Slide 1: Practical SME Security on a Shoestring
Practical SME Security on a Shoestring By Matt Summers
Slide 2: Agenda
Agenda • Who am I? • What is security? • Why all SMEs need to care …. but without fear • The Hype Curve • How incidents happen • Security on a shoestring
Slide 3: Matt Summers
Matt Summers • Penetration tester and security researcher • Doing something in security for 19 years • Work for small businesses, large enterprises, vendors AND consultancies
Slide 4: Some background
nccgroup~ Some background Ec
Slide 5: What is security?
What is security? “Security is a degree of resistance to, or protection from a threat.” Security provides: "a form of protection where a separation is created between the assets and the threat."
Slide 6: Key facets of successful security
Key facets of successful security • Processes and procedures • What is expected within the business • People • Who are trained • Who have a sense of risk ownership • Who don’t feel afraid to report • Technology • Helps people • Technology on its own can’t solve cyber security
Slide 7: The threat is real
nccgroup~ freedom from doubt The threat is real GCHQ warns private sector bosses of | MI5 boss: Cyber spies, web-enabled crooks unprecedented cyber-attack threat threaten UK economy Ministers and intelligence agencies say businesses are failing ta Security Service head warns of organised hacker peri
Slide 8: Who are Their Targets and Why?
Who are Their Targets and Why? • Casual • Target: Anything • Criminals / Employees • Target: SME On-Line Banking • Target: Extortion (e.g. CryptoLocker) • State Sponsored • Very targeted attack • Target: IP • Target: System (disruption)
Slide 9: Anti-Virus Alone is Not Enough
Anti-Virus Alone is Not Enough
Slide 10: The "Hype Cycle"
The “Hype Cycle” ANISIBILITY Peak of Inflated Expectations Plateau of Productivity Slope of Enlightenment Trough of Disillusionment Technology Trigger TIME nccgroup~ freedom from doubt II =
Slide 11: The "Hype Cycle"
The “Hype Cycle” • Anti-Virus • Firewalls • Whole Disk Encryption • Data Leakage Prevention • Web Application Firewalls • SIEM • etc.
Slide 12: How incidents happen: Staff
How incidents happen: Staff • Don’t have the training • Don’t know what to do if they suspect something • Fear punitive responses to mistakes • Thinks the technology makes risk someone else's problem
Slide 13: How incidents happen: No Controls
How incidents happen: No Controls • Outdated technology • No Anti-Virus • Flat computer networks • Shared passwords • Weak passwords • Unencrypted laptops and USB sticks
Slide 14: How incidents happen: Control Failures
How incidents happen: Control Failures • Outdated Anti-Virus • Unpatched systems • Weak WI-FI network security • Sharing passwords to help • Misuse of work systems • Lost devices • Theft
Slide 15: Security for SMEs on a Shoe String
Security for SMEs on a Shoe String
Slide 16: Security on a shoestring
Security on a shoestring Is it possible to do security on a shoestring? Yes! How?
Slide 17: Controls
Controls “Security controls are safeguards or countermeasures to avoid, counteract or minimize security risks relating to personal property, or any company property.”
Slide 18: Controls
Controls Preventative • Attempt to stop an event from occurring Detective • Identify and alert when the event occurs Corrective • Remediate after the event has occurred
Slide 19: Controls
Controls Physical • Fences, locks Procedural • Policies, standards and processes Technical • Firewalls, anti-virus, encryption Legal and Regulatory • Jurisdictional law, PCI-DSS
Slide 20: Controls
Controls • Cyber Streetwise www.cyberstreetwise.com • CPNI Top 20 Controls based on SANS www.cpni.gov.uk/advice/cyber/Critical- controls/
Slide 21: Top Controls
Top 20 Controls Critical control 1 - Inventory of authorised and unauthorised devices Critical control 2 - Inventory of authorised and unauthorised software Critical control 3 - Secure configurations for hardware and software Critical control 4 - Continuous vulnerability assessment and remediation C
Slide 22: If you do 7 things...
If you do 7 things… • Explain that staff are the first line of defence • Teach staff about phishing • Use strong passphrases • Get rid of Windows XP, Office 2000, Internet Explorer 6 • Update software (Adobe, Java, IE) • Use up-to-date anti-virus • Test your recovery processes
Slide 23: Longer term strategies..
Longer term strategies.. •Perform risk assessments •Implement a level of the 20 CSC •Harden devices •Segregate your network •Limit and control administrative privileges •Limit and control network services •Encrypt your USB sticks / laptops •Create an IR plan
Slide 24: Always remember
Always remember •Don’t buy product vendor hype •Cyber security is not about products •Cyber security doesn’t have to be costly •An incident will happen so have a plan
Slide 25: Further Reading and Resources
Further Reading and Resources • www.nccgroup.com • www.cpni.gov.uk • www.cyberstreetwise.com • www.sans.org • www.cissecurity.org • www.owasp.org
Slide 26: Questions?
Fin nccgroup~ Questions? ec
Slide 27: NCC Group office locations
Europe North America Australia Manchester - Head Office Atlanta Sydney Cheltenham Chicago Edinburgh New York Leatherhead San Francisco London Seattle Munich Austin Amsterdam Zurich