DOCSLIB.ORG

Cyber Security Trends

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Cyber Security Trends Cyber Security for the future of financial services Thio Tse Gan May 2016 © 2016 Deloitte & Touche Enterprise Risk Services Pte Ltd 1 Global trends & outlook © 2016 Deloitte & Touche Enterprise Risk Services Pte Ltd 2 Cyber-attacks are on the rise of incidents of incidents $400B+ involve abuse still take days of privileged 15% to discover [2] 55% is the annual cost to a c c e s s [2] the global economy from cybercrime [1] Numbers denote industry wise breakup of 2014 data breach incidents Healthcare Financial Services Educational Government 50% 99.9% 18% 229 recipients open emails and click of the exploited on phishing links within the first 27.5% vulnerabilities were 11% hour of receiving them [2] Average compromised more than a increase in the number of year after CVE* was data breaches in days published [2] various industries 63% attackers 8% from 2013 [5] maintained presence after 90% infiltration and before chance that at least one person Per capita cost of data breach was detection [3] will fall prey to a phishing highest in US in 2015 [4] campaign with just Global 10 $154 Average $201 2014 emails [2] $217 $217 2015 [1] Net Losses: Estimating the Global Cost of Cybercrime by Center for Strategic and International Studies; [2] Verizon 2015 Data Breach Investigations Report; [3] Mandiant -Trends® 2014: Beyond the Breach, published April 10, 2014; [4] Ponemon 2015 Cost of Data Breach Study: Global Analysis ; [5] ITRC Breach Statistics 2005-2014; * CVE (Common Vulnerabilities and Exposures) is a dictionary of publically known information security vulnerabilities and exposures -http://cve.mitre.org © 2016 Deloitte & Touche Enterprise Risk Services Pte Ltd 3 © 2016 Deloitte & Touche Enterprise Risk Services Pte Ltd 4 Rampant cyber attacks observed around the world in 2015 and 2016 80 million 5 million personal records exposed details leaked in attack launched on in data breach in VTech Anthem Inc. 19.7 million people’s personal details stolen in attack launched on National pension U.S. Office of Personnel Management system hacked in Japan and 1.25 million people’s 10.4 million personal data was records exposed exposed in 3 attacks launched U.S. IRS hacked on TalkTalk Group $81 million 100,000 personal details stolen from stolen and used to generate PINS for Social Central Bank Security numbers in 2 of Bangladesh in a separate attacks bank heist © 2016 Deloitte & Touche Enterprise Risk Services Pte Ltd 5 Complex regulatory requirements created to curb rise of cyber crime US Federal HIPPA 1996, GLBA 1999, European Union COPPA 1998, CAN-SPAM 2003. EU Data Protection Directive 1995, EU Do Not Call Improvement Act Privacy and Electronic Communications 2007, Safe Harbor Principles Directive (as amended in 2011), Data 2000, FCRA (as amended in Retention Directive 2006. Member states Russia Federal Law No. 152-FZ 2003) Patriot Act 2001 implement Directives as their own national Canada on personal data 2006 laws. Regulation of Investigatory Powers PIPEDA 2004. Act 2000 Privacy Act 1988 and Provincial privacy Laws Switzerland Federal Data Protection Act 1992 on personal data 2006 California California Online Privacy Protection Act 2003, Japan China Security Breach Notice Personal Information Decision on (Civil Code 1798 Formerly Protection Act 2003 strengthening Internet SB 1386) 2003 information protection, guideline for personal information protection Mexico Philippines Federal Law on the Data Privacy Protection of Personal South Africa Singapore Act 2011 Data Held by Private Electronic Personal Data Parties 2010 Communications Act Protection Act 2013 New Zealand Privacy Act Dubai 1993 Data Protection Act 2007 Argentina Protection of Personal Australia Data Law 2001 Australian Federal Costa Rica Privacy Act 1988. Law No. 7975 – Undisclosed Anti-Spam Act 2004 Information Law. Law No. 8968 – Protection in the Handling of the Personal Data of Individuals © 2016 Deloitte & Touche Enterprise Risk Services Pte Ltd 6 Technology regulatory landscape Financial Services Vietnam • Circular no. 01/2011/TT-NHNN Safety, secrecy guidelines of the information technology systems in banking operation • Circular no. 12/2011/TT-NHNN Management and utilization of digital signatures, sigital certificates and SBV digital signature verification services • Circular no. 29/2011/TT-NHNN Security and Secrecy of internet banking services Thailand • BOT Notification No. 1953-2548 Guideline for the Singapore Preparation of IT Contingency Plan – 2008 • Personal Data and Privacy Act - 2013 • BOT Notification No. SorNorSor. 26/2552 Guidelines • MAS Notice 644 on Technology Risk Management - 2013 for Development of IT Contingency Plan – 2008 • SRD TR 01/2014 – System vulnerability assessments and • BOT Notification No. SorNorSor.6/2557 Supervisory penetration testing Guidelines on IT Outsourcing - 2014 • SRD TR 02/2014 – IT security risk posed by personal • BOT Notification No. SorNorSor. 26/551 Supervisory mobile devices Guidelines for Security of E-Banking Services – 2008 • SRD TR 01/2015 – Early detection of cyber intrusions • SRD TR 03/2015 – Technology risk and cyber security training for Board Malaysia • MAS Notice 634 Bankig Secrecy – Conditions for • BNM Guidelines on Data Management and Outsourcing - 2004 Management information Systems – 2011 • Guidelines on Outsourcing - 2004 • Guidelines on management of IT Environment (GPIS 1) • Consultation Paper on Notice on Outsourcing - 2014 – 2004 • Consultation Paper on Guidelines on Outsourcing – 2014 • Business Continuity Management guidelines – 2013 • SRD TR 01/2011 – Information technology outsourcing Indonesia • Law of The Republic of Indonesia No. 11 of 2008 Concerning Electronic Information And Transactions • OJK No. 1/POJK.05/2015 Risk Management in Non- Bank Financial Services • No. 9/15/PBI/2007 Implementation of Risk Management in the Use of Information Technology by Commercial Banks © 2016 Deloitte & Touche Enterprise Risk Services Pte Ltd 7 Organizations are spending more money and paying Organizations spent more attention than $75.4 billion they ever have … on information security in … but for many 2015 the problem according to Gartner seems to be getting worse. © 2016 Deloitte & Touche Enterprise Risk Services Pte Ltd 8 Moving into digitization World Economic Forum report Glimpsing the future The Future of Financial Services: How disruptive innovations are reshaping the way financial services are structured, provisioned and consumed An Industry Project of the Financial Services Community | Prepared in collaboration with Deloitte © 2016 Deloitte & Touche Enterprise Risk Services Pte Ltd 10 What’s the deal? Is cyber security a consideration in your plans innovate? © 2016 Deloitte & Touche Enterprise Risk Services Pte Ltd 11 Failures & challenges © 2016 Deloitte & Touche Enterprise Risk Services Pte Ltd 12 Failure & challenges Failure to include security as part of the design principles Businesses demand features, function and time to market Addressing the incident and failing to detect the campaigns Perpetrators strategise and take a longer term view Dont miss the forest for the trees. Shortage of competent cyber security professionals Demand is outstripping supply. Willingness to accept non security IT professionals as ‘replacements’. Ineffective threat analytics Use of technology with limited data sets and arcade rules sets. Limited value owing to the rush to implement and lacking integration. © 2016 Deloitte & Touche Enterprise Risk Services Pte Ltd 13 Cyber Security 3.0 © 2016 Deloitte & Touche Enterprise Risk Services Pte Ltd 14 Building a resilient cyber security organization This means having the agility to prevent, detect and respond quickly and effectively, not just to incidents, but also to the consequences of the incidents Secure Vigilant Resilient Are controls in place to guard Can we detect malicious or Can we act and recover quickly to against known and emerging unauthorized activity, including minimize impact? threats? the unknown? Cyber governance Cyber threat Cyber threat Cyber incident intelligence mitigation response © 2016 Deloitte & Touche Enterprise Risk Services Pte Ltd 15 Cyber security design 5 design principles Design principles: everything is a potential threat Build the requirement of security as a core. Actionable intelligence: threat-centric defense Correlation and inductive technique required. Look beyond just security data. Revamp information sharing Pepetrators share intelligence to effectively compromise organisation. Why aren’t organisations sharing information about pepetrators? There is a need for situation awareness. Automation: what and how The shortage will continue. Tools and automation exist to create accuracy. 里应外合 – Combating the issue together Internal cyber security, external cyber security providers, vendors. © 2016 Deloitte & Touche Enterprise Risk Services Pte Ltd 16 Cyber Security Trends The Integrity Conundrum Business Security Integrity is the forgotten security Establishing security researchers domain. Maintaining the integrity of across the business units that data, business process, and people handle sensitive data (seen in big is going to be increasingly critical. Tech companies to increase agility). Live-Fire Exercises People Are Key Conducting sophisticated APT style Embedding the psychology of attacks, emulation and cyber range security in the business and finding testing against critical systems and the right SecOps analysts will be people assets. key for on-going management of cyber risk. Defining Normal Collaborative Security Establishing
Load more

Recommended publications
  • Business Analytics
    SPRING 2017 Business Analytics Meeting the need for talent. PAGE 4 VIRGINIA TECH BUSINESS is published twice a year by: RANKINGS Pamplin College of Business, Virginia Tech No. 2 1030 Pamplin Hall (0209) U.S. 880 West Campus Drive Blacksburg, VA 24061 540-231-6601 No. 2 No. 7 No. 6 World www.pamplin.vt.edu Master of Evening Hospitality and Address changes: [email protected] Information Technology MBA Tourism Management Editorial inquiries and story suggestions: [email protected] U.S. News & World Report QS Top Universities In this magazine, alumni, with some exceptions, are DONNIE GRAY identified by degree and the year it was received. VIRGINIA TECH’S EVENING MBA ranking in U.S. News & World Report has improved DEAN to No. 7 among the nation’s part-time Robert T. Sumichrast MBA programs, according to the 2018 EDITOR survey released in March. It was ranked Sookhan Ho No. 16 for the previous two years. Offered DESIGN by the Pamplin College of Business, the Uncork-it, Inc. Evening MBA program serves aspiring FEATURE WRITERS business leaders in the Washington, D.C., Sookhan Ho, Dan Radmacher area with classes taught at the Northern PHOTOGRAPHERS Virginia Center, and has seen significant STUDENTS such as Mala Lal balance work, Christina O’Connor, Jim Stroup, Logan Wallace, growth in recent years. study, and family in the highly ranked Evening Oliver Meredith MBA program. ALUMNI INFORMATION Gina French, Bonnie Gilbert DISTRIBUTION MANAGER Jodi Jennings Charles Schwab Financial Planning Suite ABOUT enhances learning for business students Virginia Tech’s nationally ranked Pamplin College of JIM STROUP Business offers undergraduate and graduate programs in accounting and information systems, business information technology, economics, finance, hospitality and tourism management, management, and market- ing.
    [Show full text]
  • Technical Education Landscape in the UAE: Qualifications & Opportunities
    Technical Education Landscape in the UAE: Qualifications & Opportunities GLOBAL INNOVATIONS 2013 – DOHA, QATAR Sajida H. Shroff, April 2013 Agenda • Executive Summary • UAE Parameters for Technical Education • Current Status of TECH Education in the UAE • Enrollment Growth in Vocational/Technical/Career Track Education in the UAE • UAE’s Regulatory Landscape • Proposed and (sample) Private Qualifications Frameworks in the UAE • Current Career Track Training Options in the UAE • Public and Private Providers • Gaps and Potential Programmes • Next Steps • Potential Impact • Appendices: Sources Technical Education Landscape in the UAE- updated 04Apr13 2 Executive Summary The Technical (TECH) Landscape Study identifies the current status, prospects and challenges related to the expansion of TECH offerings in Dubai • There is a need for expanded Vocational/Technical Educational Programmes in Dubai to serve the UAE and the Region • Programmes would primarily serve the Expatriate population as there is sufficient capacity for the National population • The key target market is high school graduates from the UAE and the Region who DON’T/CAN’T go to university • To mitigate the identified skills gap, the focus of VTECH Education in the UAE needs to be on ‘white collar’ “career track opportunities” • In order for these career track programmes to have credibility, a qualifications framework aligned with global best practices and enabling transferability of qualifications is necessary • Due to the negative perception surrounding Vocational/Technical Education in this region as well as current labor market practices (i.e. importing blue collar workers) – VTECH Education needs to be repositioned in the UAE Technical Education Landscape in the UAE- updated 04Apr13 3 UAE’s parameters for Technical Education & Training (TECH) have to take into account regional nuances so they should be different from the global understanding; i.e.
    [Show full text]
  • The Top 10 Biggest Data Breaches of 2015 | Digital Guardian Page 1 of 8
    The Top 10 Biggest Data Breaches of 2015 | Digital Guardian Page 1 of 8 CONTACT US • SUPPORT • BLOG • PARTNERS PRODUCTS SOLUTIONS SERVICES RESOURCES ABOUT HOME BLOG The Top 10 Biggest Data Breaches of 2015 Wednesday January 13, 2016 By Nate Lord 64 Here’s a look back at the top ten biggest data FOLLOW US: breaches in 2015. 17 2015 was yet another year of massive data breaches, with an increase of 193149 reported incidents from 2014’s total. If these numbers are any indication, 2015 could surpass 2014’s record of 1 billion records exposed from data breaches. While the smoke clears and the dust settles, here’s a New 2016 roundup1 of the ten biggest data breaches last year, by total records lost. Gartner DLP Share Magic Quadrant Digital Guardian is a 10. Excellus BlueCross BlueShield Discovers Leader in the 2016 Magic Two-Year-Old Compromise that Exposed Quadrant for Data Loss Prevention. Read the Information on 10 Million Customers report to to understand how DLP solutions have evolved to provide advanced data protection. Download the report RELATED ARTICLES Stand By Me The Court has turned the Remijas v. Neiman Image via Mike Greenlar. Marcus Group, LLC. case into gold with its ruling; In August, healthcare provider Excellus uncovered a series of successful cyber attacks dating back as far as December 2013. The attacks were read this blog post to detected in a forensic investigation conducted in response to the number learn what the Court has of recent breaches and attacks that targeted other healthcare companies done to do so.
    [Show full text]
  • The Deloitte Global 2021 Millennial and Gen Z Survey
    A call for accountability and action T HE D ELO IT T E GLOB A L 2021 M IL LE N N IA L AND GEN Z SUR V E Y 1 Contents 01 06 11 INTRODUCTION CHAPTER 1 CHAPTER 2 Impact of the COVID-19 The effect on mental health pandemic on daily life 15 27 33 CHAPTER 3 CHAPTER 4 CONCLUSION How the past year influenced Driven to act millennials’ and Gen Zs’ world outlooks 2 Introduction Millennials and Generation Zs came of age at the same time that online platforms and social media gave them the ability and power to share their opinions, influence distant people and institutions, and question authority in new ways. These forces have shaped their worldviews, values, and behaviors. Digital natives’ ability to connect, convene, and create disruption via their keyboards and smartphones has had global impact. From #MeToo to Black Lives Matter, from convening marches on climate change to the Arab Spring, from demanding eco-friendly products to challenging stakeholder capitalism, these generations are compelling real change in society and business. The lockdowns resulting from the COVID-19 pandemic curtailed millennials’ and Gen Zs’ activities but not their drive or their desire to be heard. In fact, the 2021 Deloitte Global Millennial Survey suggests that the pandemic, extreme climate events, and a charged sociopolitical atmosphere may have reinforced people’s passions and given them oxygen. 01 Urging accountability Last year’s report1 reflected the results of two Of course, that’s a generality—no group of people is surveys—one taken just before the pandemic and a homogeneous.
    [Show full text]
  • Episode 230: Click Here to Kill Everybody
    Episode 230: Click Here to Kill Everybody Stewart Baker: [00:00:03] Welcome to Episode 230 of The Cyberlaw Podcast brought to you by Steptoe & Johnson. We are back and full of energy. Thank you for joining us. We're lawyers talking about technology, security, privacy, and government. And if you want me to talk about hiking through the rain forest of Costa Rica and just how tough my six-year-old granddaughter is, I'm glad to do that too. But today I'm joined by our guest interviewee Bruce Schneier, an internationally renowned technologist, privacy and security guru, and the author of the new book, Click Here to Kill Everybody: Security and Survival in a Hyper-Connected World. We'll be talking to him shortly. For the News Roundup, we have Jamil Jaffer, who's the founder of the estimable and ever-growing National Security Institute. He's also an adjunct professor at George Mason University. Welcome, Jamil. Jamil Jaffer: [00:00:57] Thanks, Stewart. Good to be here. Stewart Baker: [00:00:58] And David Kris, formerly the assistant attorney general in charge of the Justice Department's National Security Division. David, welcome. David Kris: [00:01:07] Thank, you. Good to be here. Stewart Baker: [00:01:08] And he is with his partner in their latest venture, Nate Jones, veteran of the Justice Department, the National Security Council, and Microsoft where he was an assistant general counsel. Nate, welcome. Nate Jones: [00:01:23] Thank you. Stewart Baker: [00:01:25] I'm Stewart Baker, formerly with the NSA and DHS and the host of today's program.
    [Show full text]
  • Improving PKI Solution Analysis in Case of CA Compromisation
    Master Game and Media Technology Improving PKI Solution analysis in case of CA compromisation Samira Zaker Soltani January 2013 Utrecht University Faculty Computer Science Deloitte Nederland Deloitte Risk Services Supervisors: Gerard Tel - Univeristy Utrecht Henk Marsman - Deloitte Nederland To my mother, for she is the reason. Abstract Creating a secure connection on the Internet is made possible through the usage of certificates, binding an entity to its public key. These certificates can be issued by any of the Certificate Authorities (CA), where each CA has the same privileges. During the last year, we have seen many CA compromises, resulting into the issuance of fraudulent certificates. Fraudulent certificates can be used, in combination with the man-in-the-middle attack, to eavesdrop the communications of Internet users. This research focuses on solutions that can remove or limit the impact of a CA com- promisation and provides a description and analysis of each solution. The solutions have been chosen through interviews and literature. Among the discussed solutions are Public Key Pinning, Sovereign Keys, Certificate Transparency, Perspectives & Convergence, DANE, and MCS. In order to identify each solution’s advantages and disadvantages, we have created a metric of aspects. The aspects have been categorized into security, usability, and costs. The focus of this research has been on security, since that is the aspect in Public Key Infrastructure we are trying to solve. The results indicate that Certificate Transparency and DANE are the most promis- ing solutions for limiting the risks of a compromised CA. Further research will be needed to complete each solution, since both solutions are not yet ready for deploy- ment.
    [Show full text]
  • Core Renaissance: Revitalising the Heart of IT
    ChapterUK extractEdition Core renaissance Revitalising the heart of IT Tech Trends 2015: The fusion of business and IT B Core renaissance Core renaissance Revitalising the heart of IT Organisations have significant investments in their core systems, both built and bought. Beyond running the heart of the business, these assets can form the foundation for growth and new service development – building upon standardised data and automated business processes. To this end, many organisations are modernising systems to pay down technical debt, replatforming solutions to remove barriers to scale and performance, and extending their legacy infrastructures to fuel innovative new services and offerings. NVESTING in technologies that support Leading organisations are building a Ithe heart of the business has been IT’s roadmap for a renaissance of their core – emphasis since its earliest days – policy focussed not on painting their legacy as the administration, claims management, and “dark ages,” but on revitalising the heart of billing in insurance; order management, their IT and business footprint. resource planning and manufacturing for consumer and industrial products; Business first inventory management, pricing and Amid continuously evolving business distribution for retail; and universal needs pressures and technology trends, several such as finance and human resources. questions arise: How will the core hold up? Core systems drive process and data (Consider, first, the business angle.) How automation, standardisation and intelligence well do existing solutions meet today’s – and represent decades of investment needs? (Consider not just functional in buying packages, building custom completeness, but increasingly relevant solutions and integrating an increasingly dimensions like usability, analytics insights hybrid environment.
    [Show full text]
  • A Roadmap to Initial Public Offerings
    A Roadmap to Initial Public Offerings 2019 The FASB Accounting Standards Codification® material is copyrighted by the Financial Accounting Foundation, 401 Merritt 7, PO Box 5116, Norwalk, CT 06856-5116, and is reproduced with permission. This publication contains general information only and Deloitte is not, by means of this publication, rendering accounting, business, financial, investment, legal, tax, or other professional advice or services. This publication is not a substitute for such professional advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified professional advisor. Deloitte shall not be responsible for any loss sustained by any person who relies on this publication. As used in this document, “Deloitte” means Deloitte & Touche LLP, Deloitte Consulting LLP, Deloitte Tax LLP, and Deloitte Financial Advisory Services LLP, which are separate subsidiaries of Deloitte LLP. Please see www.deloitte.com/us/about for a detailed description of our legal structure. Certain services may not be available to attest clients under the rules and regulations of public accounting. Copyright © 2019 Deloitte Development LLC. All rights reserved. Other Publications in Deloitte’s Roadmap Series Business Combinations Business Combinations — SEC Reporting Considerations Carve-Out Transactions Consolidation — Identifying a Controlling Financial Interest Contracts on an Entity’s Own Equity
    [Show full text]
  • 858003 Getting Unstuck Working As One in Government
    Getting Unstuck How to work As One in government A GovLab study About GovLab Deloitte’s GovLab works closely with senior government executives and thought leaders from across the globe. As GovLab Fellows, we conduct research into key issues and emerging ideas shaping the public, private and non-profit sectors. Through exploration and analysis of government’s most pressing challenges, we seek to develop innovative yet practical ways that governments can transform the way they deliver their services and prepare for the challenges ahead. As used in this document, “Deloitte” means Deloitte Consulting LLP, a subsidiary of Deloitte LLP. Please see www.deloitte.com/us/about for a detailed description of the legal structure of Deloitte LLP and its subsidiaries. Certain services may not be available to attest clients under the rules and regulations of public accounting. Contents 1 Executive summary 2 Why does government need As One thinking? 4 A new approach 8 Getting unstuck: Seeing through the As One lens 21 Putting As One to work: Interventions 23 Broaden perspectives with social media monitoring 24 Conclusion Executive summary Why do some transformative government initiatives tools at their disposal to answer those questions, they can succeed on a grand scale while others fail? The answer antici pate challenges and address them before they grow lies in the abilities of agencies to translate individual into crippling obstacles. actions into collective power. Getting big things done in government requires employees and organizational The identity of a government organization, its commitment partners to commit to a single set of objectives. Working to an initiative’s objectives, and the way its employees cultures should match what needs to be done.
    [Show full text]
  • The Changing Face of Cyber-Attacks: Understanding and Preventing Both External and Insider Security Breaches
    WHITE PAPER | June 2013 The Changing Face of Cyber-Attacks: Understanding and preventing both external and insider security breaches Russell Miller CA Security Management PROTECT AGAINST INSIDER THREATS AND EXTERNAL ATTACKS Table of Contents Executive Summary 3 Section 1: Challenge 4 External Cyber-Threats are Changing Rapidly Section 2: Opportunity 7 Where Organizations Fall Short Section 3: 12 Conclusions Section 4: 12 Refernces Section 5: 13 About the Author 2 PROTECT AGAINST INSIDER THREATS AND EXTERNAL ATTACKS Executive Summary Total number of records containing Challenge sensitive personal Techniques to attack computer networks are never static. Methods and tools evolve, as do the information attackers themselves. The attacker landscape from a few years ago—where individuals or small involved in groups attacked organizations for fun and profit—no longer exists. The environment is much more security breaches complex today. Semi-organized “Hacktivist” groups, such as Anonymous and LulzSec, attempt to in the U.S. is cause damage for causes they find worthwhile. Even state-sponsored actors are becoming prominent, 607,611,003 bringing dramatically expanded resources to bear. Advanced Persistent Threats (APTs) are perhaps not in 3,716 data new, but have come to the forefront of cyber-security awareness as a result of these changes. Insider breaches between threats are also ever more complex, with the potential for damage increasing due to rapidly January 2005 expanding stores of sensitive information and highly-dynamic and virtualized IT environments. and April 2013. – A Chronology of Data Breaches, Privacy Rights Clearinghouse Opportunity Fortunately, an organization’s toolbox to defend against security breaches is more complete than ever.
    [Show full text]
  • Information Security Survey
    Central Asian Information Security Survey Results (2014) Insight into the information security maturity of organisations, with a focus on cyber security Introduction and Executive summary From September to November 2014 Deloitte performed its first “information security Executive summary survey” in Central Asia to better understand the current state of information security The survey identified the five most relevant conclusions on the current state of programmes and governance structures at organisations in the region. The survey information security programmes (cyber security) in Central Asia, as follows: covers various industries and addresses how organisations view, formulate, implement and maintain their information security programmes. 1. Majority of companies have not been exposed to cybersecurity incidents. The 39 survey questions covered the following areas: 2. Information security policies, procedures and responsibilities are mostly in place and defined. 1. organisational information 3. Insufficient controls to ensure third parties, (i.e. vendors / partners), comply with 2. information security attacks and threats appropriate security standards. 3. information security data and technologies and 4. Awareness of business (senior) management and end-user around 4. monitoring and reaction to identified security threats cybersecurity risks is insufficient. The survey focused on cyber security risks and to that end we approached 5. Though basic security measures are in place, more advanced solutions are approximately 100 companies to fill in the online survey questionnaire. uncommon. We stipulate that we present the survey results without making a distinction by Later in this report we provide more detailed insight on survey findings. industry or organisation size and that the results are ‘anonymous’ to avoid making reference to individual organisations.
    [Show full text]
  • SONY Pictures Entertainment - Hack of the Century 1
    SONY Pictures Entertainment - Hack of the Century 1 SONY Pictures Entertainment - Hack of the Century SONY Pictures Entertainment - Hack of the Century 2 Submitted to the 2016 Arthur Page Society Case Study Competition Table of Contents Executive Summary ............................................................................................................................................... 3 Hacking Overview ................................................................................................................................................. 3 Guardians of Peace ........................................................................................................................................... 3 The Interview .................................................................................................................................................... 4 Sony Inc. ................................................................................................................................................................ 4 Sony Background .............................................................................................................................................. 4 Sony Pictures Entertainment ............................................................................................................................ 4 Sony Pictures Entertainment Market ................................................................................................................... 5 Market and Industry Analysis
    [Show full text]