digital risk protection - d3oxih60gx1ls6.cloudfront.net€¦ · digital risk advocacy, training...

9/25/2018

1

Privacy & Security 2018

Nick Hayes

Senior Analyst

Digital Risk Protection Defending What You Don’t Control

2© 2018 Forrester Research, Inc. Reproduction Prohibited

A different type of threatSnippets From Mueller Indictment Of Russian Operatives

9/25/2018

2

3© 2018 FORRESTER. REPRODUCTION PROHIBITED.

Ex: Social media botnet clustering

Source: Screenshot from ZignalLabs’ visual botnet dashboard


9/25/2018

3


Digital risk

Exposure to malicious and

inadvertent events online that

directly link to and affect your

business, brand, or people.


IT

Our attack surface keeps growing

9/25/2018

4


IT

Shadow



IT

Shadow

Mobile


9/25/2018

5


IT

Shadow

Mobile

Social



IT

Shadow

Mobile

Social

Web


9/25/2018

6


IT

Shadow

Mobile

Social

Web

IoT, IPv6, ??



IT

Shadow

Mobile

Social

Web

3rd parties 3rd parties


IoT, IPv6, ??

9/25/2018

7


IT

Shadow

Mobile

Social

Web

3rd parties 3rd parties4th parties 4th parties


IoT, IPv6, ??


Active threats to your organization:

– Data and IP exposure

– Brand hijacking, account takeovers

– Executive/VIP safety

– Stock sabotage, crisis amplification

– Digital extortion

9/25/2018

8


Example: Angler phishing

Which one is real?


Example: Angler phishing

Which one is real?

9/25/2018

9


Tactics are effective and often sophisticated


Customers will even use the dark web

9/25/2018

10


We have less control


Ina

bility

to c

on

trol


9/25/2018

11


Known assets, corporate-controlled digital footprint

Ina

bility

to c

on

trol



Unsanctioned activity, rogue accounts

Ina

bility

to c

on

trol


9/25/2018

12


Spoofing, impersonations, fraud

Ina

bility

to c

on

trol



Coordinated botnets, criminal marketplaces

Ina

bility

to c

on

trol


9/25/2018

13


Defend your digital footprint with active risk recon and response.


Potential Emerging Crisis

Preventive

Responsive

Unprepared

Event stage

Ris

k im

pa

ct

Risk threshold

Recovery

9/25/2018

14


Develop active digital risk protection.


The three-step process of DRP

MapCatalog your entire digital footprint.

MonitorApply business and asset context for targeted scanning and detection.

MitigateStreamline controls and remediation action to curb risk impact.

9/25/2018

15


Points of presence

Actors

AssetsAffinities

MapCatalog your digital assets & attributes


Catalog your digital assets & attributes

• Web sites and infrastructure

• Social media, apps Points of

presenceActors

AssetsAffinities

Map

9/25/2018

16



• Employees, execs, third-parties

• Threat actors, bots

Actors

AssetsAffinities

Map



• Brands, logos, products

• PII, PHI, SSNs

AssetsAffinities

Map

9/25/2018

17



• Demographics, psychographics

• Relationships

Affinities

Map


Establish consistent visibility

1. Data collection techniques

– Access: APIs, pay-for-access data, other security intel feeds

– Harvesting: Data crawlers, bots, sensors, etc.

– HUMINT: analyst-curated, in-depth investigations

2. Breadth and depth of risk analytics

– Scope: number of assets, entities, regions, data types

– Frequency: rate of scans – weekly, daily, real-time

– Sophistication: risk scoring, alert options, data visualization

Monitor

9/25/2018

18


Prepare your response

1. Digital risk scenario analysis

2. Technical controls and contingencies– Account and asset protection

– Takedowns and event remediation

– Integration with security tools: firewalls, ESGs, etc

3. Response teams and plans– Decision trees, crisis communications

– Key external stakeholders, regional support

Mitigate


DRD leadership & expertise

Marketing, security, & risk collaboration

Digital risk advocacy, training

& awareness

Event review & escalation

Digital risk remediation

Digital governance

Digital footprint discovery &

mapping

Social risk monitoring &

mitigation

Web & Dark Web monitoring

& mitigation

Strategy & Performance Management

Digital assurance

Digital risk & compliance mgmt

People Process Technology

Oversight

Mobile risk monitoring &

mitigation

Malvertising & digital marketing

security

Digital risk analytics

Forrester’s digital risk framework

9/25/2018

19


Simplified capabilities assessment

Map Monitor Mitigate

Social media ◕ ● ◑Mobile app stores ◔ ◔ ○Surface web ◑ ◕ ◕Dark web ◔ ◑ ○Third-parties ◔ ◑ ◕


Digital distortion is only just beginning

9/25/2018

20


Key takeaways

1. Digital footprints are vast and valuable.

2. Detection and remediation supersede prevention.

3. DRP requires both data analytics and integration.

4. CISOs must prioritize brand security initiatives.

Thank you

Nick Hayes

[email protected]

@nickhayes10

For further reference

Zero Trust Outside The Wire: Combatting Influence Operations

Chase Cunningham

Nick Hayes

Jeff Pollard

digital risk protection - d3oxih60gx1ls6.cloudfront.net€¦ · digital risk advocacy, training...

Documents