Ég fann glærur frá fyrirlestri sem ég hélt fyrir OWASP á Íslandi í apríl 2014 og ákvað að skella þeim hérna á slideshare. Glærurnar er einnig hægt að nálgast af vefsíðu OWASP: https://www.owasp.org/images/6/64/OWASP_april_2014.pdf

1. Hvert er
þroskastig
netöryggismála á
Íslandi?
OWASP Iceland – apríl 2014
Svavar Ingi Hermannsson
KPMG, Ráðgjafarsvið

2. © 2014 KPMG International Cooperative (“KPMG International”), a Swiss entity. Member firms of the KPMG network of independent firms are affiliated with KPMG International. KPMG International
provides no client services. No member firm has any authority to obligate or bind KPMG International or any other member firm third parties, nor does KPMG International have any such authority to
obligate or bind any member firm. All rights reserved.
1
Dagskrá
Kynning
Tilgangur
Heildarmynd
– Almennar forsendur
Netið skoðað
– Aðferðir
– Niðurstöður
Varnarþættir
– Eftirlitsþættir
Yfirlit

3. © 2014 KPMG International Cooperative (“KPMG International”), a Swiss entity. Member firms of the KPMG network of independent firms are affiliated with KPMG International. KPMG International
provides no client services. No member firm has any authority to obligate or bind KPMG International or any other member firm third parties, nor does KPMG International have any such authority to
obligate or bind any member firm. All rights reserved.
2
Hver er ég?
Svavar Ingi Hermannsson hefur sérhæft sig í
tölvuöryggi síðustu 15 ár og hefur gengt ýmsum störfum
tengt forritun og ráðgjöf í tölvuöryggi (innbrotsprófanir,
veikleikagreiningar, kóðarýni, stjórnun
upplýsingaöryggis (þar á meðal ISO/IEC 27001 og PCI
DSS)).
Svavar hefur kennt við Háskóla Íslands og Háskólann í
Reykjavik, auk þess að hafa haldið námskeið fyrir
viðskiptavini KPMG.
Svavar var formaður faghóps um öryggismál hjá
Skýrslutæknifélaginu frá 2007 til 2012.
Svavar er með ýmsar gráður, meðal annars: CISSP,
CISA, CISM.
Kynning

4. © 2014 KPMG International Cooperative (“KPMG International”), a Swiss entity. Member firms of the KPMG network of independent firms are affiliated with KPMG International. KPMG International
provides no client services. No member firm has any authority to obligate or bind KPMG International or any other member firm third parties, nor does KPMG International have any such authority to
obligate or bind any member firm. All rights reserved.
3
Tilgangur rannsóknarinnar?
KPMG hafði áhuga á að vita þroskastig upplýsinga og netöryggismála á íslandi.
Spurning; Hvernig er netöryggi á Íslandi háttað?
Við fundum engar rannsóknir sem gáfu heildaryfirlit yfir núverandi stöðu mála.
Takmarkað af upplýsingum til staðar.
Margar spurningar, fá svör

5. Púslum raðað saman

6. © 2014 KPMG International Cooperative (“KPMG International”), a Swiss entity. Member firms of the KPMG network of independent firms are affiliated with KPMG International. KPMG International
provides no client services. No member firm has any authority to obligate or bind KPMG International or any other member firm third parties, nor does KPMG International have any such authority to
obligate or bind any member firm. All rights reserved.
5
Rannsókn – Almennar forsendur – Menntun / Vitund
Ýmsir þættir sem hafa áhrif á netöryggi: Menntun / Vitund
Þáttaka
stjórnenda /
Fjárhagslegir
þættir
Símenntun /
Upplýsinga-
öryggisvottanir
Mennta kerfið
Netöryggi
Á háskóla stigi:
-Ef boðið hefur verið upp á kúrsa í tölvuöryggi þá hafa
þeir verið valkúrsar.
-Margir tölvuöryggiskúrsar í gegnum tíðina hafa lagt
áherslu á dulkóðun.
Hvernig styður núverandi menntakerfi við
Vitundarvakningu í upplýsingaöryggi?
Á grunnskóla / gagnfræðiskólastigi?
- Það eru tækifæri til að byrja þar
- Öryggisvitund snemma

7. © 2014 KPMG International Cooperative (“KPMG International”), a Swiss entity. Member firms of the KPMG network of independent firms are affiliated with KPMG International. KPMG International
provides no client services. No member firm has any authority to obligate or bind KPMG International or any other member firm third parties, nor does KPMG International have any such authority to
obligate or bind any member firm. All rights reserved.
6
Rannsókn – Almennar forsendur – Upplýsingaöryggisgráður
Ýmsir þættir sem hafa áhrif á netöryggi: Upplýsingaöryggisgráður
Þáttaka
stjórnenda /
Fjárhagslegir
þættir
Menntakerfið
Netöryggi
What security certifications is the industry using?
15
CEH
16
CISA
6
CISSP
4
CISM
Source: (https://www.isaca.org/)
Source: (https://www.eccouncil.org)
Source: (https://www.isc2.org)
Símenntun /
Upplýsinga-
öryggisvottanir

8. © 2014 KPMG International Cooperative (“KPMG International”), a Swiss entity. Member firms of the KPMG network of independent firms are affiliated with KPMG International. KPMG International
provides no client services. No member firm has any authority to obligate or bind KPMG International or any other member firm third parties, nor does KPMG International have any such authority to
obligate or bind any member firm. All rights reserved.
7
Rannsókn – Almennar forsendur – Aðgengilegar upplýsingar
Fjöldi ISO/IEC 27001 vottaðra fyrirtækja á Íslandi
Fjöldi tilkynntra afskræmdra vefsíðna á íslenskum lénum fyrir
árið 2013, dagsetning 10.09.2013 (zone-h.org)
#fjöldi skráðra .is léna 45.201
# tilkynntar afskræmingar 823
Það er tilhneiging að gera lítið úr afhausunum vefsíðna
Það sem þau halda að það sé!
Það sem við vitum að það er!
20

9. Netið skoðað

10. © 2014 KPMG International Cooperative (“KPMG International”), a Swiss entity. Member firms of the KPMG network of independent firms are affiliated with KPMG International. KPMG International
provides no client services. No member firm has any authority to obligate or bind KPMG International or any other member firm third parties, nor does KPMG International have any such authority to
obligate or bind any member firm. All rights reserved.
9
Netið skoðað – Allir vinir í skóginum
Við vildum prófa allt… hinsvegar
Við framkvæmdum ekki
veikleikagreiningu á netunum
sem við skönnuðum.
Áhættan var talin of mikil!

11. © 2014 KPMG International Cooperative (“KPMG International”), a Swiss entity. Member firms of the KPMG network of independent firms are affiliated with KPMG International. KPMG International
provides no client services. No member firm has any authority to obligate or bind KPMG International or any other member firm third parties, nor does KPMG International have any such authority to
obligate or bind any member firm. All rights reserved.
10
Hvað var skoðað?
?
Ísland (port skönnun)
Netupplýsingar
aðgengilegar almenningi
(570 aðilar)
IPv4
Opin port
Keyrandi þjónustur
Vefmiðlarar
WCMS
DNS
Tveir stærstu þættir rannsóknarinnar

12. © 2014 KPMG International Cooperative (“KPMG International”), a Swiss entity. Member firms of the KPMG network of independent firms are affiliated with KPMG International. KPMG International
provides no client services. No member firm has any authority to obligate or bind KPMG International or any other member firm third parties, nor does KPMG International have any such authority to
obligate or bind any member firm. All rights reserved.
11
Aðferðir?
? ?
Allar IPv4 úthlutaðar til Íslands skannaðar, 770.000 IP tölur í heildina
Reykjavik Internet Exchange – RIX
This is a list of Autonomous System Numbers that are, to
the best of our knowledge, registered to Icelandic entities
and are in use in Iceland. From the networks originated
by these AS numbers we derive a list of IP networks in
use in Iceland.
Please note that this is not a geo-location service, as
there are always networks in use in Iceland that are
originated by external AS numbers or by AS numbers
registered to foreign or international service providers.
Some networks, registered to Icelandic entities, are in
use abroad, partially or totally. When we refer to Icelandic
AS-numbers or networks, please bear this in mind.
Rannsóknin spannaði júní – ágúst 2013.
Notast við
•ADSL tengingu
•Port skanna
•Sérsniðin skönnunar og greiningar tól
•Landið skannað: 100 port
Source: (http://www.rix.is/english/is-as-nets-en.html)

13. © 2014 KPMG International Cooperative (“KPMG International”), a Swiss entity. Member firms of the KPMG network of independent firms are affiliated with KPMG International. KPMG International
provides no client services. No member firm has any authority to obligate or bind KPMG International or any other member firm third parties, nor does KPMG International have any such authority to
obligate or bind any member firm. All rights reserved.
12
Rannsókn – Skönnun á IP tölum Íslands
Skönnun á öllum IPv4 sem tilheyra Íslandi, Í heildina 770.000 IP tölur
Open ports
37.970
Http
13.924
Https
1949
Telnet
9670
POP3
1383
FTP
6021 2026
CISCO
CISCO
Telnet
755
Honey pots = 2

14. Lénin skoðuð

15. © 2014 KPMG International Cooperative (“KPMG International”), a Swiss entity. Member firms of the KPMG network of independent firms are affiliated with KPMG International. KPMG International
provides no client services. No member firm has any authority to obligate or bind KPMG International or any other member firm third parties, nor does KPMG International have any such authority to
obligate or bind any member firm. All rights reserved.
14
Rannsókn – Lénin
Uppbygging rannsóknarinnar og umfang fyrir íslensku lénin.
300 stærstu
Stærstu 300 fyrirtækin
byggt á veltu fyrir árið
2012
Í heildina var notast við 570
lén í rannsókninni
Sérvaldir
aðilar
Ýmsir aðilar úr fjármála
og opinbera
atvinnugeiranum
Á þessari kynningu munum
við einbeita okkur að
heildinni auk þess sem
eftirfarandi þrjár
atvinnugreinar eru skoðaðar:
Public – Financial -
Healthcare
Atvinnu-
greinar
Flokkað í 37
atvinnugreinar

16. © 2014 KPMG International Cooperative (“KPMG International”), a Swiss entity. Member firms of the KPMG network of independent firms are affiliated with KPMG International. KPMG International
provides no client services. No member firm has any authority to obligate or bind KPMG International or any other member firm third parties, nor does KPMG International have any such authority to
obligate or bind any member firm. All rights reserved.
15
Niðurstöður – Vefmiðlarar
• Rannsóknin skoðaði vefmiðlarana sem
hýstu 570 lénin
• Áhætta er skilgreind sem mikil eða lítil
34,5% 36%
Low Risk High Risk
Heildar niðurstöður
29,5%
Information not available
22%
41%
38%
33%
35%
41%
25%
33%
36%
41%
30%
36%
35%
37%
58%
47%
42%
17%
33%
30%
29%
22%
17%
20%
0% 20% 40% 60% 80% 100%
Opinberir Aðilar
Almennur Iðnaður
Fjármálafyrirtæki
Matvælaiðnaður
Ýmis Þjónusta
Heildverslun
Fiskvinnsla og Útgerð
Heilsugæsla
Atvinnugeiri
Webserver niðurstöður eftir atvinnugeirum
Low Risk High Risk Not known

17. © 2014 KPMG International Cooperative (“KPMG International”), a Swiss entity. Member firms of the KPMG network of independent firms are affiliated with KPMG International. KPMG International
provides no client services. No member firm has any authority to obligate or bind KPMG International or any other member firm third parties, nor does KPMG International have any such authority to
obligate or bind any member firm. All rights reserved.
16
Niðurstöður – Web Content Management Systems (WCMS)
• Rannsóknin skoðaði WCMS í notkun
hjá 570 lénunum.
• Áhætta er skilgreind sem mikil eða
lág.
8% 12%
Low Risk High Risk
80%
Information not available
Heildar niðurstöður
2%
12%
8%
6%
6%
15%
4%
7%
5%
15%
18%
3%
10%
15%
33%
7%
93%
73%
75%
91%
84%
70%
63%
87%
0% 20% 40% 60% 80% 100%
Opinberir Aðilar
Almennur Iðnaður
Fjármálafyrirtæki
Matvælaiðnaður
Ýmis Þjónusta
Heildverslun
Fiskvinnsla og Útgerð
Heilsugæsla
Atvinnugeiri
WebCMS niðurstöður eftir atvinnugeirum
Low Risk High Risk Not known

18. © 2014 KPMG International Cooperative (“KPMG International”), a Swiss entity. Member firms of the KPMG network of independent firms are affiliated with KPMG International. KPMG International
provides no client services. No member firm has any authority to obligate or bind KPMG International or any other member firm third parties, nor does KPMG International have any such authority to
obligate or bind any member firm. All rights reserved.
17
Niðurstöður – Web Content Management Systems (WCMS) - framhald
• Hversu mörg óþekkt WCMS voru
Íslensk af þessum 570?
Íslensk WCMS: 40,7%
WCMS - A
WCMS - B
WCMS - C
Dreifing
15,9 %
11 %
11 %
Dreifing WCMS
68%
27%
58%
21%
19%
22%
21%
53%
0% 20% 40% 60% 80%
Opinberir Aðilar
Almennur Iðnaður
Fjármálafyrirtæki
Matvælaiðnaður
Ýmis Þjónusta
Heildverslun
Fiskvinnsla og Útgerð
Heilsugæsla
Hlutfall
Atvinnugeiri
Hlutfall íslenskra vefja eftir atvinnugeirum

19. © 2014 KPMG International Cooperative (“KPMG International”), a Swiss entity. Member firms of the KPMG network of independent firms are affiliated with KPMG International. KPMG International
provides no client services. No member firm has any authority to obligate or bind KPMG International or any other member firm third parties, nor does KPMG International have any such authority to
obligate or bind any member firm. All rights reserved.
18
Niðurstöður – DNS
• Hvernig er dreifingin á DNS skráningu?
• Fjöldi DNS miðlara fyrir 570 lénin: 309
SP A
SP B
SP C
Dreifing léna
16,9 %
11,5 %
9 %
Stærstu DNS miðlararnir
Bind
Microsoft
Unknown /
hidden
Hlutdeild
32 %
5,2 %
61,5 %
DNS útgáfur
Bind sem lekur upplýsingum um stýrikerfi: 46

20. © 2014 KPMG International Cooperative (“KPMG International”), a Swiss entity. Member firms of the KPMG network of independent firms are affiliated with KPMG International. KPMG International
provides no client services. No member firm has any authority to obligate or bind KPMG International or any other member firm third parties, nor does KPMG International have any such authority to
obligate or bind any member firm. All rights reserved.
19
Niðurstöður – TLS/SSL
• Hversu margar einstakar IP tölur voru fyrir 570 lénin? 342 IP tölur
• Hversu margar af þessum 342 IP tölum bjóða upp á TLS/SSL? 188 (55%)
Weak Cipher
SSLv2
MD5
Veikleikar sem fundust
96,3 %
39,4 %
4,8 %
Veikleikar skoðaðir:
Self signed
Expired
Veikleikar sem fundust
16,5 %
15,4 %
Aðrir þættir:

21. © 2014 KPMG International Cooperative (“KPMG International”), a Swiss entity. Member firms of the KPMG network of independent firms are affiliated with KPMG International. KPMG International
provides no client services. No member firm has any authority to obligate or bind KPMG International or any other member firm third parties, nor does KPMG International have any such authority to
obligate or bind any member firm. All rights reserved.
20
Niðurstöður – FTP
• Hversu margar af 342 IP tölunum bjóða upp á FTP? 152
• Hversu margar af þessum 152 auglýsa TLS/SSL stuðning? 21 (13,8%)
Microsoft
Vsftpd
Proftpd
Hlutdeild
26,3 %
17,1 %
14,5 %
Dreifing milli tegunda

22. © 2014 KPMG International Cooperative (“KPMG International”), a Swiss entity. Member firms of the KPMG network of independent firms are affiliated with KPMG International. KPMG International
provides no client services. No member firm has any authority to obligate or bind KPMG International or any other member firm third parties, nor does KPMG International have any such authority to
obligate or bind any member firm. All rights reserved.
21
Niðurstöður – Dreifing á IP tölur
• Hvernig er dreifingunni háttað fyrir þessar 342 IP tölur með tilliti til 570 l?
• Hversu stór hluti léna er á umfangsmestu IP tölurnar?
34
umfangsmestu
IP tölur
Aðrar IP tölur
Teknar eru fyrir 34 stærstu af 342
38 %
62 %
Dreifing léna á IP tölur
5
5
5
5
5
5
6
6
6
7
8
8
10
11
12
14
16
32
0 10 20 30 40
rrr.rrr.rrr
qqq.qqq.qqq
ppp.ppp.ppp
ooo.ooo.ooo
nnn.nnn.nnn
mmm.mmm.mmm
lll.lll.lll
kkk.kkk.kkk
jjj.jjj.jjj
iii.iii.iii
hhh.hhh.hhh
ggg.ggg.ggg
fff.fff.fff
eee.eee.eee
ddd.ddd.ddd
ccc.ccc.ccc
bbb.bbb.bbb
aaa.aaa.aaa
Lén
IPtölur
Fjöldi síðna á hverja IP tölu

23. © 2014 KPMG International Cooperative (“KPMG International”), a Swiss entity. Member firms of the KPMG network of independent firms are affiliated with KPMG International. KPMG International
provides no client services. No member firm has any authority to obligate or bind KPMG International or any other member firm third parties, nor does KPMG International have any such authority to
obligate or bind any member firm. All rights reserved.
22
Niðurstöður – Dreifing milli þjónustuaðila
• Hvernig var dreifingin milli þjónustuaðila fyrir þessi 570 lén?
SP A
SP B
SP C
Hlutdeild
7,3 %
5,3 %
4,9 %
Dreifing Þjónustuaðila
Þj. 1
9%
Þj 2
9%
Þj. 3
8%
Þj. 4
7%
Þj. 5
7%
Þj. 6
6%Þj. 7
5%
Þj. 8
6%
Þj. 9
6%
Aðrir
37%
Dreifing á lénum milli þjónustuaðila
Dreifing þar sem Þjónustuaðilar eru þekktir:

24. © 2014 KPMG International Cooperative (“KPMG International”), a Swiss entity. Member firms of the KPMG network of independent firms are affiliated with KPMG International. KPMG International
provides no client services. No member firm has any authority to obligate or bind KPMG International or any other member firm third parties, nor does KPMG International have any such authority to
obligate or bind any member firm. All rights reserved.
23
Niðurstöður – Umfang og frávik nafnamiðlara
• Hverjir eru stærstu nafnamiðlararnir?
• Hversu mikið frávik eru á milli stærstu og minnstu nafnamiðlara hjá hverjum
þjónustuaðila?
7
7
7
8
10
10
10
10
12
13
15
16
24
24
26
40
52
66
97
0 20 40 60 80 100 120
Nafnamiðlari 19
Nafnamiðlari 18
Nafnamiðlari 17
Nafnamiðlari 16
Nafnamiðlari 15
Nafnamiðlari 14
Nafnamiðlari 13
Nafnamiðlari 12
Nafnamiðlari 11
Nafnamiðlari 10
Nafnamiðlari 9
Nafnamiðlari 8
Nafnamiðlari 7
Nafnamiðlari 6
Nafnamiðlari 5
Nafnamiðlari 4
Nafnamiðlari 3
Nafnamiðlari 2
Nafnamiðlari 1
Lén
Þjónustuaðili
Umfang nafnamiðlara hjá þjónustuaðila
0%
0%
0%
0%
0%
0%
0%
0%
0%
6%
10%
14%
20%
42%
46%
50%
50%
71%
88%
0% 20% 40% 60% 80% 100%
Nafnamiðlari 19
Nafnamiðlari 15
Nafnamiðlari 14
Nafnamiðlari 11
Nafnamiðlari 10
Nafnamiðlari 9
Nafnamiðlari 7
Nafnamiðlari 5
Nafnamiðlari 2
Nafnamiðlari 1
Nafnamiðlari 13
Nafnamiðlari 18
Nafnamiðlari 12
Nafnamiðlari 6
Nafnamiðlari 3
Nafnamiðlari 16
Nafnamiðlari 4
Nafnamiðlari 17
Nafnamiðlari 8
Frávik (munur á stærsta og lægsta nafnamiðlara)
Þjónustuaðili
Frávik á nafnamiðlurum þjónustuaðila

25. © 2014 KPMG International Cooperative (“KPMG International”), a Swiss entity. Member firms of the KPMG network of independent firms are affiliated with KPMG International. KPMG International
provides no client services. No member firm has any authority to obligate or bind KPMG International or any other member firm third parties, nor does KPMG International have any such authority to
obligate or bind any member firm. All rights reserved.
24
Varnarþættir

26. © 2014 KPMG International Cooperative (“KPMG International”), a Swiss entity. Member firms of the KPMG network of independent firms are affiliated with KPMG International. KPMG International
provides no client services. No member firm has any authority to obligate or bind KPMG International or any other member firm third parties, nor does KPMG International have any such authority to
obligate or bind any member firm. All rights reserved.
25
Hvaða fyrirbyggjandi stýringar og eftirlitsþættir eru í boði?
Australian Government – Department of Defense
“At least 85% of the targeted cyber intrusions that Defense Signals Directorate
(DSD) responds to in 2011 could be prevented by following the Top 4 mitigation
strategies listed in our Strategies to Mitigate Targeted Cyber Intrusions”
Helstu 35 eftirlitsþættirnir og stýringarnar
http://www.dsd.gov.au/infosec/top35mitigationstrategies.htm

27. © 2014 KPMG International Cooperative (“KPMG International”), a Swiss entity. Member firms of the KPMG network of independent firms are affiliated with KPMG International. KPMG International
provides no client services. No member firm has any authority to obligate or bind KPMG International or any other member firm third parties, nor does KPMG International have any such authority to
obligate or bind any member firm. All rights reserved.
26
Helstu 35 eftirlitsþættirnir og stýringarnar
http://www.dsd.gov.au/infosec/top35mitigationstrategies.htm

28. Stóra spurningin / Yfirlit
Hvert er þroskastig netöryggismála á Íslandi?

29. © 2014 KPMG International Cooperative (“KPMG International”), a Swiss entity. Member firms
of the KPMG network of independent firms are affiliated with KPMG International. KPMG
International provides no client services.
The KPMG name, logo and “cutting through complexity” are registered trademarks or trademarks of
KPMG International.
The information contained herein is of a general nature and is not intended to address the
circumstances of any particular individual or entity. Although we Endeavour to provide accurate and
timely information, there can be no guarantee that such information is accurate as of the date it is
received or that it will continue to be accurate in the future. No one should act on such information
without appropriate professional advice after a thorough examination of the particular situation.
kpmg.com/socialmedia
Spurningar?
shermannsson@kpmg.is