CRITICAL INFRASTRUCTURE PROTECTION - NYS Forum.PPTVIP

Performing a Cyber Security Risk Assessment Cyber Security Workshop Joint Partnership between MS-ISAC and DHS US-CERT Coordinated through the New York State Office of Cyber Security and Critical Infrastructure Coordination and the New York State Forum 94 Federal Government 491 State Government 117 Local Government 145 Academia, non-profit Accenture ATT Aon Computer Associates CDW-G CGI CMA DD Consulting Ernst Young Gartner HP IIC Jay Dee Systems Keane Microsoft Nortel Networks Novell NYSTEC Oracle SAIC SAS Sybase Symantec Veritas Introduction and Opening Remarks William Pelgrin, Chair of the Multi-State ISAC; Director, New York State Office of Cyber Security and Critical Infrastructure Coordination Lawrence C. Hale, Deputy Director, National Cyber Security Division, US CERT, Department of Homeland Security Performing a Cyber Security Risk Assessment Graeme Payne, CA, CISSP, CISM, CISA; Partner, Security Technology Solutions, Ernst Young Rick Trapp, Vice President, Product Management, Computer Associates Today’s Objectives Identify reasons for performing a CyberSecurity Risk Assessment Identify key components of a CyberSecurity Risk Assessment Understand considerations in performing a CyberSecurity Risk Assessment Today’s Agenda Developing a Common Language Why Perform Cyber Security Assessments? When to perform a CyberSecurity Risk Assessment? How to perform a CyberSecurity Risk Assessment QA Developing a Common Language What is a Risk Assessment? Definitions Why Perform CyberSecurity Risk Assessments? The Need for CyberSecurity Risk Assessments Reported vulnerabilities rose from 417 in 1999 to 3,784 in 2003 (CERT Coordination Center) 2004 CSI/FBI Computer Crime and Security Survey respondents reported nearly $142 million in total losses as a result of computer security incidents Objectives of a CyberSecurity Risk Assessment Baseline Where am I today? What controls do I have in place? Evaluate effectiveness of security controls Where do I want to