Information Technology Security Presentation to Joint Legislative - PowerPoint PPT Presentation

Information Technology Security Presentation to Joint Legislative Committee on Information Technology Oversight Chip Moore State Chief Information Security Officer Office of Information Technology Services December 13, 2012

Introduction • Security adage: there are two kinds of organizations – Those that have been hacked – Those that don’t know they’ve been hacked • Attempts to steal or compromise data are constant, and hackers will probably get into your systems • Key issue is what have you done to protect your data and minimize the damage 2

Outline • Threats – Entry points – Types of threats • Current themes in IT security • IT security in state government • Opportunities for improvement • Questions 3

Cyber infrastructure • Internet Connections – Three (3) • Wide Area Network Connections ~3,700 • Exposed Servers (Web, Mail, Mainframe, Agency Applications >1,000) • PCs and laptops (~64,000) •Core Applications (Windows, Office, Adobe, anti-virus) •E-mail (Threats: Spam, fake email, viruses and spyware) •Web (Threats: Malicious web pages) State’s backbone network and POPs (Points of Presence) 4

Threats and Motivations • Organized crime – motive is profit • Hacktivists – motive is to make a point, political motive, embarrassment of an organization • State sponsored hackers - government belief that you may be able to destabilize an economy • Black hat – pride, bragging rights • Script kiddies - people looking to say they are successful security professionals 5

Techniques • Fake electronic mail • Unknown software vulnerabilities • Hacking including web defacements • Interruptions to Internet service that would limit citizens’ ability to conduct state business • Viruses • Social engineering 6

Challenges • Protecting data when it is everywhere – Ever-changing technology, tablets and smartphones, have made data mobile • Workforce demanding to use personal devices for work • Human behavior – Policies, rules and regulations will not stop people from acting without thinking • Insider threats • Password management • Timely removal of confidential data at the end of its usefulness • Business demands for data sharing 7

Themes in IT security • National Association of State Chief Information Officers (NASCIO) call to action issued last month – Enterprise approach • Fewer silos = better security • Enforce standards • Minimize entries to network • Approach reduces operational costs 8

What are we doing? • Technical security controls – antivirus, firewalls, intrusion detection and monitoring, encryption of devices and some data • Training and Awareness – provide monthly training newsletters to executive branch agencies • ITS has mandatory annual training for all employees • Information sharing - relationships with Homeland Security and the FBI to receive and provide information for ongoing investigations • Audits – we have audits performed by the State Auditor, the federal government and private industry for regulatory compliance. • Annually provide and update security standards based on international security standards. • Preparing for a third party vulnerability assessment and limited penetration testing 9

Areas for Improvement • Additional funding for – More outside vulnerability and penetration testing – Additional security controls purchased at the enterprise level – Data Loss Prevention • Encryption, other technical approaches • Start with most critical data • As first step, agencies should evaluate their data and programs to determine sensitivity and risk of exposure • Employee Security Training and Awareness – More training and newsletters; timely notifications of significant, current threats

Cost vs. risk • IT security, like any security, is a matter of cost vs. risk – How much willing to spend to achieve what level of security • Cost of a breach is also significant – Lost credibility and trust – Cost of notifying citizens, as required by law – Cost of protecting citizens against identity theft after a breach

Questions? Chip Moore Chief Information Security Officer (919) 754-6300 charles.moore@nc.gov http://www.esrmo.scio.nc.gov/ 12