chief product officer, granicus · 2017 digital communications summit (dccomm17) bob ainsbury. the...
TRANSCRIPT
BOB AINSBURYChief Product Officer, Granicus
Closing the Cyber Security Gap2017 Digital Communications Summit (DCComm17)
Bob Ainsbury
The user's going to pick dancing pigs over security every time.
The most likely way for the world to be destroyed, most experts agree, is by accident. That's where we come in; we're computer professionals.
We cause accidents.
Those of us in security are very much like cardiologists. Our patients know that lack of exercise, too much dietary fat, and smoking are all bad for them. But they will continue to smoke, eat fried foods, and practice being couch potatoes until they have their infarction.
6
7
8
the practice of using a network of remote servers (accessed via the Internet) to store, manage, and process data, rather than a local system.
9
YOUR STUFF ON OTHER PEOPLES SYSTEMSPOTENTIALLTY ACCESSABLE BY MORE THAN
25 BILLION DEVICES
10
11
120
1,000,000
2,000,000
3,000,000
4,000,000
5,000,000
6,000,000
7,000,000
8,000,000
9,000,000
10,000,000
1 2
Intrusion Attempts Per Day
10,000,000 IAPD
20,000,000 IAPD
10,000,000 IAPD 50,000 IAPD
13
1,300%
in February 2015, the Director of National Intelligence testified that cyber threats to U.S. national and economic security are increasing in frequency, scale, sophistication, and severity of impact.
14
Chief Information Security Officer (CISO)
ensure that the agency is meeting the requirements of the law, including developing, documenting, and implementing the agency-wide information security program
We only need to be lucky once. You need to be lucky every time.
16
17
Do you exercise?
Do you smoke?
Do you drink?
How many hours do you sleep?
How stressful is your job?
When did you last go to the dentist?
When did you last take a vacation?
18
Do you exercise?
Do you smoke?
Do you drink?
How many hours do you sleep?
How stressful is your job?
When did you last go to the dentist?
When did you last take a vacation?
?
19
Do you receive regular security training?
Do you receive security incident alerts?
Do you share login credentials?
Is security discussed at team and group meetings?
Are there passwords on whiteboards?
Does your organization test employees for security IQ?
20
Do you receive regular security training?
21
Does your organization test employees for security IQ?
22
Does your organization test employees for security IQ?
23
Take a moment and think about yourself, your group, your department, your agency.
How do you rate your security health?
24
the systems you use need to be secure
FEDRAMPprovides a standardized approach to security assessment, authorization, and continuous monitoring
25
1. A company doesn't get authorized – individual products or services do.
2. Just because a product runs in a FedRAMP cloud provider (like Amazon) doesn’t mean that the application is FedRAMP’d …..far from it.
3. Agency's have to use FedRAMP’d solutions
4. FedRAMP uses a very rigorous and effective process
5. An agency has security obligations even when you use a FedRAMP’d Product
Closing the GAP• Get security burned into your culture – don’t wait for the CISO
• Make security part of your regular dialog
• Train and re-train
• Test your teams
• Measure, Monitor, Adjust
• Only use FedRAMP approved products
• And do your part in meeting your obligations
27
Those of us in security are very much like cardiologists. Our patients know that lack of exercise, too much dietary fat, and smoking are all bad for them. But they will continue to smoke, eat fried foods, and practice being couch potatoes until they have their infarction.
