DIR HB 3834 END USER CYBER SECURITY AWARENESS PRESENTATION Andy - - PDF document
DIR HB 3834 END USER CYBER SECURITY AWARENESS PRESENTATION Andy Bennett Deputy CISO State of Texas 1 HB 3834 Training Disclaimer DISCLAIMER These slides are distributed by the Texas Municipal League (TML) for informational purposes only.
Andy Bennett Deputy CISO State of Texas
1
2
3
4
Cybersecurity Coordinator shall "oversee cybersecurity matters for th[e] state.“ [LINK]
cybersecurity coordinator shall establish and lead a cybersecurity council that includes public and private sector leaders and cybersecurity practitioners to collaborate on matters of cybersecurity concerning this state.” [LINK]
coordinator may implement any portion or all of the recommendations made by the Cybersecurity, Education, and Economic Development Council under Subchapter N.” [LINK]
5
TEXAS GOVERNMENT CODE
cybersecurity training programs for state and local government employees.“
6
7
8
Availability
Information refers to “[a]ny communication or representation of knowledge such as facts, data, or
including textual, numerical, graphic, cartographic, narrative, or audiovisual.” Information System refers to “[a] discrete set of information resources
maintenance, use, sharing, dissemination, or disposition of information.”
Source: NIST SP 800-171 Rev. 1 Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations Source: NIST SP 800-53 Rev. 4 Security and Privacy Controls for Federal Information Systems and Organization
9
Availability
Prevent unauthorized access and use of information resources Prevent unauthorized change and ensure reliability of information resources Ensure timely availability of information resources
Users must exercise due care to ensure the confidentiality, integrity, and availability of the information resources under their care.
10
11
Availability
12
Availability
13
Availability
14
This Photo by Unknown Author is licensed under CC BY-ND This Photo by Unknown Author is licensed under CC BY-NC-ND
Defense-in-Depth Information assets are protected by many interlocking, redundant, and complimentary controls to detect, deter, and prevent attacks.
15 USER DOMAIN WORKSTATION DOMAIN LAN-TO-WAN DOMAIN LAN DOMAIN APPLICATION DOMAIN REMOTE ACCESS DOMAIN Public Internet
Encrypted Tunnel Encrypted Tunnel
WAN DOMAIN Public Internet
Vendors
WEB EMAIL
DMZ
Defense-in-Depth Information assets are protected by many interlocking, redundant, and complimentary controls to detect, deter, and prevent attacks.
16
“Information assets” are protected by several layers of “technical” controls.
Least Privileges & Segregation of Duties Limit user privileges (access/use) to no more than what is necessary to perform their duties. Ex: The judicial branch of government, by law, may decide the constitutionality of a law, but it may not create law. Why? Because this authority belongs to the legislature and CANNOT be delegated to another branch.
17
This Photo by Unknown Author is licensed under CC BY-SA
Controls/Safeguards Categories and Design Controls/safeguards are instruments implemented by an organization to ensure the “CIA” of “information assets”. They are categorized as one or several of the following: 1) Administrative; 2) Physical; or 3) Technical. They are designed for one or several outcomes: 1) Detection; 2) Deterrence; 3) Prevention; and/or 4) Correction. See NIST SP 800-53 Rev.4 for a comprehensive set of “controls”. (Link)
18
Administrative Controls/Safeguards Administrative controls/safeguards generally refer to the policies, standards, procedures, and guidelines adopted to provide for the confidentiality, integrity, and availability of information. Administrative controls can be enforced through physical and technical controls. Examples:
19
Administrative Controls/Safeguards Your information security program should consist of a “policy framework.” The “policy framework” will balance the organization’s objectives and:
20
security issue. Policy
achieving system or procedural- specific requirements. Standards
specific steps of a process. Procedures
voluntary methods
Guidelines
Physical Controls/Safeguards Physical controls/safeguards generally refer to physical mechanisms implemented throughout an
Examples:
21
This Photo by Unknown Author is licensed under CC BY-SA
Technical Controls/Safeguards Technical controls/safeguards generally refer to the software and/or hardware mechanisms implemented throughout the network, in order to enforce the rules and requirements defined in the administrative controls. These controls may also be designed to detect, prevent, and/or correct security incidents. Examples:
22
a. Confidentiality b. Integrity c. Availability
23
24
Administrative Controls/Safeguards Administrative controls/safeguards generally refer to the policies, standards, procedures, and guidelines adopted to provide for the confidentiality, integrity, and availability of information. Administrative controls can be enforced through physical and technical controls. Examples:
25
Administrative Controls/Safeguards Your information security program should consist of a “policy framework.” The “policy framework” will balance the organization’s objectives and:
26
security issue. Policy
achieving system or procedural- specific requirements. Standards
specific steps of a process. Procedures
voluntary methods
Guidelines
Top Secret Secret Confidential
LESS MORE LESS
CONTROL S
ACCESS MORE INFORMATION CLASSIFICATION MANAGEMENT PROGRAM EXAMPLE
A formal system for: 1. Classifying information a. Primarily based on the potential damage to national security, if information is released to an unauthorized party. 2. Safeguarding Information a. What controls apply? b. Who can access and use it? c. When can it be accessed? d. How can it be used? e. Where and how to store it? 3. Declassifying Information a. When, why, and how.
Information Classification Management Program National Policy: EO 12958, Later Replaced By EO 13526 (Link) Implementing Directive: 32 CFR Part 2001/2004, "Classified National Security Information Directive No. 1“ (Link)
27
CONFIDENTIAL CONVERSATION
DOCUMENT CLASSIFICATION: CONFIDENTIAL (C)
Who can access and use this information? Where and how can this information be stored?
28
c. When can it be accessed?
29
30
31
Physical information assets at “rest”.
32
Audio information assets in “use” and “transit”.
33
Electronic information assets in “use” and “transit”.
34 USER DOMAIN WORKSTATION DOMAIN LAN-TO-WAN DOMAIN LAN DOMAIN APPLICATION DOMAIN REMOTE ACCESS DOMAIN Public Internet
Encrypted Tunnel Encrypted Tunnel
WAN DOMAIN Public Internet
Vendors
WEB EMAIL
DMZ
c. Digital/Electronic.
35
36
37 USER DOMAIN WORKSTATION DOMAIN LAN-TO-WAN DOMAIN LAN DOMAIN APPLICATION DOMAIN REMOTE ACCESS DOMAIN Public Internet
Encrypted Tunnel Encrypted Tunnel
WAN DOMAIN Public Internet
Vendors
WEB EMAIL
DMZ
Administrative Controls/Safeguards Your information security program should consist of a “policy framework.” The “policy framework” will balance the organization’s objectives and:
38
security issue. Policy
achieving system or procedural- specific requirements. Standards
specific steps of a process. Procedures
voluntary methods
Guidelines
Administrative Controls/Safeguards Administrative controls/safeguards generally refer to the policies, standards, procedures, and guidelines adopted to provide for the confidentiality, integrity, and availability of information. Administrative controls can be enforced through physical and technical controls. Examples:
39
Physical Controls/Safeguards Physical controls/safeguards generally refer to physical mechanisms implemented throughout an
Examples:
40
This Photo by Unknown Author is licensed under CC BY-SA
Technical Controls/Safeguards Technical controls/safeguards generally refer to the software and/or hardware mechanisms implemented throughout the network, in order to enforce the rules and requirements defined in the administrative controls. These controls may also be designed to detect, prevent, and/or correct security incidents. Examples:
41
a. Administrative Controls/Safeguards b. Physical Controls/Safeguards c. Technical Controls/Safeguards
42
43
44 USER DOMAIN WORKSTATION DOMAIN LAN-TO-WAN DOMAIN LAN DOMAIN APPLICATION DOMAIN REMOTE ACCESS DOMAIN Public Internet
Encrypted Tunnel Encrypted Tunnel
WAN DOMAIN Public Internet
Vendors
WEB EMAIL
DMZ
45
Physical information assets should be stored and locked according to policy.
46
Confidential or sensitive conversations should take place in secure areas where unauthorized individuals cannot eavesdrop.
47
Information stored on an authorized and encrypted cloud storage services only Information stored on authorized and encrypted mobile media
Information stored on authorized and encrypted workstations
Information stored on authorized and encrypted mobile devices
a. Filing cabinets and/or safes b. Authorized and secure cloud storage services (e.g., Microsoft OneDrive) c. Authorized and secure removable media (e.g., USB flash drives) d. Authorized and secure mobile devices (e.g., cell phones)
48
49
Administrative Controls/Safeguards Your information security program should consist of a “policy framework.” The “policy framework” will balance the organization’s objectives and:
50
security issue. Policy
achieving system or procedural- specific requirements. Standards
specific steps of a process. Procedures
voluntary methods
Guidelines
Administrative Controls/Safeguards Administrative controls/safeguards generally refer to the policies, standards, procedures, and guidelines adopted to provide for the confidentiality, integrity, and availability of information. Administrative controls can be enforced through physical and technical controls. Examples:
51
Information Sanitization: Refers to “the actions taken to render data written on media unrecoverable by both
Information Destruction: Refers to actions taken to permanently destroy media in which data/information is stored.
DOCUMENT CLASSIFICATION: CONFIDENTIAL (C)
FIRE ZEROIZATION REDACTION DEGAUSSING DRILLING DRILLING SHREDDING OTHER COMMON SANITIZATION & DESTRUCTION METHODS For more information, see NIST SP 800-88 Rev. 1, Guidelines for Media Sanitization (Link)
52
a. Sanitized; or b. Destroyed.
53
54
Availability
According to NIST, a ‘threat’ is “[a]ny circumstance or event with the potential to adversely impact organizational operations, organizational assets, individuals, other
disclosure, modification of information, and/or denial of service.”
55
Availability
[Information Security] Threats
Human-Based
Threat actors who take actions to compromise the CIA of an organization.
Nature-Based
Threat actors who take actions to compromise the CIA of an organization.
Impact: Confidentiality, Integrity, and Availability
56
Availability
According to NIST, ‘threat actor’ refers to “[a]n individual or group posing a threat.”
57
THREAT ACTORS
HACKTIVISTS CRIMINALS INSIDERS STATE ACTORS Conduct attacks in furtherance
interests. Conduct attacks in furtherance
interests. Conduct attacks in furtherance
interests. Destruction, disruption, and espionage in furtherance
interests.
Availability
Impact: Confidentiality, Integrity, and Availability
58
Availability
According to NIST, a ‘risk’ is “[a] measure of the extent to which an entity is threatened by a potential circumstance or event, and typically a function of: (i) the adverse impacts that would arise if the circumstance or event occurs; and (ii) the likelihood of occurrence. Information system-related security risks are those risks that arise from the loss of confidentiality, integrity, or availability of information or information systems and reflect the potential adverse impacts to organizational operations (including mission, functions, image,
59
Availability
According to NIST, an ‘attack’ is “[a]n attempt to gain unauthorized access to system services, resources, or information, or an attempt to compromise system integrity, availability, or confidentiality.”
60
61 USER DOMAIN WORKSTATION DOMAIN LAN-TO-WAN DOMAIN LAN DOMAIN APPLICATION DOMAIN REMOTE ACCESS DOMAIN Public Internet
Encrypted Tunnel Encrypted Tunnel
WAN DOMAIN Public Internet
Vendors
WEB EMAIL
DMZ
a. Nature-based; or b. Human-based.
a. Hacktivists; b. Insiders (unintentional/intentional); c. Criminal; d. State-Sponsored; e. Opportunists; or f. Other.
62
63
Social Engineering Attacks
sensitive information, obtaining unauthorized access, or committing fraud by associating with the individual to gain confidence and trust.” Source: NIST SP 800-63-3 Digital Identity Guidelines
systems.
1. Phishing (Email): A threat actor may send emails to your organization, purporting to represent a trusted entity, such as a vendor or co-worker. This email will typically request the recipient to either provide information, open an attached document (containing malware), or click an embedded link to an infected website. 2. Smishing (SMS): A threat actor may send text messages to a user, purporting to represent a trusted entity, such as a vendor or co-worker. This text message will request the recipient to either provide confidential information or click a link to an infected website. 3. Vishing (Voice): A threat actor may call your organization, purporting to represent a trusted entity, such as a vendor or co-worker. During this call, the threat actor will ask questions designed to trick the recipient into divulging confidential information. 4. Masquerading (In-Person): A threat actor may arrive at your organization, purporting to represent a trusted entity, such as a vendor or delivery person.
64
http:notdocusign.com
Trusted sender? Threat actor spoofs a trusted colleague’s email address to deceive the user. Risk Mitigation: Contact the sender out-of-band (phone or separate email) to confirm. Threat actor prompts the user to visit a fraudulent site to review a contract. Risk Mitigation: Hover over the links to reveal their URL. If suspicious: 1) Do not click on the link; and 2) Report the email to your
Information Security Department.
THREAT INDICATOR 1. Threat actor sends user a fraudulent email prompting action a. Appears to come from a trusted source (spoofed) b. Prompts user to click a link 2. Threat actor directs user to fraudulent site 1. Prompts user to provide username and password 2. Prompts user to download MS Office document containing malware (macro- based)
65
http:notdocusign.com
This is not “https:docusign.com” The user’s email/password are captured for unauthorized reuse by the threat actor. Risk Mitigation: If you have made it this far and notice the URL is suspicious: 1) Do not provide your username and password; 2) Do not click on any of the links on the page; and 3) Report the email to your
Information Security Department.
THREAT INDICATOR 1. Threat actor sends user a fraudulent email prompting action a. Appears to come from a trusted source (spoofed) b. Prompts user to click a link 2. Threat actor directs user to fraudulent site 1. Prompts user to provide username and password 2. Prompts user to download MS Office document containing malware (macro- based)
66
THREAT INDICATOR 1. Threat actor sends user a fraudulent email prompting action a. Appears to come from a trusted source (spoofed) b. Prompts user to click a link 2. Threat actor directs user to fraudulent site 1. Prompts user to provide username and password 2. Prompts user to download MS Office document containing malware (macro- based)
http:notdocusign.com
Risk Mitigation: If you have made it this far and have downloaded a file: 1) Do not enable content (macros); and 2) Report the email to your
Information Security Department. The user downloads the fraudulent contract document for review. This document contains a macro-based malware, which will infect his/her computer and network upon activation.
67
The user clicked “enable content” on the Word document, which infects his/her PC and network with “ransomware”.
68
emails or by unknowingly visiting an infected website.” Source: Department of Homeland Security
represent a trusted entity, such as a vendor or co-worker. This email will typically request the recipient to either provide information, open an attached document (containing malware), or click an embedded link to an infected website.
69
INDICATOR OF COMPROMISE
a. Files or system are encrypted b. Recovery of files contingent upon:
1. Ability to decrypt (or pay the ransom); or 2. Recover from backups.
Risk Mitigation: If you have made it this far have downloaded a file: 1) Do attempt to pay or decrypt; 2) Immediately report the ransom to your
Information Security Department; and 3) Follow instructions regarding who and how this information can be shared.
70
a. Social Engineering; and
I. Phishing (Email) II. Smishing (SMS) III. Vishing (Voice) IV. Masquerading (In-Person)
b. Ransomware.
1. What they are; 2. How they work; 3. How to spot them; 4. How to report and respond to them.
71
72
a. Suspicious computer or network activity indicating an attempted attack. b. Suspicious computer or network activity indicating a successful attack. c. Any suspicious behavior in the workplace.
a. E.g., Help-Desk, IT, Information Security, or other.
a. Know how soon, as well.
a. Before and after reporting.
73
Source: Texas Administrative Code
Secure Reporting for State Agencies
B, Rule § 202.23 Security Reporting for Institutions of Higher Education
C, Rule §202.73
TEXAS ADMINISTRATIVE CODE TEXAS GOVERNMENT CODE
Source: Texas Government Code Section 2054.1125
74
Who: The City of Atlanta was the victim of a Ransomware attack conducted by two Iranian hackers, Faramarz Shahi Savandi (35y) and Mohammad Mehdi Shah Mansouri (28y).
What: The threat actors infected several mission-critical resources, ultimately affecting many services and programs, such as: utilities, parking, and even court services. Response/Reporting Lessons Learned: March 22 (~5am), a City of Atlanta employee discovered the ransom note on an Atlanta Police Department computer. This employee took a picture of the ransom note with a cell phone and leaked the incident to local media, 11Alive.
portal, leaving the City with no option to pay. (link) Key Takeaway:
responsible for responding to computer security incidents.
by your organization.
75
Texas Department of Information Resources In Texas, if you are impacted by an incident, DIR provides the following resources:
Services For more information about these resources, please visit: Link More information on State Security Resources Below.
76
a. Who to report it to; b. How to report it; c. When to report it; d. What to do after it has been reported; and e. Who else they can share the information with.
77
78
SECURITY TRAINING
Link
INFORMATION SHARING
Security Meetings
Link
79
INFORMATION SECURITY PLANNING
Cybersecurity Framework
security planning Link
Incident Response Risk and Compliance
Security Monitoring and Device Management
IDS/IPS
Firewall
System
and Event Management (SIEM)
Center Services
Security
Preparedness
Management
Application Test
Scanning
Vulnerability Scanning
Assessment
80
Remote Management and Operations
San Antonio, Texas Tampa, Florida Dallas, Texas San Jose, California
Security Operations Center Services (Onsite Management)
DIR NSOC Austin, Texas Where Needed Texas Available Only in Legacy Data Centers:
Available for ALL Systems and Locations:
Available for Non-DCS managed systems:
81
Incident Response Preparedness
Provides a critical review of current internal processes and procedures for handling events, incidents, and evidence. Includes:
environment
Digital Forensics
images
Incident Response Management
in your environment
containment of computer security events
82
https://pubext.dir.texas.gov/portal/internal/resources/DocumentLibrary/Incident%20Response%20Template%202019.pdf
83
Penetration Testing
84
1. Information security is interdisciplinary, consisting of risk management, technology, and compliance. 2. Consider adopting a recognized framework, such as the NIST/TX CSF, to plan, design, implement, and maintain your enterprise information security program. 3. Identify your information assets, assess the risks of each, and implement controls to achieve an “acceptable level of risk”. 1. Know what you have; 2. Know your risks; 3. Prepare to defend; 4. Prepare to respond; and 5. Prepared to recover. 4. Use a “risk-based” approach to ensure you provide for the confidentiality, integrity, and availability of your information assets. 5. Do not go it alone – consider leveraging the state level resources provided by the DIR
85
NIST Cybersecurity Framework (Link) NIST Special Publications (Link) NIST NICE Cybersecurity Workforce Framework (Link)
NIST SP 800-12 Rev. 1, An Introduction to Information Security (Link) NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments (Link) NIST SP 800-50, Building an Information Security Awareness and Training Program (Link) NIST SP 800-61 Rev. 2, Computer Security Incident Handling Guide (Link)
NIST Glossary of Key Information Security Terms (Link)
86
87