tx cio academy 16 presentation - best practices in security prevention - by ron northcutt

©2016 Acquia Inc. — Confidential and Proprietary

I’ve been hacked… now what?

Ron NorthcuttSr. Solutions Architect

©2016 Acquia Inc. — Confidential and Proprietary©2016 Acquia Inc. — Confidential and Proprietary

Agenda

● Approach

● Core concept

● Prevention plan

● Incident response plan

● Strategies


Approach

● Solutions based methodology

● Focus on common attack vectors

● Know your risk levels

● Minimize footprint

● Keep it simple


Core concept

● Revolves around 2 plans

○ How to Prevent an attack

○ How to Respond to an attack


Cyber defense plan (Prevent)

● Monitoring tools

● Defensive tools

● Managed services

● Pen testing

● Hunting


Incident response plan (Respond)

“Incident response is an organized approach to addressing and

managing the aftermath of a security breach or attack (also known as

an incident).

The goal is to handle the situation in a way that limits damage and

reduces recovery time and costs.”

http://searchsecurity.techtarget.com/definition/incident-response




1 - Discovery & Investigation

2 - Escalation of the breach

3 - Containment of the breach

4 - Data integrity & forensic evidence

5 - Restore services

6 - Notify affected parties

7 - Post incident report

Return to monitoring

7 Stages of Incidence Response


Strategy - Plan management

● Living document

● Update regularly

● Track revisions & approvals

● Align with partners


Strategy - Architecture

● Separation of concerns

● Layers of security

● Harden devices and connections

● Whitelisting over blacklisting

● Fungible systems with scripting


Strategy - Centralized services & tools

● Examples: in-house, managed services,

cross-department, etc.

● Economy of scale = less expensive

● Outsource maintenance & compliance

● Augment your team with expert partners


Strategy - Look at the ROI for all scenarios

● Be honest about the risk

● Be honest about the cost

● Invest in human time

● Maximize the resources you have

(budget, hires, internal teams, existing tools, etc.)


● Solutions based approach

● Core concept

● Prevention plan

● Incident response plan

● Strategies

Review


Take action!

Schedule a review of your plan today.


Questions?

Ron NorthcuttSr. Solutions Architect

[email protected]

mailto:[email protected]

mailto:[email protected]

tx cio academy 16 presentation - best practices in security prevention - by ron northcutt

Government & Nonprofit