Cyber Security Program Enhancement

IT Governance Business Case Technology Solutions Cyber Security Program Enhancement

Background on Cyber Security Program 1st Quarter FY19 – • Procured new security tools (Tenable.io, ForeScout CounterACT) • Conducted 1st Security Awareness Training Campaign (Email Security & Phishing) 2nd Quarter FY19 – • Hired Senior Cyber Security Analyst • Lab Testing Tenable.io Vulnerability Management • Lab Testing ForeScout CounterACT Network Access Control • Successfully defended against and minimized the impact of a major malware attack (Emotet) with a coalition of resources (internal/external) • Updated McAfee – Antivirus/Malware Detection • Implemented Advanced Threat Hunting capability with Huntress – Breach Detection/Eradication  3rd Quarter FY19 – • Conducting Cyber Security Gap Analysis (Phase 1) • Completing lab testing of Tenable.io and ForeScout CounterACT; developing deployment strategy • Implementation of Huntress and additional remediation strategies, minimized impact of 2nd malware attack (TrickBot) • Additional enterprise security controls being tested and implemented to aid in continuous monitoring

Current State  IT Policies and Procedures due for review, revisions and updates. Additional human capital is needed to support cyber security program. Our current enterprise security architecture is outdated for today’s evolving cyber threat landscape. It was developed 10 years ago.  Current security tools while providing key value have limited visibility across network: Tenable.io – Vulnerability management ForeScout CounterACT – Network Access Control McAfee – Antivirus/Malware Detection Huntress – Breach Detection/Eradication Netwrix Auditor – Auditing/Compliance Network Devices (IDS/IPS) require skilled security engineers

 Security Awareness Training platform is currently operational but

needs a focused resource

Current Pain Points • Limited in-house cyber security analysts and security engineers to provide analytical and engineering support for program.

• Limited network security visibility with current cyber security resources and tools.

• Lack of best practice separation of security duties.

Project Objectives to Address Pain Points

Major Objective: Develop a comprehensive cyber security program utilizing best-of-breed cyber security framework that embraces Information Security Governance and Risk Management with the following principles in a multi-year program development strategy: o o o

Year 1 – Establish Cyber Security Framework, Conduct Cyber Security Gap Analysis (Cyber Security Context and Leadership; Evaluation and Direction, and Compliance, Audit and Review) - Current FY Year 2 – Establish Security Operations Center (SOC) Services *(Identification and Prevention, Detection, Response and Recovery) Year 3 – Fully implement a Cyber Security Program Measurement Initiative (Metrics Program and Continuous Monitoring and Improvement)

*Addresses 2018 Security Audit Critical Finding

BEST PRACTICE ADAPTIVE SECURITY ARCHITECTURE

Future State • A multi-year strategy to fully implement a Cyber Security Program that supports an adaptive security architecture for the City of Durham’s Cyber Security Division • Improved external partnerships and collaboration through the use of a Managed Security Services Provider (MSSP), Center for Internet Security (CIS) and Multi-State Information Sharing and Analysis Center (MS-ISAC) cyber security resources and services

Future State Benefits • Improved Cyber Security posture for the City of Durham • Reduced overall risk from cyber threats facing the City of Durham • Scalable best of breed cyber security framework utilizing Managed Security Services Provider (MSSP) and the MS-ISAC resources • Improved budget forecasting with right-sized cyber security support and services for the City of Durham

Cyber Security Program Comparative Analysis – Sister Cities & Municipalities Cyber Security Program Comparative Analysis - Enterprise Security Architecture

City of Durham

Durham County

City of Greensboro

Overall Maturity Level: 1.5

Overall Maturity Level: 2.1

Overall Maturity Level: 4

< 1 year

1.5 years

5 years

Staffing Levels: FTE/Contractor?

1 FTE

1 FTE

3 FTE

Number of Employees?

2,700

1,900

4,000

No

Augmented FW Services (Dell SecureWorks)

No

$342,877

$802,203

$914,676

Cyber Security Program Age of Program or Role?

Managed Security Services Provider?

Estimated or Approved Cyber Security Program Budget

Cyber Security Program Comparative Analysis – Sister Cities & Municipalities

Cyber Security Program Comparative Analysis - Enterprise Security Architecture

Security Architecture Tools/Services

City of Durham

Overall Maturity Level: 1.5

Perimeter Security

1. FW: Cisco ASA (x2) 2. IDS/IPS: McAfee Maturity Level: Level 1

Network Security

1. Datacenter FW: FatPipe (x2) 2. Inline Patching: Manual 3. NAC: ForeScout (LAB) 4. Enterprise Wireless Security: Cisco Meraki 5. Enterprise Remote Access: Cisco AnyConnect Maturity Level: Level 2

Endpoint Security

Application Security

1.

2.

Durham County

Overall Maturity Level: 2.1

Overall Maturity Level: 4

1. FW: Palo Alto Maturity Level: Level 2

1. FW: Cisco ASA 2. NGFW: Cisco FirePower 3. Router ACL 4. Message Security: Cisco ESA; Websense 5. IDS/IPS: FireEye, Cisco FirePower Maturity Level: Level 5

1.

Enterprise Message Security: Cisco Umbrella 2. Enterprise Threat Detection: Cisco Stealthwatch Maturity Level: Level 2

1. Desktop FW: Windows Defender Maturity Level: Level 3

1. Database Monitoring: Netwrix Auditor Maturity Level: Level 1

--Maturity Level: Level 0

Data Classification: Netwrix Auditor Identity and Access Mgt: Native Access Control Maturity Level: Level 1

1. MDM: Intune Maturity Level: Level 2

1.

1.

Prevention - Policy Management

Security Polices & Compliance: IT Sec Pol. Under revision 2. Security Awareness Training: Proofpoint Security Awareness Training platform 3. Vulnerability Assessment: Tenable (LAB) Maturity Level: Level 3

Monitoring & Response - Operations

1. CIRT: Adhoc w/MS-ISAC 2. Digital Forensics: Adhoc w/MS-ISAC/CIS Maturity Level: Level 1

1. SIEM: Logrhythm Maturity Level: Level 3

Data Security

1. FW: Cisco ASA 2. NGFW: Cisco FirePower 3. Router ACL 4. Web Protection: Cisco WSA; FireEye 5. Message Security: Cisco ESA; Websense 6. DLP: Cisco ESA; Symantec Maturity Level: Level 4 1.

Content Security: McAfee VirusScan Endpoint Security Enforcement: Tenable (LAB) 3. Patch Management: WSUS/SCCM Maturity Level: Level 2

1.

2.

City of Greensboro

Endpoint Protection: Symantec; MalwareBytes 2. Mobile Security: Maas360; AVG360Security; iOS/Android 3. Endpoint Security: Nessus, PCI – Coalfire Maturity Level: Level 5 1. Code Analysis 2. OWASP Top 10 3. Security Testing Maturity Level: Level 5 1. DLP: Cisco ESA; Symantec Maturity Level: Level 2

Security Polices & Compliance: IT Sec Pol. 1. Policies and Procedures Under revision 2. Certifications and Standards: 2. Security Awareness Training: ISO27001:2013; PCI-DSS 3. Vulnerability Assessment: Rapid7 3. User Awareness & Training: Live; Maturity Level: Level 3 KnowBe3-Phishing; Bulletins, Posters Maturity Level: Level 5 1. Splunk; FireEye; Cisco FirePower 2. Open Source Intelligence/FTK/EV Maturity Level: Level 3

Solution Options & Analysis

11

1.

Implementing a defense in depth strategy which includes: a. SOC Services b. Hire a MSSP c. Utilize MS-ISAC resources and services

2. Utilize Senior Cyber Security Analyst, current TS Staff, and: a. SOC Services b. MS-ISAC resources and services

12

1.

Implementing a defense in depth strategy which includes: a. SOC Services b. Hire a MSSP c. Utilize MS-ISAC resources and services

Description

Pros

Cons

• • • • •

• •

Strengthen Enterprise Security Architecture (Defense-In-Depth) MSSPs can better identify and remediate threats.

SOC services address shortage of qualified security analysts and engineers Improved resource allocation and reduced costs 24x7x365 monitoring, alerting and incident response

May require additional costs for hardware or software that will integrate with the MSSP and MS-ISAC services A nominal level of personnel will be required to monitor, integrate and maintain a relationship with the MSSP, SOC, and MS-ISAC

13

COST ESTIMATES Cyber Security Program

FUNDING

Year One Costs (Hours) plus recurring costs

Run Costs (Hours)/ KTLO

Departmental Funding Amount:

$0

Labor $ (Hours) Internal TS: Business Analysis TS Services TS Project Management:

1484 hours

1170 hours

0 hours

0 hours

1484 hours

1170 hours

72 hours

0 hours

External: Cyber Security Management Services - vCISO

$70,000 (0 hours)

$70,000 (0 hours)

SOC-as-a-Service

$191,744(0 hours)

$174,509 (0 hours)

Hardware:

$80,965

$0

Software:

$144,403

$132,191

$0

$0

Funding Requested (Y/N):

Project One Time Costs

$487,112

Project Run Cost (External)

$376,700

*Total Project Funding Requested

$487,112

*Recurring Costs

$376,700

Non-Labor $

Other:

14

Y

*Total Project Funding Requested (External), includes the External Annual Run Costs and Non-Labor

Description

Pros

1.

Utilize Senior Cyber Security Analyst, current TS Staff, and: a. SOC Services b. MS-ISAC resources and services

• Strengthen Enterprise Security Architecture (Defense-In-Depth) • SOC services address shortage of qualified security analysts and security engineers • Improved resource allocation and reduced costs • 24x7x365 monitoring, alerting and incident response •

Cons

•

May require additional costs for hardware or software that will integrate with the SOC and MS-ISAC services A nominal level of personnel will be required to monitor, integrate and maintain a relationship with the SOC and MSISAC

15

COST ESTIMATES

FUNDING

Project One Time Costs (Hours)

NC4 Street Smart

Run Costs (Hours)/ KTLO

Departmental Funding Amount:

$0

Labor $ (Hours) Internal TS: Business Analysis TS Services TS Project Management:

External: Business Analysis SOC Services – (24x7x365)

1484 hours

1170hours

0 hours

0 hours

1484 hours

1170 hours

72 hours

0 hours

$0 (0 hours)

$0 (0 hours)

$0 (0 hours)

$0 (0 hours)

$376,000 (0 hours)

$336,000 (0 hours)

$0

$0

$126,974

$108,279

$0

$0

Funding Requested (Y/N):

Project One Time Costs

$462,976

Project Run Cost (External)

$444,279

*Total Project Funding Requested for FY 20

$462,976

*Recurring Costs

$444,279

Non-Labor $ Hardware: Software: Other:

*Total Project Funding Requested (External), includes the External Annual Run Costs and Non-Labor

16

Y

Cyber Security Risk Assessment SECURITY OBJECTIVE CATEGORY

Confidentiality

POTENTIAL IMPACT MODERATE

Unauthorized disclosure of information = a limited adverse effect on organizational operations, organizational assets, or individuals.

National Institute of Standards and Technology (NIST) Special Publication 800-60, Volume 2, Rev. 1

Integrity

Unauthorized modification or destruction of information = a serious adverse effect on organizational operations, organizational assets, or individuals.

Availability

Disruption of access to or use of information or an information system = a limited adverse effect on organizational operations, organizational assets, or individuals.

The information type identified for Cyber Security Program Enhancement is Information Security Information Type, with the following security categorization recommendation: Final Security Categorization = Confidentiality: Low; Integrity: Moderate; Availability: Low 17

Summary & Recommendation

18

Options 1. SOC Services, Hire MSSP 2.SOC Services, MS-ISAC

Cyber Security Program Enhancement – Desired Business Value Analysis Criteria Improved 24/7/365 Gain Cyber Third-party Resiliency and Scalability Alerting and Security support when Efficiency Monitoring skills/expertise needed

Cost

$$$ $$

19

Recommendation Option 1: Proceed with SOC Services and Hire MSSP

20

Our Ask

We are asking to approve the Business Case for our Cyber Security Program

Project Planning

Implementation Overview

Risk & Risk Mitigation

Project Timeline

Recap

Projected Implementation Overview

23

Post-contract award One-Time and Recurring Critical Deliverables: • One-Time Critical Deliverables • Day 1 Readiness Plan – Within Thirty (30) days of the effective date • Service Management Manual (SMM) – Within 14 days after the effective date • New Customer Integration Plan – Within One (1) months after the effective date • Technology Plan – Complete in accordance with the established deliverable cycle and requirements • Outreach and Growth Plan – Within Thirty (30) days of the effective date • Operating Level Agreements – Within Forty-Five (45) days of the effective date

Projected Implementation Overview

24

Post-contract award One-Time and Recurring Critical Deliverables: • Recurring Deliverables • Technology Plan and Roadmap – Updated in accordance with the established deliverable cycle (at least annually) • Annual Equipment & Software Refresh Plan – Due annually • Service Management Manual Updates – Quarterly Report • Customer Satisfaction Improvement Plan – Service will submit a customer satisfaction survey quarterly and a customer satisfaction improvement plan bi-annually • Outreach and Growth Plan -- Annual plan to evaluate the success of the prior year’s outreach plan and proposed improvements to affect incremental growth for future year(s) • Monthly Deliverables Review -- Monthly review of the status of all deliverables

xxx 2018

25