|
| 1 | +--- |
| 2 | +date: 2021-08-23 |
| 3 | +title: Day 1 and the Security Environment Overview |
| 4 | +--- |
| 5 | + |
| 6 | +[Index](../../../index.md) > [Cyber Risk and Resilience](./index.md) > {{ page.date }}: {{ page.title }} |
| 7 | + |
| 8 | +# {{ page.date }}: {{ page.title }} |
| 9 | + |
| 10 | +Agenda: |
| 11 | + |
| 12 | +- intros |
| 13 | +- syllabus |
| 14 | +- sec env overview |
| 15 | +- exec level concerns |
| 16 | +- frameworks |
| 17 | + |
| 18 | +Things to do: |
| 19 | + |
| 20 | +- Keep an eye on MyCourses |
| 21 | +- Join the slack (link on MyCourses) |
| 22 | + |
| 23 | +## Intros |
| 24 | + |
| 25 | +Dr Rick Mislan: |
| 26 | + |
| 27 | +- Named Ritchie! |
| 28 | +- GCI Cyber Ranger Creative Director |
| 29 | +- US Army Electronic Warfare Officer |
| 30 | +- Has hung out with: |
| 31 | + - At RIT: |
| 32 | + - McAfee |
| 33 | + - Vince Cerf |
| 34 | + - In a trailer after a concert: |
| 35 | + - John Mellancamp |
| 36 | + |
| 37 | +> Join slack later to introduce yourselves (again) |
| 38 | +
|
| 39 | +Introductions round one: |
| 40 | + |
| 41 | +- who you are |
| 42 | +- where you're from |
| 43 | +- something unique |
| 44 | + |
| 45 | +There will be roughly 5 homework assignments, 5% *each*; exams are 15% *each*, project is 35% |
| 46 | + |
| 47 | +The textbook is coming in PDF format, Nice! |
| 48 | + |
| 49 | +## The Security Environment Overview |
| 50 | + |
| 51 | +> "For every wall, there is a ladder" |
| 52 | +
|
| 53 | +> "Security is a Feeling" |
| 54 | +
|
| 55 | +> SETA - Security Education, Training, and Awareness |
| 56 | +
|
| 57 | +Information is in one of three states: |
| 58 | + |
| 59 | +- Data in Motion |
| 60 | +- Data at Rest |
| 61 | +- Data in Use |
| 62 | + |
| 63 | +These are called the "Avenues of Access" |
| 64 | + |
| 65 | +Identify, prevent, Detect, Response, Recover (this is not picerl) |
| 66 | + |
| 67 | +The three pillars or risk: |
| 68 | + |
| 69 | +- Information Technology |
| 70 | +- Operational |
| 71 | +- Fraud and Financial Crime |
| 72 | + |
| 73 | +IT is where cyber attacks hit. |
| 74 | + |
| 75 | +Risk appetite: What can we accept? What isn't worth worrying about? |
| 76 | + |
| 77 | +Identify, Prevent, Detect, Respond |
| 78 | + |
| 79 | +- Identify potential threats |
| 80 | +- Prevent those things from happening |
| 81 | +- Detect those events |
| 82 | +- Respond to them, recover |
| 83 | + |
| 84 | +Stumbling Blocks: |
| 85 | + |
| 86 | +- Organizational Silos |
| 87 | + - cyber doesn't stay in its bucket |
| 88 | +- Insufficient Business Involvement |
| 89 | + - Cyber risk is a business problem, not just a technical one. |
| 90 | +- Over-reliance on training and communications |
| 91 | + - Controlling risk *only* by changing human behavior |
| 92 | +- Talent shortfalls |
| 93 | + - self explanatory |
0 commit comments