Cyber security uddhav phondba-cwin18_india

CW
IN
CAPGEMINI
WEEK OF
INNOVATION
NETWORKS
CyberSecurity
Uddhav Phondba, Mumbai, 26 Sep 2018

CWIN18: Cyber Security | Uddhav Phondba | 26/09/18 © 2018 Capgemini. All rights reserved. 2© 2018 Capgemini. All rights reserved.
We have all
heard about
Security

CWIN18: Cyber Security | Uddhav Phondba | 26/09/18 © 2018 Capgemini. All rights reserved. 3
Designing Security

Implementing Security

Enforcing Security

Cybersecurity is such a MONSTER!!!

Or is it really so?

Let’s find out…
Or is it really so?

Cybersecurity – the definition as per ISO/IEC 27032:2012
Cyberspace Security
The complex
environment resulting
from the interaction
of people, software
and services on the
Internet by means of
technology devices
and networks
connected to it, which
does not exist in any
physical form.
“Preservation of
Confidentiality,
Integrity and
Availability of
Information” in
Cyberspace
Cybersecurity

Cyberspace Security
The complex
of people, software
and services on the
technology devices
and networks
physical form.
“Preservation of
Confidentiality,
Integrity and
Availability of
Information” in
Cyberspace
Cybersecurity
CIA
TRIAD

Cyberspace Security
The complex
of people, software
and services on the
technology devices
and networks
physical form.
“Preservation of
Confidentiality,
Integrity and
Availability of
Information” in
Cyberspace
Cybersecurity
The standard is actually about “Information security” in Cyberspace
CIA
TRIAD

How do we
implement
Information
Security?

NIST Cybersecurity Framework - a high level taxonomy of cybersecurity
outcomes and a methodology to assess and manage those outcomes
•Asset Management
•Business Environment
•Governance
•Risk Assessment
•Risk Management
Strategy
Identify
•Access Control
•Awareness and Training
•Data Security
•Info Protection
Processes & Procedures
•Maintenance
•Protective Technology
Protect
•Anomalies and Events
•Security Continuous
Monitoring
•Detection Processes
Detect
•Response Planning
•Communications
•Analysis
•Mitigation
•Improvements
Respond
•Recovery Planning
•Improvements
•Communications
Recover
1 2 3
4 5

ISO/IEC 27001:2013 – Annex A Controls
A.5 Information
security policies
A.6 Organization of
information security
A.7 Human resource
security
A.8 Asset management
A.9 Access control A.10 Cryptography
A.11 Physical and
environmental security
A.12 Operations
security
A.13 Communications
security
A.14 System
acquisition,
development and
maintenance
A.15 Supplier
relationships

Implementation of Information Security
By implementing Security Controls
that form Defense against Threats
Technical
Management System

Network
Host
Application
Data
Technical
Management System
Technical
Controls

Network
Host
Application
Data
Technical
Management System
Focus of this session is on
the Technical Controls
Technical
Controls

Network
Host
Application
Data
Technical
Management System
Focus of this session is on
the Technical Controls
Technical
Controls
How do we know that the controls are adequate and working?

Validation of Application Security
Vulnerability Assessment and Penetration Testing ( VAPT)
- To identify vulnerabilities
- To ensure on a regular basis that the security controls are working
Vulnerability Scanning
- Examines the exposed assets (network, server, applications) for vulnerabilities
Penetration testing
- Looks at vulnerabilities and will try and exploit them.

What value do I get from Penetration Testing?
1. Validate your controls
2. Prioritize your risks.
3. Train developers to make fewer
mistakes
4. Uncover holes in your security.
5. Determine the feasibility of attack
vectors.
6. Justify security investment/tools
7. Meet compliance requirements
8. Post Incident analysis
9. Improve Security response time
10. Bring synergy between Dev and
Ops teams

When should the Penetration testing be done?
After deployment of new infrastructure
After deployment of new application
After major change to infrastructure (e.g. changes
to firewall rules, updating of firmware, patches)
After major change to application (e.g. upgrades
to softwares, code changes)

What do the Penetration Tests check for?

What do the Penetration Tests check for?
OWASP Top 10 - 2017
A1:2017 -
Injection
A2:2017 -
Broken
Authentication
A3:2017 -
Sensitive Data
Exposure
A4:2017 - XML
External Entities
(XXE)
A5:2017 -
Broken Access
Control
A6:2017 -
Security
Misconfiguration
A7:2017 -
Cross-Site
Scripting (XSS)
A8:2017 -
Insecure
Deserialization
A9:2017 - Using
Components
with Known
Vulnerabilities
A10:2017 -
Insufficient
Logging &
Monitoring

Ways to get Penetration Testing done

Open up your application to entire world1

Get the client to conduct penetration tests and act on findings once
report is received2

report is received2
Pay an external vendor or Capgemini Sogeti to carry out the Pen test3

report is received2
Pay an external vendor or Capgemini Sogeti to carry out the Pen test3
Do it yourself !!!???4

OWASP Zed Attack Proxy(ZAP) : one of the world’s most
popular free security tools
Open Source freeware supported by a strong community
User-friendly penetration testing tool that finds vulnerabilities in web apps.
Provides automated scanners and a set of tools for those who wish to find
vulnerabilities manually
Ideal for functional testers who are new to pen testing, or for developers
Supports Selenium integration; you can run Selenium tests through ZAP
Official ZAP plugin for the Jenkins continuous integration and delivery application
Sonarqube plugin for publishing ZAP results

What do you achieve?
Assurance that security controls are adequate and working1
No major findings in client initiated penetration tests.2
No sleepless nights fixing security defects just before production
release3
No additional costs!!4

CWIN18: Cyber Security | Uddhav Phondba | 26/09/18 © 2018 Capgemini. All rights reserved. 33Presentation Title | Author | Date © 2018 Capgemini. All rights reserved.
Image Credits
1. www.dilbert.com
2. www.thesecurityawarenesscompany.com/wp-content/uploads/2015/05/CIAtriad-
copy2.png
3. https://pixabay.com/en/cyber-security-word-computer-cloud-2120014/
4. https://depositphotos.com/31528535/stock-video-unstressed-businessman-
relaxing-on-the.html

CWIN18: Cyber Security | Uddhav Phondba | 26/09/18 © 2018 Capgemini. All rights reserved. 34Presentation Title | Author | Date © 2018 Capgemini. All rights reserved.
uddhav.phondba@capgemini.com
Uddhav Phondba
Senior Architect, Program Manager
Digital Customer eXperience
+91 22 6944 4001 – Extn 228 4267
https://www.linkedin.com/in/uddhavphondba/
About me

CWIN18: Cyber Security | Uddhav Phondba | 26/09/18 © 2018 Capgemini. All rights reserved.
This message contains information that may be privileged or confidential and is
the property of the Capgemini Group.
Copyright © 2018 Capgemini. All rights reserved.
A global leader in consulting, technology services and digital transformation, Capgemini is
at the forefront of innovation to address the entire breadth of clients’ opportunities in the
evolving world of cloud, digital and platforms. Building on its strong 50-year heritage and
deep industry-specific expertise, Capgemini enables organizations to realize their business
ambitions through an array of services from strategy to operations. Capgemini is driven
by the conviction that the business value of technology comes from and through people.
It is a multicultural company of 200,000 team members in over 40 countries. The Group
reported 2017 global revenues of EUR 12.8 billion.
About Capgemini
Learn more about us at
www.capgemini.com

Cyber security uddhav phondba-cwin18_india

Recommended

Recommended

More Related Content

More from Capgemini

More from Capgemini (20)

Recently uploaded

Recently uploaded (20)

Cyber security uddhav phondba-cwin18_india