Less Security Products, More Secured Products You are squinting if - PowerPoint PPT Presentation

Less Security Products, More Secured Products You are squinting if you can read this

Which is Worst? ERP system down for a week or Customer Data Hacked | slide 2

Less Security Products, More Secured Products You are squinting if you can read this

1. Introduction – Kin Kwan, TELUS Health Agenda 2. What is Cyber Security? 3. Recent News and Trends 4. What Business Analysts Should Know about Cyber Security  Everything Can Be Hacked  Data Sensitivity  Cyber Security is Risk Management  BA is a Technical Liaison  Cyber Security Requirements TELUS Restricted

Exercise #1 https://vimeo.com/29985766 | slide 5

Presenter Security Officer TELUS Health Position Overview • Manage the Information/Cyber Security Program for TELUS Health * Responsibilities • Governance, Risk, and Compliance • Collaborate with TELUS CSO • Internal & External Communication • Don’t get hacked / Demonstrate due-diligence | slide 6 | slide 6

Cyber Threat World Map | slide 7

What is Cyber Security? | slide 8

Exercise #2 | slide 9

Exercise #3 https://www.youtube.com/watch?v=4gR562GW7TI | slide 10

What motivates Hackers? 1.Financial Gain (ransom) 2. Espionage (competition) 3. FIG (fun, ideology, and grudge) 4. Other (errors, glitches, etc.) | slide 11 | slide 11

Cyber Security – Most Targeted Industry 1.PHI/PII is very lucrative (10x) 2. Legacy Equipment (XP) 3. High Impact (Life or Death) 4. Very Connected | slide 12 | slide 12

Cyber Security – Recent News and Trends World’s Biggest Data Breaches | slide 13

Ransomware https://www.youtube.com/watch?v=2sNrhcVGbx0 | slide 14

Ransomware | slide 15

Equifax – 4 th Largest Hack in History What Happened? • Impact - 145.5 million records (8K Canadians) leaked (Full Name, SSN/SIN, BOD, Address, Driver’s License, Credit Cards, Bank Accounts, etc.) • Root Cause: Unpatched application bug (Apache Struts) • Company Impact: • 24% drop in stock price, Q3 earning TBD • CEO, CISO, CIO “retired” Core Lessons • Application security is critical • Layers of Defense is more critical and reinforcement of the “difficult basics” (patching, vulnerability scanning, incident management, etc.) • Compliance driven approach is not adequate - must go above and beyond • Accountability is becoming the new norm • We are all in this together | slide 16 | slide 16

Looking Back at 2017 and Looking Forward at 2018 • Large Data Breaches is becoming the New Norm • More Large Data Breaches •Equifax (145m) • $150 per record •Yahoo (3b) •Uber (57m) • Compliance – GDPR (May 2018), Fines •Nissan Canada (1.13m) and Notification rules •Deloitte •DNC (Trump won) •HBO (GoT) • Market Consolidation - M&A • Security market 50% growth (85m market • Ransomware continue to increase (1b) cap) • Poor security habits continues • Cloud Security remains a top risk • Poor passwords • Lack of patching • People are still the Weakest Link • Out-of-date anti-virus software • Lack of monitoring • Ransomware – “WannaCry” • Legacy systems and application • API • Perimeter is disappearing • IoT (11b) 2017 2018 2018 | slide 17 | slide 17

What BAs Should Know about Cyber Security? Everything Can Be Hacked Data Sensitivity Security is Risk Management BA is a Technical Liaison Cyber Security Requirements | slide 18

Everything Can Be Hacked Know Your Crown Jewels | slide 19 | slide 19

Data Sensitivity Not All Data are Equal | slide 20 | slide 20

Security is Risk Management Don’t Accept the Risk On Your Own!! | slide 21 | slide 21

BA is a Technical Liaison Consult with Privacy and Security Groups Business Cyber Security Ensuring Compliance with Internal Policies and External Regulations (PCI, PIPA) Business Cases and Budgeting | slide 22 | slide 22

Cyber Security Requirements | Secure-by-Design Similar to resilient-by-design or privacy-by-design, secure-by-design specifies that security must be included in the fundamental design of the system, application or solution from the ground up . This differs from current approaches that identify security later and treat it as a layer that can be added to an existing design to make it secure, or a technique that can be applied at a discrete point in the process. | slide 23 | slide 23

Exercise #3 Hawaiian Emergency Management Officials Hold Interview | slide 24

Contact • Kin.Kwan@Hotmail.com • https://www.linkedin.com/in/kinkwan/ | slide 25