Security and digital: it's all about leadership

Security and digital: it’s all about leadership James Stewart |@jystewart
| [email protected]

$  Digital government 

@jystewart “Your threat model has changed”

@jystewart Good security requires cultural change (just like digital does)

@jystewart - Take responsibility - Focus on outcomes - Empower
teams - Change the environment

@jystewart Can I put this data outside our borders?

@jystewart Can I put this data outside our borders?  
What guarantees do we need to make about data?

@jystewart It is unacceptable for a board to not understand
ﬁnancial risk. The same has to be true for cyber risk.

@jystewart https://insidegovuk.blog.gov.uk/2016/11/15/incident-report-gov-uk-dns-outage/

@jystewart Data in transit protection - Data transiting networks should
be protected against tampering and eavesdropping Asset protection and resilience - Data, and the assets that store/protect it, should be protected appropriately Separation between consumers - To prevent one compromised consumer from affecting the service of another Governance framework - To direct their overall approach to the management of the service and information Operational security - Processes and procedures need to be in place to ensure the operational security of the service Personnel security - Security service provider staff should be subject to personnel security screening Secure development - Services should be designed and developed to identify and mitigate threats to their security Supply chain security - The supply chain should support all of the security principles that the service Secure consumer management - Consumers should be provided with the tools required securely manage their service Identity and authentication - Access should be constrained to the authorised and authenticated users External interface protection - All external or less trusted interfaces of the service should have appropriate protections Secure service administration - All methods used by the service administrators should mitigate risk of exploitation Audit information provision to consumers -To help consumers monitor access to their service and their data Secure use of the service by the consumer - Consumers need to be trained and comply with guidance for use of cloud https://bit.ly/cloud-security-principles

From “Agile Application Security” by Laura Bell, Michael Brunton-Spall, Rich
Smith, Jim Bird

@jystewart “Make email mean something again” https://www.ncsc.gov.uk/blog-post/active-cyber- defence-tackling-cyber-attacks-uk

@jystewart “If security doesn't work for people, it doesn't work”
- Emma W from NCSC https://www.ncsc.gov.uk/blog-post/cyberuk-2017-people- strongest-link

Security and digital: it’s all about leadership James Stewart |@jystewart
| [email protected]

Security and digital: it's all about leadership

Security and digital: it's all about leadership

jystewart

Transcript