IT Governance Business Case Technology Solutions Cyber Security Program Enhancement
Background on Cyber Security Program 1st Quarter FY19 – • Procured new security tools (Tenable.io, ForeScout CounterACT) • Conducted 1st Security Awareness Training Campaign (Email Security & Phishing) 2nd Quarter FY19 – • Hired Senior Cyber Security Analyst • Lab Testing Tenable.io Vulnerability Management • Lab Testing ForeScout CounterACT Network Access Control • Successfully defended against and minimized the impact of a major malware attack (Emotet) with a coalition of resources (internal/external) • Updated McAfee – Antivirus/Malware Detection • Implemented Advanced Threat Hunting capability with Huntress – Breach Detection/Eradication 3rd Quarter FY19 – • Conducting Cyber Security Gap Analysis (Phase 1) • Completing lab testing of Tenable.io and ForeScout CounterACT; developing deployment strategy • Implementation of Huntress and additional remediation strategies, minimized impact of 2nd malware attack (TrickBot) • Additional enterprise security controls being tested and implemented to aid in continuous monitoring
Current State IT Policies and Procedures due for review, revisions and updates. Additional human capital is needed to support cyber security program. Our current enterprise security architecture is outdated for today’s evolving cyber threat landscape. It was developed 10 years ago. Current security tools while providing key value have limited visibility across network: Tenable.io – Vulnerability management ForeScout CounterACT – Network Access Control McAfee – Antivirus/Malware Detection Huntress – Breach Detection/Eradication Netwrix Auditor – Auditing/Compliance Network Devices (IDS/IPS) require skilled security engineers
Security Awareness Training platform is currently operational but
needs a focused resource
Current Pain Points • Limited in-house cyber security analysts and security engineers to provide analytical and engineering support for program. • Limited network security visibility with current cyber security resources and tools. • Lack of best practice separation of security duties.
Project Objectives to Address Pain Points
Major Objective: Develop a comprehensive cyber security program utilizing best-of-breed cyber security framework that embraces Information Security Governance and Risk Management with the following principles in a multi-year program development strategy: o o o
Year 1 – Establish Cyber Security Framework, Conduct Cyber Security Gap Analysis (Cyber Security Context and Leadership; Evaluation and Direction, and Compliance, Audit and Review) - Current FY Year 2 – Establish Security Operations Center (SOC) Services *(Identification and Prevention, Detection, Response and Recovery) Year 3 – Fully implement a Cyber Security Program Measurement Initiative (Metrics Program and Continuous Monitoring and Improvement)
*Addresses 2018 Security Audit Critical Finding
BEST PRACTICE ADAPTIVE SECURITY ARCHITECTURE
Future State • A multi-year strategy to fully implement a Cyber Security Program that supports an adaptive security architecture for the City of Durham’s Cyber Security Division • Improved external partnerships and collaboration through the use of a Managed Security Services Provider (MSSP), Center for Internet Security (CIS) and Multi-State Information Sharing and Analysis Center (MS-ISAC) cyber security resources and services
Future State Benefits • Improved Cyber Security posture for the City of Durham • Reduced overall risk from cyber threats facing the City of Durham • Scalable best of breed cyber security framework utilizing Managed Security Services Provider (MSSP) and the MS-ISAC resources • Improved budget forecasting with right-sized cyber security support and services for the City of Durham
Cyber Security Program Comparative Analysis – Sister Cities & Municipalities Cyber Security Program Comparative Analysis - Enterprise Security Architecture
City of Durham
Durham County
City of Greensboro
Overall Maturity Level: 1.5
Overall Maturity Level: 2.1
Overall Maturity Level: 4
< 1 year
1.5 years
5 years
Staffing Levels: FTE/Contractor?
1 FTE
1 FTE
3 FTE
Number of Employees?
2,700
1,900
4,000
No
Augmented FW Services (Dell SecureWorks)
No
$342,877
$802,203
$914,676
Cyber Security Program Age of Program or Role?
Managed Security Services Provider?
Estimated or Approved Cyber Security Program Budget
Cyber Security Program Comparative Analysis – Sister Cities & Municipalities
Cyber Security Program Comparative Analysis - Enterprise Security Architecture
Security Architecture Tools/Services
City of Durham
Overall Maturity Level: 1.5
Perimeter Security
1. FW: Cisco ASA (x2) 2. IDS/IPS: McAfee Maturity Level: Level 1
Network Security
1. Datacenter FW: FatPipe (x2) 2. Inline Patching: Manual 3. NAC: ForeScout (LAB) 4. Enterprise Wireless Security: Cisco Meraki 5. Enterprise Remote Access: Cisco AnyConnect Maturity Level: Level 2
Endpoint Security
Application Security
1. 2.
Durham County
Overall Maturity Level: 2.1
Overall Maturity Level: 4
1. FW: Palo Alto Maturity Level: Level 2
1. FW: Cisco ASA 2. NGFW: Cisco FirePower 3. Router ACL 4. Message Security: Cisco ESA; Websense 5. IDS/IPS: FireEye, Cisco FirePower Maturity Level: Level 5
1.
Enterprise Message Security: Cisco Umbrella 2. Enterprise Threat Detection: Cisco Stealthwatch Maturity Level: Level 2
1. Desktop FW: Windows Defender Maturity Level: Level 3
1. Database Monitoring: Netwrix Auditor Maturity Level: Level 1
--Maturity Level: Level 0
Data Classification: Netwrix Auditor Identity and Access Mgt: Native Access Control Maturity Level: Level 1
1. MDM: Intune Maturity Level: Level 2
1.
1.
Prevention - Policy Management
Security Polices & Compliance: IT Sec Pol. Under revision 2. Security Awareness Training: Proofpoint Security Awareness Training platform 3. Vulnerability Assessment: Tenable (LAB) Maturity Level: Level 3
Monitoring & Response - Operations
1. CIRT: Adhoc w/MS-ISAC 2. Digital Forensics: Adhoc w/MS-ISAC/CIS Maturity Level: Level 1
1. SIEM: Logrhythm Maturity Level: Level 3
Data Security
1. FW: Cisco ASA 2. NGFW: Cisco FirePower 3. Router ACL 4. Web Protection: Cisco WSA; FireEye 5. Message Security: Cisco ESA; Websense 6. DLP: Cisco ESA; Symantec Maturity Level: Level 4 1.
Content Security: McAfee VirusScan Endpoint Security Enforcement: Tenable (LAB) 3. Patch Management: WSUS/SCCM Maturity Level: Level 2
1. 2.
City of Greensboro
Endpoint Protection: Symantec; MalwareBytes 2. Mobile Security: Maas360; AVG360Security; iOS/Android 3. Endpoint Security: Nessus, PCI – Coalfire Maturity Level: Level 5 1. Code Analysis 2. OWASP Top 10 3. Security Testing Maturity Level: Level 5 1. DLP: Cisco ESA; Symantec Maturity Level: Level 2
Security Polices & Compliance: IT Sec Pol. 1. Policies and Procedures Under revision 2. Certifications and Standards: 2. Security Awareness Training: ISO27001:2013; PCI-DSS 3. Vulnerability Assessment: Rapid7 3. User Awareness & Training: Live; Maturity Level: Level 3 KnowBe3-Phishing; Bulletins, Posters Maturity Level: Level 5 1. Splunk; FireEye; Cisco FirePower 2. Open Source Intelligence/FTK/EV Maturity Level: Level 3
Solution Options & Analysis
11
1.
Implementing a defense in depth strategy which includes: a. SOC Services b. Hire a MSSP c. Utilize MS-ISAC resources and services
2. Utilize Senior Cyber Security Analyst, current TS Staff, and: a. SOC Services b. MS-ISAC resources and services
12
1.
Implementing a defense in depth strategy which includes: a. SOC Services b. Hire a MSSP c. Utilize MS-ISAC resources and services
Description
Pros
Cons
• • • • •
• •
Strengthen Enterprise Security Architecture (Defense-In-Depth) MSSPs can better identify and remediate threats. SOC services address shortage of qualified security analysts and engineers Improved resource allocation and reduced costs 24x7x365 monitoring, alerting and incident response
May require additional costs for hardware or software that will integrate with the MSSP and MS-ISAC services A nominal level of personnel will be required to monitor, integrate and maintain a relationship with the MSSP, SOC, and MS-ISAC
13
COST ESTIMATES Cyber Security Program
FUNDING
Year One Costs (Hours) plus recurring costs
Run Costs (Hours)/ KTLO
Departmental Funding Amount:
$0
Labor $ (Hours) Internal TS: Business Analysis TS Services TS Project Management:
1484 hours
1170 hours
0 hours
0 hours
1484 hours
1170 hours
72 hours
0 hours
External: Cyber Security Management Services - vCISO
$70,000 (0 hours)
$70,000 (0 hours)
SOC-as-a-Service
$191,744(0 hours)
$174,509 (0 hours)
Hardware:
$80,965
$0
Software:
$144,403
$132,191
$0
$0
Funding Requested (Y/N):
Project One Time Costs
$487,112
Project Run Cost (External)
$376,700
*Total Project Funding Requested
$487,112
*Recurring Costs
$376,700
Non-Labor $
Other:
14
Y
*Total Project Funding Requested (External), includes the External Annual Run Costs and Non-Labor
Description
Pros
1.
Utilize Senior Cyber Security Analyst, current TS Staff, and: a. SOC Services b. MS-ISAC resources and services
• Strengthen Enterprise Security Architecture (Defense-In-Depth) • SOC services address shortage of qualified security analysts and security engineers • Improved resource allocation and reduced costs • 24x7x365 monitoring, alerting and incident response •
Cons
•
May require additional costs for hardware or software that will integrate with the SOC and MS-ISAC services A nominal level of personnel will be required to monitor, integrate and maintain a relationship with the SOC and MSISAC
15
COST ESTIMATES
FUNDING
Project One Time Costs (Hours)
NC4 Street Smart
Run Costs (Hours)/ KTLO
Departmental Funding Amount:
$0
Labor $ (Hours) Internal TS: Business Analysis TS Services TS Project Management:
External: Business Analysis SOC Services – (24x7x365)
1484 hours
1170hours
0 hours
0 hours
1484 hours
1170 hours
72 hours
0 hours
$0 (0 hours)
$0 (0 hours)
$0 (0 hours)
$0 (0 hours)
$376,000 (0 hours)
$336,000 (0 hours)
$0
$0
$126,974
$108,279
$0
$0
Funding Requested (Y/N):
Project One Time Costs
$462,976
Project Run Cost (External)
$444,279
*Total Project Funding Requested for FY 20
$462,976
*Recurring Costs
$444,279
Non-Labor $ Hardware: Software: Other:
*Total Project Funding Requested (External), includes the External Annual Run Costs and Non-Labor
16
Y
Cyber Security Risk Assessment SECURITY OBJECTIVE CATEGORY
Confidentiality
POTENTIAL IMPACT MODERATE
Unauthorized disclosure of information = a limited adverse effect on organizational operations, organizational assets, or individuals.
National Institute of Standards and Technology (NIST) Special Publication 800-60, Volume 2, Rev. 1
Integrity
Unauthorized modification or destruction of information = a serious adverse effect on organizational operations, organizational assets, or individuals.
Availability
Disruption of access to or use of information or an information system = a limited adverse effect on organizational operations, organizational assets, or individuals.
The information type identified for Cyber Security Program Enhancement is Information Security Information Type, with the following security categorization recommendation: Final Security Categorization = Confidentiality: Low; Integrity: Moderate; Availability: Low 17
Summary & Recommendation
18
Options 1. SOC Services, Hire MSSP 2.SOC Services, MS-ISAC
Cyber Security Program Enhancement – Desired Business Value Analysis Criteria Improved 24/7/365 Gain Cyber Third-party Resiliency and Scalability Alerting and Security support when Efficiency Monitoring skills/expertise needed
Cost
$$$ $$
19
Recommendation Option 1: Proceed with SOC Services and Hire MSSP
20
Our Ask
We are asking to approve the Business Case for our Cyber Security Program
Project Planning
Implementation Overview
Risk & Risk Mitigation
Project Timeline
Recap
Projected Implementation Overview
23
Post-contract award One-Time and Recurring Critical Deliverables: • One-Time Critical Deliverables • Day 1 Readiness Plan – Within Thirty (30) days of the effective date • Service Management Manual (SMM) – Within 14 days after the effective date • New Customer Integration Plan – Within One (1) months after the effective date • Technology Plan – Complete in accordance with the established deliverable cycle and requirements • Outreach and Growth Plan – Within Thirty (30) days of the effective date • Operating Level Agreements – Within Forty-Five (45) days of the effective date
Projected Implementation Overview
24
Post-contract award One-Time and Recurring Critical Deliverables: • Recurring Deliverables • Technology Plan and Roadmap – Updated in accordance with the established deliverable cycle (at least annually) • Annual Equipment & Software Refresh Plan – Due annually • Service Management Manual Updates – Quarterly Report • Customer Satisfaction Improvement Plan – Service will submit a customer satisfaction survey quarterly and a customer satisfaction improvement plan bi-annually • Outreach and Growth Plan -- Annual plan to evaluate the success of the prior year’s outreach plan and proposed improvements to affect incremental growth for future year(s) • Monthly Deliverables Review -- Monthly review of the status of all deliverables
xxx 2018
25