Security Risk Management Marcus Murray CISSP MVP Security

Agenda § What is Risk Management? § Security Strategy § § Mission and Vision

What is Risk Management? § The process of measuring assets and calculating risk! §

Marcus Murray, MVP marcus. murray@truesec. se

Risk Based Security Strategy Corporate Security Mission and Vision Security Operating Principles Risk Based

Mission and Vision Information Security Mission Operating Principles Risk Based Decision Model Tactical Prioritization

Mission and Vision Information Security Vision Operating Principles Risk Based Decision Model Tactical Prioritization

Mission and Vision Security Operating Principles Risk Based Decision Model Tactical Prioritization § Management

Mission and Vision Enterprise Risk Model Operating Principles Risk Based Decision Model Tactical Prioritization

Mission and Vision Components of Risk Assessment Asset Threat Vulnerability Mitigation What are you

Mission and Vision Risk Management Process and Roles Operating Principles Risk Based Decision Model

Mission and Vision Tactical Prioritization by Environment Operating Principles Risk Based Decision Model Tactical

Mission and Vision Risk Analysis by Asset Class Operating Principles Risk Based Decision Model

Representative Risks and Tactics Enterprise Risks Tactical Solutions Unpatched Devices Secure Environment Remediation Unmanaged

Security Solutions and Initiatives Mitigate risk to the infrastructure through implementation of key strategies

More information § § www. microsoft. se/technet www. microsoft. se/security www. truesec. se/events www.

Marcus Murray marcus. murray@truesec. se Marcus Murray, MVP marcus. murray@truesec. se

Slides: 25

Download presentation

Security Risk Management Marcus Murray, CISSP, MVP (Security) Senior Security Advisor, Truesec marcus. murray@truesec. se

Agenda § What is Risk Management? § Security Strategy § § Mission and Vision Security Principles Risk Based Decision Model Tactical Prioritization § Representative Risks and Tactics Marcus Murray, MVP marcus. murray@truesec. se

What is Risk Management? § The process of measuring assets and calculating risk! § Something we all do! (More or less) Marcus Murray, MVP marcus. murray@truesec. se

Marcus Murray, MVP marcus. murray@truesec. se

Risk Based Security Strategy Corporate Security Mission and Vision Security Operating Principles Risk Based Decision Model Tactical Prioritization Marcus Murray, MVP marcus. murray@truesec. se

Mission and Vision Information Security Mission Operating Principles Risk Based Decision Model Tactical Prioritization Prevent malicious or unauthorized use that results in the loss of Company Intellectual property or productivity by systematically assessing, communicating and mitigating risks to digital assets Marcus Murray, MVP marcus. murray@truesec. se Assess Risk Define Policy Audit Controls

Mission and Vision Information Security Vision Operating Principles Risk Based Decision Model Tactical Prioritization An IT environment comprised of services, applications and infrastructure that implicitly provides availability, privacy and security to any client. § Key Client Assurances § § § My Identity is not compromised Resources are secure and available Data and communications are private Clearly defined roles and accountability Timely response to risks and threats Marcus Murray, MVP marcus. murray@truesec. se

Mission and Vision Security Operating Principles Risk Based Decision Model Tactical Prioritization § Management Commitment § Manage risk according to business objectives § Define organizational roles and responsibilities § Users and Data § Manage to practice of Least Privilege § Privacy strictly enforced § Application and System Development § Security built into development lifecycle § Layered defense and reduced attack surface § Operations and Maintenance § Security integrated into Operations Framework § Monitor, audit, and response functions aligned to operational functions Marcus Murray, MVP marcus. murray@truesec. se

Mission and Vision Enterprise Risk Model Operating Principles Risk Based Decision Model Tactical Prioritization (Defined by Business Owner) Impact to Business High Unacceptable Risk assessment drives to acceptable risk Acceptable Risk Low Probability of Exploit (Defined by Corporate Security) Marcus Murray, MVP marcus. murray@truesec. se High

Mission and Vision Components of Risk Assessment Asset Threat Vulnerability Mitigation What are you trying to assess? What are you afraid of happening? How could the threat occur? What is currently reducing the risk? Impact Probability What is the impact to the business? How likely is the threat given the controls? + = Current Level of Risk What is the probability that the threat will overcome controls to successfully exploit the vulnerability and impact the asset? Marcus Murray, MVP marcus. murray@truesec. se Operating Principles Risk Based Decision Model Tactical Prioritization

Mission and Vision Risk Management Process and Roles Operating Principles Risk Based Decision Model Tactical Prioritization Corp. Sec Prioritize Risks Security Policy 1 2 Engineering and Operations Tactical Prioritization Marcus Murray, MVP marcus. murray@truesec. se Security Solutions & Initiatives 3 Compliance 5 Sustained Operations 4

Mission and Vision Tactical Prioritization by Environment Operating Principles Risk Based Decision Model Tactical Prioritization Data Center Client Prioritized Risks Unmanaged Client RAS Extranet Marcus Murray, MVP marcus. murray@truesec. se Policies and mitigation tactics appropriate for each environment

Mission and Vision Risk Analysis by Asset Class Operating Principles Risk Based Decision Model Tactical Prioritization Exploit of misconfiguration, buffer overflows, open shares, Net. BIOS attacks Host Application Data sniffing on the wire, network fingerprinting Network Assets Account Trust Unmanaged trusts enable movement among environments Marcus Murray, MVP marcus. murray@truesec. se Unauthenticated access to applications, unchecked memory allocations Compromise of integrity or privacy of accounts

Representative Risks and Tactics Enterprise Risks Tactical Solutions Unpatched Devices Secure Environment Remediation Unmanaged Devices Network Segmentation via IPSec Embody Trustworthy Computing Remote & Mobile Users Secure Remote User Single-Factor Authentication 2 -Factor for RAS & Administrators Focus Controls Across Key Assets Managed Source Initiatives Marcus Murray, MVP marcus. murray@truesec. se

Security Solutions and Initiatives Mitigate risk to the infrastructure through implementation of key strategies 1. Secure the Network Perimeter n n n n Secure Wireless Smart Cards for RAS Secure Remote User Next Generation AV Messaging Firewall Direct Connections IDC Network Cleanup 2. Secure the Network Interior n n n n Eliminate Weak Passwords Acct Segregation Patch Management (SMS/WUS/SUS) NT 4 Domain Migration Network Segmentation Smart Cards for Admin Access Regional Security Assessment Marcus Murray, MVP marcus. murray@truesec. se 3. Secure Key Assets n n n Automate Vulnerability Scans Secure Source Code Assets Lab Security Audit 4. Enhance Monitoring and Auditing n n n Network Intrusion Detection System Host Intrusion Detection Systems Automate Security Event Analysis Use MOM for Server Integrity Checking Use ACS for realtime security log monitoring

More information § § www. microsoft. se/technet www. microsoft. se/security www. truesec. se/events www. itproffs. se Marcus Murray, MVP marcus. murray@truesec. se

Marcus Murray marcus. murray@truesec. se Marcus Murray, MVP marcus. murray@truesec. se

Related presentations