Real Life Information Security

Real Life Information Security Embedding security in economic reality [email_address]

Hewitt Associates ,[object Object],[object Object],[object Object]

H ewitt’s Market ,[object Object],[object Object],[object Object],[object Object],[object Object]

Security - Shepherds or policemen? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Learn f rom the past ,[object Object]

Learn f rom market analytics ,[object Object],[object Object],[object Object],[object Object],Source: Ponemon Institute, „2008 Annual Study: Cost of Data Breach”

Learn f rom others’ mistakes Source: FSA, 22 July 2009

Learn f rom Your r isk a nalysis ,[object Object],[object Object]

When Risk Management makes sense? ,[object Object],Source: Flickr (edou а rd)

What makes Control cost? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Source: Flickr (d а veme)

Risk Analysis -> Potential loss -> Control -> Real loss  Wrong but common scenario...

Qualified Certificate in ZUS* ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Source: Money.pl, ZUS * ZUS = Polish public pensions provider

Invoicing ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Sources: EU MEMO/00/85

E-Invoicing in Europe ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Sources: EEI 2007, ITST, OECD; GUS 2008

Risk Management in e-banking Source: Bankier.pl report, October 2009 (selected data only) ↓ Repudiation ↓ Low security, ↑ Low cost 7 TAN ↑ Non-repudiation ↓ Not usable, ↓ Big cost 2 Smart - card ↓ Repudiation ↓ Big cost 11 Token ↓ Repudiation ↑ Usable, ↓ Big cost 15 SMS High non-repudiation needs Millions of clients Auth method Corporate Individual Number

Laffer’s curve in security Source: Wikipedia

Mayfield’s Paradox Source: ISACA, „ Mathematical Proofs of Mayfield's Paradox ”, 2001

Avoid „ o ne-size fits all” approach

Control questions ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Is security a cost? ,[object Object],[object Object],[object Object],[object Object]

How FDE * saves money ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],* FDE = Full-Disk Encryption

Source: Willem Duiff, GE (SASMA 2009)

Building a consistent security policy #1 ,[object Object],[object Object],[object Object],[object Object],[object Object],Source: Flickr ( а resnick)

Building a consistent security policy #2 ,[object Object],[object Object],[object Object],[object Object],[object Object],Source: Wikipedia

Building a consistent security policy #3 ,[object Object],[object Object],[object Object],[object Object],[object Object]

Things we learned when talking to business ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

[object Object],[object Object],[object Object]

Real Life Information Security

Recommended

Recommended

More Related Content

Viewers also liked

Viewers also liked (6)

Similar to Real Life Information Security

Similar to Real Life Information Security (20)

More from Pawel Krawczyk

More from Pawel Krawczyk (20)

Recently uploaded

Recently uploaded (20)

Real Life Information Security