Cyber Security

                            

                         [Source: Fortalice, Cyber Security Experts]

Now What? 

Since many breaches could have been avoided through reasonable security controls, members are encouraged to follow the below recommended steps:

• Identify your top one, two or three most critical types of information and the systems which use them
  
• Plan how you will operate if that information is lost, corrupted or the systems rendered inoperable
• Train and communicate strategy to all company employees
• Have a third party assess your information environment at least once a year and conduct penetration tests of both your logical and physical controls as part of the assessment

• Develop and routinely review security policies and procedures that impact your critical information environment
• Facilitate an internal simulation of a data breach or cyber disaster
• Perform regular audits of your security polices and procedures.  Address security practices holistically, not just as "physical"or just as "computer"
• Monitor your information for intrusion, corruption and loss
• Identify recovery assets in case of a cyber breach
• Develop relationship with industry experts, crisis PR firm and legal counsel with cyber experience

General Resources:

• 2013 Global Security Report – a valuable resource for businesses, free download from Trustwave
• Common Sense Guide to Mitigating Insider Threats - This guide describes 19 practices that organizations should implement across the enterprise to prevent and detect insider threats, as well as case studies of organizations that failed 
  to do so.
•  2013 Data Breach Investigations Report - This year’s DBIR combines the expertise of 19 organizations from around the globe. Download the report to discover stats that might surprise you—from the percentage of espionage-related attacks to the astonishing length of time it often takes to spot a security breach. By knowing today’s threats, you can better protect your organization tomorrow.
• Guide to better Passwords - It is important to remember why passwords are important: passwords are often the first (and possibly only) defense against intrusion
• 2013 Security Predictions - predictions to help prepare your network defenses for a safe and secure 2013
• Security Breach Notification Chart - Perkins Coie's Privacy & Security practice maintains a comprehensive chart that summarizes state laws regarding security breach notification.  The chart is for informational purposes only and is intended as an aid in understanding each state's sometimes unique security breach notification requirements.  Lawyers, compliance professionals, and business owners have told us that the chart has been helpful when preparing for and responding to data breaches. 

Federal Resources:

•  US-CERT- Check out these Tips that describe and offer advice about common security issues for non-technical computer users.
• US-CERT Posters and Brochures - provide guidance on physical and cyber security and how to report suspicious behavior, activity, and cyber incidents.
• US-CERT mailing lists and feeds -  for a variety of products including the National Cyber Awareness System and Current Activity updates. The National Cyber Awareness System was created to ensure that you have access to timely information about security topics and threats.
• Cyber Security Evaluation Tool - tools to assess company's control system and information technology network security practices against recognized industry standards.
• NIST Glossary of Key Information Security Terms - This glossary provides a central resource of terms and definitions most commonly used in NIST information security publications and in CNSS information assurance publications.