Sheet 20Nov2013
Dave Eilken
 
The Cybercriminal Underground: Understanding and categorising criminal market...
The Cybercriminal Underground: Understanding and categorising criminal market...The Cybercriminal Underground: Understanding and categorising criminal market...
The Cybercriminal Underground: Understanding and categorising criminal market...
Mark Arena
 

Mais procurados (20)

Actionable Threat Intelligence
Actionable Threat IntelligenceActionable Threat Intelligence
Actionable Threat Intelligence
 
IOCs Are Dead—Long Live IOCs!
IOCs Are Dead—Long Live IOCs!IOCs Are Dead—Long Live IOCs!
IOCs Are Dead—Long Live IOCs!
 
Practical and Actionable Threat Intelligence Collection
Practical and Actionable Threat Intelligence CollectionPractical and Actionable Threat Intelligence Collection
Practical and Actionable Threat Intelligence Collection
 
Cyber intelligence for corporate security
Cyber intelligence for corporate securityCyber intelligence for corporate security
Cyber intelligence for corporate security
 
Threat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - SubmittedThreat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - Submitted
 
Effective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceEffective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat Intelligence
 
The Making of a simple Cyber Threat Intelligence Gathering System
The Making of a simple Cyber Threat Intelligence Gathering SystemThe Making of a simple Cyber Threat Intelligence Gathering System
The Making of a simple Cyber Threat Intelligence Gathering System
 
Threat Intelligence Workshop
Threat Intelligence WorkshopThreat Intelligence Workshop
Threat Intelligence Workshop
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligence
 
The Cyber Threat Intelligence Matrix
The Cyber Threat Intelligence MatrixThe Cyber Threat Intelligence Matrix
The Cyber Threat Intelligence Matrix
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligence
 
Cyber Intelligence Vision Information Sheet 20Nov2013
Cyber Intelligence Vision Information Sheet 20Nov2013Cyber Intelligence Vision Information Sheet 20Nov2013
Cyber Intelligence Vision Information Sheet 20Nov2013
 
The Cybercriminal Underground: Understanding and categorising criminal market...
The Cybercriminal Underground: Understanding and categorising criminal market...The Cybercriminal Underground: Understanding and categorising criminal market...
The Cybercriminal Underground: Understanding and categorising criminal market...
 
Cyber threat intelligence: maturity and metrics
Cyber threat intelligence: maturity and metricsCyber threat intelligence: maturity and metrics
Cyber threat intelligence: maturity and metrics
 
STIX, TAXII, CISA: Impact of the Cybersecurity Information Sharing Act of 2015
STIX, TAXII, CISA: Impact of the Cybersecurity Information Sharing Act of 2015STIX, TAXII, CISA: Impact of the Cybersecurity Information Sharing Act of 2015
STIX, TAXII, CISA: Impact of the Cybersecurity Information Sharing Act of 2015
 
Threat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep SinghThreat hunting 101 by Sandeep Singh
Threat hunting 101 by Sandeep Singh
 
Cyber Threat Intelligence: What do we Want? The Incident Response and Technol...
Cyber Threat Intelligence: What do we Want? The Incident Response and Technol...Cyber Threat Intelligence: What do we Want? The Incident Response and Technol...
Cyber Threat Intelligence: What do we Want? The Incident Response and Technol...
 
Why_TG
Why_TGWhy_TG
Why_TG
 
The Cybercriminal Underground: Understanding and categorising criminal market...
The Cybercriminal Underground: Understanding and categorising criminal market...The Cybercriminal Underground: Understanding and categorising criminal market...
The Cybercriminal Underground: Understanding and categorising criminal market...
 
Cybersecurity: Cyber Risk Management for Lawyers and Clients
Cybersecurity: Cyber Risk Management for Lawyers and ClientsCybersecurity: Cyber Risk Management for Lawyers and Clients
Cybersecurity: Cyber Risk Management for Lawyers and Clients
 

Destaque

Cozen o'connor interview questions and answers
Cozen o'connor interview questions and answersCozen o'connor interview questions and answers
Cozen o'connor interview questions and answers
AlanWright789
 
LinkedIn Infographic draft 11_1200
LinkedIn Infographic draft 11_1200LinkedIn Infographic draft 11_1200
LinkedIn Infographic draft 11_1200
AMComms
 
Konvergensi media satu_gadget_untuk_bany
Konvergensi media satu_gadget_untuk_banyKonvergensi media satu_gadget_untuk_bany
Konvergensi media satu_gadget_untuk_bany
Khaerudin Imawan
 
Student organization president and vice president training
Student organization president and vice president trainingStudent organization president and vice president training
Student organization president and vice president training
BelmontSELD
 
Pdhpe assessment 2 - weebly assessment - powerpoint slides
Pdhpe assessment 2 - weebly assessment - powerpoint slidesPdhpe assessment 2 - weebly assessment - powerpoint slides
Pdhpe assessment 2 - weebly assessment - powerpoint slides
pmalios
 

Destaque (20)

Rkil it,security & corporate presentation
Rkil it,security & corporate presentationRkil it,security & corporate presentation
Rkil it,security & corporate presentation
 
Cozen o'connor interview questions and answers
Cozen o'connor interview questions and answersCozen o'connor interview questions and answers
Cozen o'connor interview questions and answers
 
Universal Design for Learning & the iPad
Universal Design for Learning & the iPadUniversal Design for Learning & the iPad
Universal Design for Learning & the iPad
 
Untitled Presentation
Untitled PresentationUntitled Presentation
Untitled Presentation
 
Carta de Atenas
Carta de AtenasCarta de Atenas
Carta de Atenas
 
ความรู้
ความรู้ความรู้
ความรู้
 
LinkedIn Infographic draft 11_1200
LinkedIn Infographic draft 11_1200LinkedIn Infographic draft 11_1200
LinkedIn Infographic draft 11_1200
 
Governoor
GovernoorGovernoor
Governoor
 
Konvergensi media satu_gadget_untuk_bany
Konvergensi media satu_gadget_untuk_banyKonvergensi media satu_gadget_untuk_bany
Konvergensi media satu_gadget_untuk_bany
 
CLI, Inc. Contract Manager Roles and Responsibilities
CLI, Inc. Contract Manager Roles and ResponsibilitiesCLI, Inc. Contract Manager Roles and Responsibilities
CLI, Inc. Contract Manager Roles and Responsibilities
 
Student organization president and vice president training
Student organization president and vice president trainingStudent organization president and vice president training
Student organization president and vice president training
 
Lecture 7
Lecture 7Lecture 7
Lecture 7
 
Planificación
PlanificaciónPlanificación
Planificación
 
FMS Spring Appeal 2014
FMS Spring Appeal 2014FMS Spring Appeal 2014
FMS Spring Appeal 2014
 
Thrust block
Thrust blockThrust block
Thrust block
 
Presidential Service Award
Presidential Service AwardPresidential Service Award
Presidential Service Award
 
OSAC: Personal Digital Security Presentation
OSAC: Personal Digital Security PresentationOSAC: Personal Digital Security Presentation
OSAC: Personal Digital Security Presentation
 
Pdhpe assessment 2 - weebly assessment - powerpoint slides
Pdhpe assessment 2 - weebly assessment - powerpoint slidesPdhpe assessment 2 - weebly assessment - powerpoint slides
Pdhpe assessment 2 - weebly assessment - powerpoint slides
 
Asthma
AsthmaAsthma
Asthma
 
White Stone logo
White Stone logoWhite Stone logo
White Stone logo
 

Semelhante a Proactive Counterespionage & Business Continuity / Resiliency

Scot Secure 2017
Scot Secure 2017Scot Secure 2017
Scot Secure 2017
Ray Bugg
 
2016 - Cyber Security for the Public Sector
2016 - Cyber Security for the Public Sector2016 - Cyber Security for the Public Sector
2016 - Cyber Security for the Public Sector
Scott Geye
 
ISACA UAE - Importance of Human-Centric Approaches to Cyber Security
ISACA UAE - Importance of Human-Centric Approaches to Cyber SecurityISACA UAE - Importance of Human-Centric Approaches to Cyber Security
ISACA UAE - Importance of Human-Centric Approaches to Cyber Security
Dr. Lydia Kostopoulos
 
Cybersecurity Risk Management Tools and Techniques (1).pptx
Cybersecurity Risk Management Tools and Techniques (1).pptxCybersecurity Risk Management Tools and Techniques (1).pptx
Cybersecurity Risk Management Tools and Techniques (1).pptx
ClintonKelvin
 
InfraGard Webinar March 2016 033016 A
InfraGard Webinar March 2016 033016 AInfraGard Webinar March 2016 033016 A
InfraGard Webinar March 2016 033016 A
Ward Pyles
 

Semelhante a Proactive Counterespionage & Business Continuity / Resiliency (20)

Top 5 secrets to successfully jumpstarting your cyber-risk program
Top 5 secrets to successfully jumpstarting your cyber-risk programTop 5 secrets to successfully jumpstarting your cyber-risk program
Top 5 secrets to successfully jumpstarting your cyber-risk program
 
Scot Secure 2017
Scot Secure 2017Scot Secure 2017
Scot Secure 2017
 
Week 1&2 intro_ v2-upload
Week 1&2 intro_ v2-uploadWeek 1&2 intro_ v2-upload
Week 1&2 intro_ v2-upload
 
2016 - Cyber Security for the Public Sector
2016 - Cyber Security for the Public Sector2016 - Cyber Security for the Public Sector
2016 - Cyber Security for the Public Sector
 
ISACA UAE - Importance of Human-Centric Approaches to Cyber Security
ISACA UAE - Importance of Human-Centric Approaches to Cyber SecurityISACA UAE - Importance of Human-Centric Approaches to Cyber Security
ISACA UAE - Importance of Human-Centric Approaches to Cyber Security
 
Cybersecurity Risk Management Tools and Techniques (1).pptx
Cybersecurity Risk Management Tools and Techniques (1).pptxCybersecurity Risk Management Tools and Techniques (1).pptx
Cybersecurity Risk Management Tools and Techniques (1).pptx
 
InfraGard Webinar March 2016 033016 A
InfraGard Webinar March 2016 033016 AInfraGard Webinar March 2016 033016 A
InfraGard Webinar March 2016 033016 A
 
Main Menu
Main MenuMain Menu
Main Menu
 
Cobit 2
Cobit 2Cobit 2
Cobit 2
 
Opening the Door to DoD Perspectives on Cyber Threat Intelligence
Opening the Door to DoD Perspectives on Cyber Threat IntelligenceOpening the Door to DoD Perspectives on Cyber Threat Intelligence
Opening the Door to DoD Perspectives on Cyber Threat Intelligence
 
Cybersecurity Threats - NI Business Continuity Forum
Cybersecurity Threats - NI Business Continuity ForumCybersecurity Threats - NI Business Continuity Forum
Cybersecurity Threats - NI Business Continuity Forum
 
Data Science for Cyber Risk
Data Science for Cyber RiskData Science for Cyber Risk
Data Science for Cyber Risk
 
Bridging the Gap Between Threat Intelligence and Risk Management
Bridging the Gap Between Threat Intelligence and Risk ManagementBridging the Gap Between Threat Intelligence and Risk Management
Bridging the Gap Between Threat Intelligence and Risk Management
 
Bridging the Gap Between Threat Intelligence and Risk Management
Bridging the Gap Between Threat Intelligence and Risk ManagementBridging the Gap Between Threat Intelligence and Risk Management
Bridging the Gap Between Threat Intelligence and Risk Management
 
CACR Overview
CACR OverviewCACR Overview
CACR Overview
 
The Legal Case for Cyber Risk Management - InfoSec World Privacy & Risk Summit
The Legal Case for Cyber Risk Management - InfoSec World Privacy & Risk SummitThe Legal Case for Cyber Risk Management - InfoSec World Privacy & Risk Summit
The Legal Case for Cyber Risk Management - InfoSec World Privacy & Risk Summit
 
The Legal Case for Cyber Risk Management Programs and What They Should Include
The Legal Case for Cyber Risk Management Programs and What They Should IncludeThe Legal Case for Cyber Risk Management Programs and What They Should Include
The Legal Case for Cyber Risk Management Programs and What They Should Include
 
Cyber Security Awareness Month 2017-Wrap-Up
Cyber Security Awareness Month 2017-Wrap-UpCyber Security Awareness Month 2017-Wrap-Up
Cyber Security Awareness Month 2017-Wrap-Up
 
How to Steer Cyber Security with Only One KPI: The Cyber Risk Resilience
How to Steer Cyber Security with Only One KPI: The Cyber Risk ResilienceHow to Steer Cyber Security with Only One KPI: The Cyber Risk Resilience
How to Steer Cyber Security with Only One KPI: The Cyber Risk Resilience
 
40 under 40 in cybersecurity. top cyber news magazine
40 under 40 in cybersecurity. top cyber news magazine40 under 40 in cybersecurity. top cyber news magazine
40 under 40 in cybersecurity. top cyber news magazine
 

Mais de Dr. Lydia Kostopoulos

Versatility at the Tip of the Spear: Food Security and the Utility of SOF
Versatility at the Tip of the Spear: Food Security and the Utility of SOFVersatility at the Tip of the Spear: Food Security and the Utility of SOF
Versatility at the Tip of the Spear: Food Security and the Utility of SOF
Dr. Lydia Kostopoulos
 
The Longevity Dividend: What advancements in longevity science mean for indiv...
The Longevity Dividend: What advancements in longevity science mean for indiv...The Longevity Dividend: What advancements in longevity science mean for indiv...
The Longevity Dividend: What advancements in longevity science mean for indiv...
Dr. Lydia Kostopoulos
 
Micro Journaling - Intermediate Cycle Tracker
Micro Journaling - Intermediate Cycle TrackerMicro Journaling - Intermediate Cycle Tracker
Micro Journaling - Intermediate Cycle Tracker
Dr. Lydia Kostopoulos
 
Decoupling Human Characteristics from Algorithmic Capabilities
Decoupling Human Characteristics from Algorithmic CapabilitiesDecoupling Human Characteristics from Algorithmic Capabilities
Decoupling Human Characteristics from Algorithmic Capabilities
Dr. Lydia Kostopoulos
 
Strategic Foresight: Sense-making in an Era of Rapid Change
Strategic Foresight: Sense-making in an Era of Rapid ChangeStrategic Foresight: Sense-making in an Era of Rapid Change
Strategic Foresight: Sense-making in an Era of Rapid Change
Dr. Lydia Kostopoulos
 
The Mindset to Thrive in Uncertain, Turbulent & Exponential Times
The Mindset to Thrive in Uncertain, Turbulent & Exponential TimesThe Mindset to Thrive in Uncertain, Turbulent & Exponential Times
The Mindset to Thrive in Uncertain, Turbulent & Exponential Times
Dr. Lydia Kostopoulos
 
Leadx: Public-Private Partnership Exercise Handout
Leadx: Public-Private Partnership Exercise HandoutLeadx: Public-Private Partnership Exercise Handout
Leadx: Public-Private Partnership Exercise Handout
Dr. Lydia Kostopoulos
 
Due Diligence Considerations for Scientists, Commanders, and Politicians As T...
Due Diligence Considerations for Scientists, Commanders, and Politicians As T...Due Diligence Considerations for Scientists, Commanders, and Politicians As T...
Due Diligence Considerations for Scientists, Commanders, and Politicians As T...
Dr. Lydia Kostopoulos
 
Part IV: Workwear Fashion, Human Anatomy, Transparency & Technology
Part IV: Workwear Fashion, Human Anatomy, Transparency & TechnologyPart IV: Workwear Fashion, Human Anatomy, Transparency & Technology
Part IV: Workwear Fashion, Human Anatomy, Transparency & Technology
Dr. Lydia Kostopoulos
 
Part III: Workwear Fashion, Human Anatomy, Transparency & Technology
Part III: Workwear Fashion, Human Anatomy, Transparency & TechnologyPart III: Workwear Fashion, Human Anatomy, Transparency & Technology
Part III: Workwear Fashion, Human Anatomy, Transparency & Technology
Dr. Lydia Kostopoulos
 
Part II: Workwear Fashion, Human Anatomy, Transparency & Technology
Part II: Workwear Fashion, Human Anatomy, Transparency & TechnologyPart II: Workwear Fashion, Human Anatomy, Transparency & Technology
Part II: Workwear Fashion, Human Anatomy, Transparency & Technology
Dr. Lydia Kostopoulos
 
Part I: Workwear Fashion, Human Anatomy, Transparency & Technology
Part I: Workwear Fashion, Human Anatomy, Transparency & TechnologyPart I: Workwear Fashion, Human Anatomy, Transparency & Technology
Part I: Workwear Fashion, Human Anatomy, Transparency & Technology
Dr. Lydia Kostopoulos
 

Mais de Dr. Lydia Kostopoulos (20)

Versatility at the Tip of the Spear: Food Security and the Utility of SOF
Versatility at the Tip of the Spear: Food Security and the Utility of SOFVersatility at the Tip of the Spear: Food Security and the Utility of SOF
Versatility at the Tip of the Spear: Food Security and the Utility of SOF
 
The Corporate Social Responsibility of Artificial Intelligence
The Corporate Social Responsibility of Artificial IntelligenceThe Corporate Social Responsibility of Artificial Intelligence
The Corporate Social Responsibility of Artificial Intelligence
 
The Longevity Dividend: What advancements in longevity science mean for indiv...
The Longevity Dividend: What advancements in longevity science mean for indiv...The Longevity Dividend: What advancements in longevity science mean for indiv...
The Longevity Dividend: What advancements in longevity science mean for indiv...
 
Letter from the Frontline in 2050
Letter from the Frontline in 2050Letter from the Frontline in 2050
Letter from the Frontline in 2050
 
Concept: Metaverse Center for Women's Human Performance, Healthy Aging and Lo...
Concept: Metaverse Center for Women's Human Performance, Healthy Aging and Lo...Concept: Metaverse Center for Women's Human Performance, Healthy Aging and Lo...
Concept: Metaverse Center for Women's Human Performance, Healthy Aging and Lo...
 
Imagination Performance: Thinking Beyond GPT
Imagination Performance: Thinking Beyond GPT Imagination Performance: Thinking Beyond GPT
Imagination Performance: Thinking Beyond GPT
 
Decoupling Human Characteristics from Algorithmic Capabilities
Decoupling Human Characteristics from Algorithmic CapabilitiesDecoupling Human Characteristics from Algorithmic Capabilities
Decoupling Human Characteristics from Algorithmic Capabilities
 
Micro Journaling - Intermediate Cycle Tracker
Micro Journaling - Intermediate Cycle TrackerMicro Journaling - Intermediate Cycle Tracker
Micro Journaling - Intermediate Cycle Tracker
 
Decoupling Human Characteristics from Algorithmic Capabilities
Decoupling Human Characteristics from Algorithmic CapabilitiesDecoupling Human Characteristics from Algorithmic Capabilities
Decoupling Human Characteristics from Algorithmic Capabilities
 
Strategic Foresight: Sense-making in an Era of Rapid Change
Strategic Foresight: Sense-making in an Era of Rapid ChangeStrategic Foresight: Sense-making in an Era of Rapid Change
Strategic Foresight: Sense-making in an Era of Rapid Change
 
Technological Surrogacy & Predictive Powers
Technological Surrogacy & Predictive PowersTechnological Surrogacy & Predictive Powers
Technological Surrogacy & Predictive Powers
 
Humans over Hardware: Posturing SOF for the Future
Humans over Hardware: Posturing SOF for the FutureHumans over Hardware: Posturing SOF for the Future
Humans over Hardware: Posturing SOF for the Future
 
The Mindset to Thrive in Uncertain, Turbulent & Exponential Times
The Mindset to Thrive in Uncertain, Turbulent & Exponential TimesThe Mindset to Thrive in Uncertain, Turbulent & Exponential Times
The Mindset to Thrive in Uncertain, Turbulent & Exponential Times
 
Leadx: Public-Private Partnership Exercise Handout
Leadx: Public-Private Partnership Exercise HandoutLeadx: Public-Private Partnership Exercise Handout
Leadx: Public-Private Partnership Exercise Handout
 
Due Diligence Considerations for Scientists, Commanders, and Politicians As T...
Due Diligence Considerations for Scientists, Commanders, and Politicians As T...Due Diligence Considerations for Scientists, Commanders, and Politicians As T...
Due Diligence Considerations for Scientists, Commanders, and Politicians As T...
 
Part IV: Workwear Fashion, Human Anatomy, Transparency & Technology
Part IV: Workwear Fashion, Human Anatomy, Transparency & TechnologyPart IV: Workwear Fashion, Human Anatomy, Transparency & Technology
Part IV: Workwear Fashion, Human Anatomy, Transparency & Technology
 
Part III: Workwear Fashion, Human Anatomy, Transparency & Technology
Part III: Workwear Fashion, Human Anatomy, Transparency & TechnologyPart III: Workwear Fashion, Human Anatomy, Transparency & Technology
Part III: Workwear Fashion, Human Anatomy, Transparency & Technology
 
Part II: Workwear Fashion, Human Anatomy, Transparency & Technology
Part II: Workwear Fashion, Human Anatomy, Transparency & TechnologyPart II: Workwear Fashion, Human Anatomy, Transparency & Technology
Part II: Workwear Fashion, Human Anatomy, Transparency & Technology
 
Part I: Workwear Fashion, Human Anatomy, Transparency & Technology
Part I: Workwear Fashion, Human Anatomy, Transparency & TechnologyPart I: Workwear Fashion, Human Anatomy, Transparency & Technology
Part I: Workwear Fashion, Human Anatomy, Transparency & Technology
 
#ArtAboutAI - The First Pieces [Digital Exhibit]
#ArtAboutAI - The First Pieces [Digital Exhibit]#ArtAboutAI - The First Pieces [Digital Exhibit]
#ArtAboutAI - The First Pieces [Digital Exhibit]
 

Último

Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Miguel Araújo
 
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc
 
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law DevelopmentsTrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc
 
A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?
Igalia
 
Histor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slideHistor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slide
vu2urc
 

Último (20)

Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
 
Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024
 
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
 
HTML Injection Attacks: Impact and Mitigation Strategies
HTML Injection Attacks: Impact and Mitigation StrategiesHTML Injection Attacks: Impact and Mitigation Strategies
HTML Injection Attacks: Impact and Mitigation Strategies
 
Handwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsHandwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed texts
 
Data Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt RobisonData Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt Robison
 
presentation ICT roal in 21st century education
presentation ICT roal in 21st century educationpresentation ICT roal in 21st century education
presentation ICT roal in 21st century education
 
AWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of TerraformAWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of Terraform
 
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
 
Boost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfBoost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdf
 
A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)
 
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
 
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law DevelopmentsTrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
 
A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?
 
Advantages of Hiring UIUX Design Service Providers for Your Business
Advantages of Hiring UIUX Design Service Providers for Your BusinessAdvantages of Hiring UIUX Design Service Providers for Your Business
Advantages of Hiring UIUX Design Service Providers for Your Business
 
Tech Trends Report 2024 Future Today Institute.pdf
Tech Trends Report 2024 Future Today Institute.pdfTech Trends Report 2024 Future Today Institute.pdf
Tech Trends Report 2024 Future Today Institute.pdf
 
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
 
Histor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slideHistor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slide
 
Real Time Object Detection Using Open CV
Real Time Object Detection Using Open CVReal Time Object Detection Using Open CV
Real Time Object Detection Using Open CV
 
Partners Life - Insurer Innovation Award 2024
Partners Life - Insurer Innovation Award 2024Partners Life - Insurer Innovation Award 2024
Partners Life - Insurer Innovation Award 2024
 

Proactive Counterespionage & Business Continuity / Resiliency

  • 1. SESSION ID: #RSAC Lydia Kostopoulos, PhD Proactive Counterespionage as a Part of Business Continuity and Resiliency SOP-R06 Intelligence & Cybersecurity Professor / Institute of International and Civil Security (IICS) International Engagement Coordinator / Cyber Security Forum Initiative (CSFI) @LKCYBER
  • 3. #RSAC @LKCYBER (Economy) Business Innovation Espionage National Security • Economic Prosperity • National Defense • Geopolitical Interests • Socio-Cultural Values • Competitive Intellectual Property • Business Growth: Financial, Service & Product • Innovation Capacity & Capability • Reputation Management • Criminal • Industrial • Nation-State • Non-state Political Cybersecurity Scope: Focus: Human Factor
  • 4. #RSAC @LKCYBER We set up network defenses… Intrusion Detection System Defense in Depth Firewall We set up data defenses… Destruction What about human defenses? Encryption Data in Use At Rest In Motion Classification Internal Use Public Confidential Secret We set up malware defenses… Anti-Virus Spam Filter? Data Leakage Prevention Data Loss Prevention Identity & Access Management Phishing
  • 5. #RSAC @LKCYBER Why are human defenses important?  Roles in an organization that are instrumental in achieving the desired goals and fulfilling aspirations set forward in the business strategy and vision. * Business Critical Roles can also be viewed as: High Value Targets, Key People Terrain, (Single) Points of Failure, or Nodes of Compromise.  Should people in these roles be compromised it would constitute a point of failure with potentially serious to detrimental repercussions for business continuity and operations. Business Critical Roles (BCR)
  • 6. #RSAC @LKCYBER - Tangible and intangible - Internal knowledge of organization structure and operations - Trade secrets - Business intentions - Data, networks, servers, people, proprietary ideas, trade secrets, money, internal strategy and intent - Innovative ideas, insight and perspective - Intellectual capacity and capability - Motivation and aspiration Information Access Intellect What form of assets do BCR roles have? What happens when people in Business Critical Roles are Compromised? 2030 205020402020 Internal divides, issues, problems Org structure: official vs reality
  • 7. #RSAC @LKCYBER Attacks: Human Factor & Intellectual Property (IP)  91% of cyberattacks begin with spear phishing email – TrendMicro Research IP Intensive Businesses in the US • Support at least 40 million jobs • $5 trillion to US GDP  28%  $445 billion – annual cost of cybercrime and economic espionage to the world economy - 2014 CSIS & McAfee report How much does it cost the world? What’s the most common attack vector?
  • 9. #RSAC @LKCYBER "Never underestimate the impact of user behavior on a defensive strategy" Admiral Rogers Director of US Cyber Command/NSA
  • 11. #RSAC @LKCYBER Proactive Counter-Espionage Roadmap Phase 1: Identification of Business Critical Roles & Espionage Risk Proactive Counter-Espionage Phase 2: Policy Creation Phase 3: Communication Protocol Phase 4: Operationalize Whole of Enterprise Approach
  • 12. #RSAC @LKCYBER Categories of Business Interests • Define levels of espionage risk from low (1) to high (5). Collaboration with Business Strategists, Business Intelligence and Security Operations. • Risk levels should be defined as per impact to business interests, incorporate business intelligence and reflect organization’s risk appetite. Proactive Counter-Espionage Roadmap Phase 1: Identification of Business Critical Roles & Espionage Risk Identify Business Critical Roles (BCR) Levels of Espionage Risk • Map business critical roles on top of categories of business interests. Use business strategy as guidance. • Identify people who represent business continuity points of failure in these goals should they be compromised. • Determine areas that are business critical to identified business continuity goals. Reflective of Business strategy, interests, goals, aspirations and continuity plan. • Define BCR roles within categories and risk levels specifically as they pertain to the respective business. • Definitions should clearly indicate criticality of role responsibilities and the value the people in these roles bring to achieving desired business goals, as well as the risk for business continuity should they be compromised. • Prepare tailored risk profiles of business critical roles to be delivered for situational awareness, policy creation and need based use by: - Business Strategists - Human Resources - Business Intelligence - Security Operations - Information Security Enterprise Risk Risk Profile
  • 13. #RSAC @LKCYBER Proactive Counter-Espionage Roadmap Phase 2: Policy Creation Human Resources Information Security Policy Creation Business Intelligence Inter-Departmental Collaborative Effort • Establish BCR related policies to preserve, protect and maintain operational security (OPSEC) • Establish policies for reverse open source intelligence (OSI) hunting and information sanitization • Create policy for identity and access management • SIEM policies for life-cycle of employee and role type • Establish defined ‘need to know’ events relating to employee • Internal classification of high espionage risk roles/responsibilities • Establish hiring policies for different roles and risk levels
  • 14. #RSAC @LKCYBER Hardening Human Assets (HHA)  Be proactive not reactive  Cross departmental teamwork Security Culture People: High Espionage Risk  OPSEC Awareness  Social Engineering Awareness  Specialized SIEM Settings (Cross-departmental collaboration)  Espionage Threat Awareness  Data Protection Awareness  Social Media Use Awareness  Travel Security Awareness Proactive Counter-Espionage Roadmap Phase 2: Policy Creation - Awareness Human Assets Whole of Enterprise Approach Hardening of Human Assets (HHA) – The process of elevating security awarenessof a human asset in efforts to reduce and eliminate as many risks as possible.
  • 16. #RSAC @LKCYBER Proactive Counter-Espionage Roadmap Phase 4: Operationalize TimelinePrioritize DelegateMethodPhase 4 • Determine the best method for implementing the roadmap. • Identify chain of command for operationalizing the roadmap with key stakeholders. • Assess impact of unique organizational culture, operations and resources of the organization in question. • Detail a list of tasks to be done. • Prioritize identified tasks into essential tasks, primary and secondary tasks. • Prioritization decided by those at the top of the chain of command for operationalizing the roadmap. • Agree on a suitable timeline for operationalizing the roadmap. • Delegate people who will be responsible for task completion and oversight. Monitoring Reporting KPI
  • 17. #RSAC @LKCYBER “The only thing constant in life is change.” - Ancient Philosopher Heraclitus Be agile and adapt to constantly changing circumstances!
  • 18. #RSAC @LKCYBER Our adversaries are relentless in acquiring our data, we should be relentless in protecting it. @LKCYBER
  • 20. #RSAC @LKCYBERImage reference for images used in this presentation 20 http://apworldhistory2012-2013.weebly.com/uploads/9/9/9/6/9996001/8757598.jpg?696 http://www.firstpointit.com/wp-content/uploads/2014/03/business-icon1.png http://www.iftr.in/attachments/Image/rd1.jpg?1430157298948 https://www.sanjuancollege.edu/Images/HR/people.jpg http://d1du5om4ehlar1.cloudfront.net/wp-content/uploads/2015/02/product.png?529770 http://www.mobot.net/writer/wordpress/wp-content/uploads/2012/08/light-bulb.jpg http://www.strategy4seo.com/wp-content/uploads/2012/11/unique-content.jpg http://www.medical-billing.com/img/revenue-cycle-management.jpg http://bloximages.chicago2.vip.townnews.com/alligator.org/content/tncms/assets/v3/editorial/9/84/98428ba2- d08d-11e2-a775-0019bb2963f4/51b3b501c96e7.image.jpg https://www.ase.org/sites/ase.org/files/styles/featured_blog/public/broken_link.jpg?itok=uNpj5vWL http://prajwaldesai.com/wp-content/uploads/2013/11/firewall_man.png http://www.cloneguard.com/images/firewall-network.png http://www.teach-ict.com/images/stk/network_firewall.jpg http://www.liquidtechnology.net/img/layout/icon-data-destruction.png https://plannetplc.files.wordpress.com/2010/12/tech_55.jpg https://portal.utpa.edu/portal/page/portal/utpa_main/daa_home/hshs_home/pasp_home/imagesfiles/email.png http://svmtinc.us/wp-content/uploads/2013/11/Document-Management.png http://beandesoftware.com/img/DB-DEV-3.png http://true-hire.com/wp-content/themes/truehire/images/credentials_icon.jpg https://www.isheriff.com/img/icon_analysis_db_250.png http://www.iconshock.com/img_jpg/BETA/networking/jpg/256/spam_icon.jpg http://niiconsulting.com/checkmate/wp-content/uploads/2013/01/DLP.png http://www.immunitynetworks.com/images/identity-protection-and-management.jpg http://noticias.automoveis-online.com/wp-content/uploads/2012/07/Sabe-o-que-%C3%A9-Phishing.jpg https://cdn0.iconfinder.com/data/icons/financial-3/500/Financial_phishing-512.png http://www.defense.gov/News-Article-View/Article/616569/rogers-outlines-cyber- challenges-facing-dod-us https://manunicareersblog.files.wordpress.com/2015/04/istock_000013296501small- network-of-people.jpg http://knowledgecafe.care2share.wikispaces.net/file/view/sna2.jpg/30810569/sna2.jpg https://www.manageengine.com/network-monitoring/images/network-mapping.jpg https://www.deksoftware.com/dna/images/window.png http://www.2020spaces.com/wp- content/uploads/2014/05/Depositphotos_2077697_original3.jpg http://www.slidehunter.com http://weinspirefutures.com/wp-content/uploads/vacay.png https://c1.staticflickr.com/3/2385/2073251155_0451f31674.jpg http://precisemgmt.net/wp-content/uploads/2015/07/24x7-monitoring1.jpg http://www.paydiddy.com/gallery/cisco-cdr-reporting-software-is-the-provider- important-pic/Cisco-CDR-reporting-software-is-the-provider-important.jpg http://jerryching.no-ip.org/Software/Photo/Icon/Windows%207%20Blue%20Icons%20& %20Cursors/PNG/Folders/Documents.png http://www.getcybersafe.gc.ca/cnt/rsrcs/nfgrphcs/nfgrphcs-2012-10-11-en.aspx