When RSA Conference 2018 convenes in San Francisco on April 16th – 20th, over 40,000 attendees will have to divide their attention between hundreds of speakers and sessions.
With so many events to choose from, it’s important to show up with a good idea of which topics are likely to be of key relevance to the industry in the coming year.
Some of Booz Allen’s best and brightest cybersecurity professionals will be among those sharing their expertise at speaker sessions and peer-to-peer events throughout the week. Here are three areas where they’ve chosen to focus their attention.
Evidence-Based Security: The New Top Five Controls
Implementing advanced cyber defense strategies is a waste of time and money if you don’t have the basics in place first. Evidence suggests that most threats can be stopped by basic prevention measures and network security tools. By analyzing recent attacks and breaches, we’ve identified five foundational controls that will pay dividends.
Top 5 basic cybersecurity priorities—backed by evidence:
- Implement multifactor authentication: 81% of incidents recorded in the Verizon Data Breach Investigations Report involved stolen or weak passwords.
- Secure Email: Email is the delivery mechanism for two-thirds of recorded breaches involving malware.
- Train users to spot spear phishing: A trained user base coupled with a process for reporting and triaging incidents is critical.
- Patch the right 80% of vulnerabilities: For most organizations, attackers will target well-known, easily exploitable vulnerabilities on Internet-facing systems or hosts.
- Manage the external attack surface: Configuration reviews, patches, and continuous testing of public-facing websites and applications provides real benefit in reducing successful attacks.
By raising the bar for what it takes to gain initial network access, we can eliminate most threats and narrow down the range of actors that need to be hunted and expelled from inside the network.
Learning from the Three-Ring Circus of NotPetya
The NotPetya malware incident wreaked global havoc in 2017, quickly spreading to 2,000 companies and resetting computers at rates exceeding 20,000 machines per minute. And it all started with the compromise of a single supplier’s software distribution. We can expect more attacks like NotPetya to produce higher damages in the future, but the experience provides us with actionable lessons that can help businesses reduce impacts when the next breach strikes:
- Include internal and external dependencies in business continuity plans.
- Secure the supply chain to prevent the distribution of malicious payloads through backdoors.
- Segment your networks to create firebreaks and checks on adversary movement.
- Have a paper copy of your disaster recovery plan so you can actually follow your process if the worst happens.
Cyber attacks aren’t just about your IT systems, they affect every phase of your business process. Thinking holistically about your operations can help prepare you for the next NotPetya.
Privacy as a Stakeholder: How to Get a Seat at the Table
Privacy is a key component of day-to-day business operations. It shouldn’t function in a silo or be buried within another department. It should have a seat at the leadership table.
“Privacy as a stakeholder” is a concept that aims to embed privacy considerations into business decisions at the very beginning of the process, strategically leveraging resources to ensure that the highest risk items get the necessary attention.
To succeed in implementing “privacy as a stakeholder,” follow these keys to success:
- Cultivate buy-in from senior leaders
- Build relationships and partnerships across your organization
- Demonstrate the value of privacy as a differentiator and business enabler
- Find ways to get to “yes” while still protecting people’s privacy
When properly executed, “privacy as a stakeholder” can help your organization achieve business goals, reduce costs, protect company reputation, and ensure compliance.
