Daily Learning - Day 62

Date: 26th July 2017

Follow Hashtag: #SKC100DaysofLearning

Topic: Security Testing

Webinar Notes:  Create a custom security strategy for your organisation by PluralSight


Access the Risk:

1. STRIDE
2. DREAD
3. Third Party Assessments

Prioritize the Risk:
1. Penetration and Vulnerability

• OWASP

2. Indepedent Certification

3. Training & Awareness

• Basic training is important for members in organisation.
• Basic security courses needs to be provided to team members as awareness.

4. Focus

• As organisation, OPS Team should be developed as a team to focus only on security.
• And aligns with company culture, business strategy. [CSO - Chief Security Officer]
• Is your Executive team focus on security.

Frameworks:

• ISO 
• NIST
• ITIL
• TOGAF - Total Group Architecture Foundation 
• SABSA

Security Risk Score:

• Risk Management & Oversight
• Security Monitoring
• Threat & Vulnerability Management
• Security Controls

This helps to focus on a Security Road Map. Continue to evaluate and make adjustments to plan.

BEST LAID PLANS:
Things to look for in your systems:

1. Changes to state events

•  CPU Usage
•  Disk Space
•  Network Utilisation
•  Log events and size

2.  Customer Support Issues

• Have basic training on customer issues and whom they need to redirect the issues to

3. Malicious Traffic

4. Acceptable Use Violations

5. Intrusion Detection Systems

INCIDENT RESPONSE PLAN

1. IDENTIFY THE TEAM

• Information Security Team
• Legal 
• Support
• Communications /Marketing Team

2.  INFOSEC INVESTIGATION/RESPONSE PLAN

• Detection and Discovery
• Analysis and Assessment
• Risk Mitigation Strategy
• Escalation Process, Communication within the team/rest of team.

3. Communication Process

• What Constitutes a breach that requires external communication
• Who should be Notified - Customers/Public
• Who communicates Externally 
• What channels to communicate by
• Communications

4. Maintain Incident Response Records

• What 
• When
• Where
• Who detected, escalated and responded

Finally Some Advice:

• Disclose Early, Leverage Social Media
• Protect Accounts Immediately
• Be clear, Honest, Lead with the Facts
• Be Specific.
• Explain what actually happened
• Keep Customers Updated.
• Apologise

References:
1. SSCP : Jason Helmick
2. Web security & OWASP - Troy hunt
3. Enterprise Security: Policies, Practices & Procedures - Dale Meredith
4. Tesla Security Vulnerability Reporting Policy
5. Owasp.org