Industry sign banking new mexico confidentiality agreement computer
good evening afternoon morning middle of the night or whatever it is wherever you are my name is Keith Palmgren and welcome to the cya by using the CIA correctly for a change the cover of your assets by using the confidentiality integrity availability what we normally think of as a triad we're going to be punked out a bit tonight but before we get to that again my name is Keith Palmgren I am a senior sans instructor as you can see there is an awful lot of alphabet soup out to my name and you see my email address there you also see my twitter handle in case you're interested but the email address every student I have ever had over 25,000 of you now have a standing 4life invitation to send key questions via email and if I can possibly help you out I am more than happy to do so no I will not design your entire security architecture via email and yes I have been asked to do that kind of thing but if you are trying to understand a topic or a term or something of that nature shoot me an email and we'll work on and we'll see if we can pop with something that helps you out also notice up in the corner you see a QR code and also a link to a tinyurl.com slash ch3 708 e you notice that is a lowercase O but those will take you to a Dropbox folder I have shared the world I don't put things up there if I am ok with everybody having having it so this presentation my other three or four night talks are also up there as well is a whole lot of other stuff I just kind of put that stuff up there and my students and so forth colleagues and so on can download and make use of it if you find something up there that you feel has value you have my permission to share with colleagues and so on I do ask that you don't try to profit from my mine the stuff I'm giving away for free up there I had someone try that about four or five years ago so I guess I have to say that now unfortunately but so this talk we've all heard the CIA the confidentiality integrity availability we're going to get in some some discussion about that but part of what this talk is really about our agenda here for this evening we are going to try to debunk some of the conventional thinking that goes around the CIA now you might be asking okay who is this character Keith and and why does he think he gets to do that well I've been doing this stuff and by stuff I mean computers and network in general but security in particular I specialize in security from day one and I've been doing this for over 35 years I started my career and I joined the Air Force the United States Air Force in January 1985 or with cryptokeys and codes as well as the very brand-new computer security program that they had just started up back in the 1986-87 timeframe worked in that for a while I was at AT&T as a security consultant I built and ran the first security consulting practice for Sprint I've been doing my own consulting practice for over 20 years now and through all of that working with various clients and government sector private sector u.s. international law enforcement you name it I figured a few things out in most cases because I've tried to follow conventional wisdom and found out that it did not work so that's kind of where some of this talk came from now basically our agenda for this evening we're going to do a quick review of the CIA if you're attending this talk you probably know what I mean is a CIA confidentiality integrity availability but just to make sure everybody's on the same page and and seeing it with with where I'm coming from we'll do a quick review but I want to introduce this pie chart expedient but I'm going to use try to make some points throughout the throughout the talk here we will look at the pipes or it was serious and various companies I'm just choosing more or less at random and then by sector by Department and we'll finish up with some Q&A now this talk I've done this talk a number of times in live events and it sometimes is over in 45 minutes and it is sometimes over and you know an hour to an hour and five it depends on that final bullet that's UA how much how many questions we have you know and so forth but but notice the little white board over here on the side our to-do list tonight is to learn and part of that means we need to interact and it's not just me talking to you it's also you asking questions making suggestions telling me I'm wrong if that's how you feel but so exactly you know how long we will be here this evening it does vary somewhat very much depending well actually more on you than on me okay but so we can also agree to disagree not everyone is going to agree with everything I say here tonight okay and that is perfectly okay the purpose of this talk is to make you think to make you as our whiteboard says here to make you question everything there's a lot of value in that sometimes I may make you think about things you've never even consider before in other cases I may think makes you think about you know old things and new ways but in either case whether at the at the end of the day whether you agree with me or disagree with me that's okay if I have made you walk away from this presentation thinking things through in new and different ways and so forth then there is value and that just simply making you think there's a lot of value there and during our Q&A session maybe you'll make me think a little bit too it has been known to happen okay now the CIA let's just do a quick little review I think we know confidentiality only those who are supposed to have access to something should have access to it the integrity the data must be kept in a pristine and accurate fashion and of course the availability the resource has to be accessible and usable or it's not doing you very much good and so we know that our security programs want to address confidentiality integrity and availability and when we when we look at how this is viewed around the industry whether you're talking cissp security plus or pretty much anything else out there any kind of training classes or anything like that you might go to you're going to hear this discussed as the CIA triad triad defined as three equal parts so I'm going to try to address all three of those in equal parts okay and the CIA triad it is commonly touted as the proper way of doing things well part of what we are here today to try to accomplish we're going to shatter that notion that the CIA triad is the proper way that the triad part of it is proper we have to do this we have to understand more the early thinking or originates okay and where it really kind of came from and I've looked into this as hard as I can this terminology of CIA triad really kind of seems to originate with the CISSP exam now please understand I hold the CISSP II active CISSP certification I've held that certification since 1998 I'm proud of the certification etc I'm certainly not bashing on CISSP but - you kind of have to understand where it came from the original cissp questions were written in 1988 1989 and 1990 by a gentleman named Mike quarry now in the interest of full disclosure my core is a a good friend of mine and my former boss I used to work for him but he would be the first was a believe me I'm not bashing on Mike as I say he's a good friend of mine name I used to be my boss this is not intended any way to bash my kiss certification or anything else it's a simply analyzing one small piece of it okay but he would be the first one to tell you that he really kind of designed the CISSP as a certification for perfect world security and the things that he put in he and his team put into the CISSP certification test pretty much became conventional wisdom I can give you several examples if you would like but the problem with conventional wisdom it's not always wise okay well as an example there's a place out there I call it Keith's perfect world and in Keith's perfect world everybody gets eight hundred percent of their staffing requests nine hundred percent of their budget requests and he's perfect world is an amazingly lonely place in fact nobody actually lives there we all live in the real world where we're gonna give 50% of our staff requests 20% of our budget requests on mats if we're lucky today so in other words we'd never have the resources necessary to implement the CIA as a triad of three equal parts and I that I speak from from knowledge okay I have tried it because I learned it this way CIA triad the back of me in the early 90s when I first started hearing the term running into it and that's how I learned it to implement it as three equal parts and so I went into client after client after client both when I was running the practice like a sprint and then again in my own practice and so forth and we have tried repeatedly to implement the CIA triad in three equal parts and in every case we failed because the organization ran out of funds before we could succeed there just simply didn't have the the people and the budget to be able to do that and eventually I figured out that the triad piece of the CIA triad is an unattainable ideal that doesn't mean that the CIA is bad it means that attempting to implement it as a triad is a mistake okay and so this talk here tonight we're gonna see how we can still use CIA to very good effect but not try to obtain an unattainable ideal okay now kind of an expedient that I'm going to be using here tonight I'm going to use this CIA pie-chart if you will and I'm going to break it up and three different colors as you can see with red being for confidentiality claim for integrity blue for availability colors don't really mean anything I just needed three colors so I picked those three now when I did first did this talk the very first time a gentleman came up at doors and said great talk but I am colorblind i can only see shades of grey so that was kind of tough for me I said Wow I didn't think of that so I threw the CDI in the a in there to help out as well okay but so we're going to you know wait these three with different companies with this company would give more weight to the confidentiality piece on the end of a lability piece and so on and we will use this the simple pie chart as an expedient to to illustrate and demonstrate this okay now the specific percentages just are not the point here we're not going to get bogged down on the weeds here now should that be a 49% or a 50% you know we're not going there okay that's that's really not what this is but and again some of you are going to completely disagree with my weighting and I'm perfectly okay with that I'm not saying I'm perfect for occasions and believe my wife can give you a long list of times not got no wrong okay so it does happen now I needed some companies to to use as examples here so you know nothing special about these companies are just some you know large pretty well-known companies coca-cola the largest soft drink maker in the world obviously we'll talk more about ball when we get to them but if you're familiar with their they're a very significant company in their industry sector the largest in their industry sector chase a large US bank obviously Pfizer the largest pharmaceutical company ExxonMobil largest oil and gas company and I think you might have heard of Amazon they do some online sales a little bit they also use some tax some clouds and things like that but so I like I say I needed some companies to use as examples these are the ones I happen to choose okay now again and the interesting for of full disclosure I've never had a business relationship with any of these companies here I have never been an employee I have ever been a consultant to one of them I pick some big well-known companies okay and you know what follows here when I show these different pie charts for each of these companies this is kind of my day one on the job assumption about how they would weight the CIA pie chart and I'll be the first one to say that as I spend more time when the company and get to understand it better and you know kind of become more of an insider instead of an outsider I probably would change so am I so am I waiting a little bit I probably got something wrong I need to make some adjustments okay this is this is simply based on an outsider's view of those companies okay so I understand kind of where this came from now with that let's take a look at some pie charts here so when we take a look at coca-cola I think it's pretty obvious with the formula for coca-cola there are other companies out there that could make coke that is an obviously true statement okay and so consequently the formula for coca-cola is notoriously protected I don't know if you've heard but one third of the formula is in the control of three different executives in three different cities maintained in three different vaults no one person is ever supposed to have access to all three pieces etc in fact following the 9/11 attack one of the the the company coca-cola actually donated a lot of money toward the cleanup and in it was you know altruistic to a certain extent but it was also done because one third of their formula was in a vault in the basement of one of the World Trade Center towers I mean they wanted to get that formula back and that was that was also part of that equation as well okay but so they do present that formula pretty pretty carefully okay one of the most carefully protected formulas in the world if you ever watch how stuff's made and how companies like this protect their formulas that's the piece of you know and all of the house stuff made shows are fantastic and I just also care and watch them for hours because I'm kind of weird that way but when they start talking about how they protect their formulas that's when I really set up and start taking notice but there's also other products that they make you know others sports drinks and so forth and then of course they're always doing research and development on new products so consequently when I take a look at the coca-cola company I'm probably going to give confidentiality by far the biggest piece of the pie integrity is going to come in a strong second they want coke to taste like coke and some of you that are closer to my age might remember 1985 they called it New Coke oh my word they came up with the new formula for coca-cola and put it out it didn't taste the same and people were so upset and and they figured out the integrity that formula needs to be that the coke needs to taste like coke that's what they kind of figured out from that availability is a pretty distant third I mean how they do want to have their you know be able to access their formulas and so forth they you know they do want to have that but when you compare the importance of availability to the other two it's a pretty distant third okay now that's how I would look at the pie chart when we looked at a company like coca-cola if we change over and go instead to ball corporation if you're not familiar you may remember your grandmother or even you know in my case my mother canning vegetables out of the garden using ball canning jars okay well that is actually now a subsidiary of the ball corporation it's a very small part of their their business making those jars their primary business concern now they make well soda cans in fact two of their largest customers are named one is named coca-cola and the other is named PepsiCo or Pepsi okay so when you walk down the soda aisle in your local grocery store pretty much every can and bottle that you see on the shelves probably made by by the ball corporation and then when you step over to the beer aisle almost all the beer cans and beer bottles were made by by ball vegetable can soup cans etc aerosol cans jars for four jelly pickles you know ketchup mustard whatever pretty much when you're walking down the aisle in the grocery store if there is a can or a bottle of any kind it was probably made by this company they are by far the largest okay well so let's take a look at their pie chart for the company like that I'm going to say that availability is going to be our number one concern when you sign up with a company well just just take one example we just need to deal with coca-cola to make sure that they have enough bottles and cans to put their soda into just that one contract alone the service level agreements for y
u know how many cans and bottles we have to deliver on a daily basis and so on the numbers are astronomical they are they are mind-boggling and that is just one of their many many customers so availability they actually have something like 36 factories around the globe and making soda cans and all kinds of cans and bottles all the time it's a much larger operation you might imagine integrity well matters QA Quality Assurance for their you know their their products may give the soda maker or whatever some bottles and cans they do have to meet certain requirements and confidentiality though you know how do you make a bottle or a can as a kind of well known thing okay now I don't know if you recall but back when I first began this I said some of you may disagree with some of what I say and that actually happened here from this slide I had a gentleman come up to me after the presentation he didn't call me out in front of anybody but he absolutely he was at one of our San sconces and he happens to be a vice president at the ball corporation and he said you know you came pretty close he said the one thing you should be aware of our R&D facility confidentiality is real important he said I you know I can't tell you a lot you know and that's the proper he said but just one example it's actually pretty well known he said you remember several years ago when Coors beer came out with these bottles and cans that if the beer was cold enough the mountains turn blue he said it was our R&D facility that came up with how to make the mountains turn blue and the the battle between all the beer makers for who was going to get that feature on their bottles and cans was pretty intense so yeah he said yeah we were protecting that as a trade secret very close as to how we did that I found that to be a pretty interesting conversation and I repeat it by the way with his permission by the way but so you know at least with them their R&D facility within that function he said he would write rain would wait the confidentiality much hot air we're going to come back to that concept here it's an important concept coming up to hear what happens we start getting into different departments of the company and things like this okay now when we move into chase now this would be our online bank and I do want to be clear here I am talking about their online banking if you can't get to your online bank lets inconvenient it's a pain it's well dog got it I wish had happened but it's not the end of the world if I can see your bank account balance okay well now that's not good and we certainly don't want that to happen but if I can change your bank account balance when I'm not supposed to change it inappropriately that's really really bad that's an integrity issue okay now we should understand how a bank protects that integrity your online bank hopefully has some good authentication procedures to make sure that only you can get into your bank account now authentication is normally thought of as a more along the lines of a confidentiality measure I authenticate my users to keep other people off my network so they can't see my stuff that's a confidentiality measure and if you if you talk to most security folks they would immediately tell you the authentication is about confidentiality and it generally is well here in this particular case though the the online bank is forcing strong authentication in part to protect the confidentiality so that I can't see your bank account balance but primarily to keep me out of your bank account so that I cannot impact its integrity by inappropriately transferring funds ok so that's how it really comes down and so here integrity obviously our number one concern the availability nice to have ok confident chianti does get a significant slice but now you know if we change this up I was very specific in that I was talking about their online banking if you go to their stock trading function if you can't get in and trade your stocks in a timely manner the fines are very very huge so you know go to a different area of this organization you would see a very different pie chart but in the online banking function in particular ok then pharmaceuticals such as Pfizer the Pfizer is lipitor patent is actually there now the second most valuable in history generated a hundred and five billion dollars from 1993 to 2009 that's more than most companies on the sp500 generated during the same period of time there's a very very valuable formula protecting that formula is just absolutely vital ok and so confidentiality is obviously going to be the number one concern here but their integrity also has to play a pretty close second to this keeping the the pills doing what they're supposed to do and that actually believe it or not most of pharmaceuticals weren't looking at that integrity piece all that hard until once again you'd have to go back to the mid-1980s I won't be able to give you a year on this but we had an incident where somebody put some poison in some pill bottles and stores tylenol bottles in particular and some people died and all of a sudden people went oh gosh I guess it is possible that the you know the integrity of the medications does those kind of matter and so they they step that game up a bit okay I'm going to tell you I have been and I teach the NSA I have taught work for GCHQ which is basically the British NSA military bases all over the country and all over the world in fact etc I've been in some very very secure government facilities and I've been in the R&D facilities of pharmaceuticals and the R&D facilities of pharmaceuticals their security will trump anything I have ever seen done by the government including up to and including in one case three person integrity you could not go anywhere in the R&D facility without two people accompanying you including to the restroom you get to know your co-workers quite well but you know they were basically making it so that three people would have to agree to steal their formula now one little footnote here it says here that Abbey's Humera formula will soon have more total value as of early this year Abbey's Humira has surpassed actually lipitor the examples bill value valid but Abbey's Humera is now the most valuable drug in history believe it or not for several years the most valuable drug in history was viagra but Lipitor and Humera have both surpassed it now moving into a oil and gas companies such as Exxon Mobil when you talk to the CEO of a company of that nature their number one concern is to keep the oil flowing and of course you know getting the oil turned into gas or you know whatever the the products is that there have to be putting out so protecting the R&D on the oil deposits like hediye where is the oil underneath Gulf of Mexico is just one example the research that goes into obtaining that information cost they cost millions upon millions of dollars that is incredibly valuable research ok and so you know how you take crude oil and turn it into gasoline once again it's a pretty well-known thing so they're not necessarily protecting that so tightly but protecting the oil deposit data the confidentiality there yes huge ok integrity well when you're looking at the part about keeping the oil flowing the oil comes out of the ground in the form that it comes out of the ground in and you you have to work with it from there and if it's integrity is very good then you just have to deal with that ok but so for that part of it it tailored and pretty minimal now integrity for what leaves their factories you know is the gasoline up to purity levels and so forth that would obviously be important availability that's the other one though keeping that oil flowing and keeping the gas flowing and keeping the product flowing to market and so forth so if you notice here I'm giving confidentiality and availability pretty much even slices and integrity really just a sliver now again it kind of depends on what part of the process you're looking at if you're looking at where you're good at oil out of the ground I think that pie chart is very accurate if you're looking at the part of the process where the where the gasoline for example is leaving the factory the pie chart would provide you to look a little different but there'd be more integrity concern there but other than that I think it's a fairly accurate representation when we move into another type of the company for example Amazon here I'm talking about there Amazon's online sales until not that long ago 100 percent of Amazon's revenue was generated with online sales they down now do have some bricks and mortar stores of course and we're going to see how that goes for them and you know you could almost predict Amazon's revenue by looking at prior years and trending analysis and so forth I think the 2020 trending is going to just totally blow the charts off the doors or we'll have to wait and see but with all the pandemic and people staying home and not going to British mortar stores we just don't know what's going to happen with this but 2019 to Amazon's total revenue was 280 point five two billion now that compares to 2018 two hundred and thirtysomething billion so it's been going up about that much every year but but that comes down to five hundred and thirty three thousand dollars per minute if you talk to a lot of people they would tell you that a denial of service attack is a nuisance and I agree a denial of service attack is absolutely a nuisance and to Amazon it is a five hundred and thirty three thousand dollar per minute nuisance that is a pretty big nuisance you know if you look at Amazon Day in 2019 it was kind of a busted there wasn't that great of sales and stuff but 2018 Amazon Day was amazing they had some great sales stuff everybody wanted on sale for great prices and stuff and there's about a 15 minute period right smack dab in the middle of Amazon Day 2018 about 15 minutes the Amazon Web site went down a a popularity denial-of-service sort of sometimes referred to as so many people try to access the site that it runs out of resources and crashes now you know I like I said I don't do business with these companies well other than the fact that I'm a customer is some of them but you know they're not my customers so I don't have any inside knowledge here but I want to I want to go out on a limb and I'm going to tell you that Jeff Bezos the head of Amazon after that 15-minute outage in the middle of Amazon day I want to tell you he probably set some folks down and said this will not happen again ok I could show them but I kind of don't think I am I kind of think maybe that conversation happened so when you are looking at that you are looking very very much at availability being our number one concern in other words when you all poni browser you typed in Amazon they want to be very very certain that that web page opens up in that browser and and you know they don't have a web server they have massive server farms of hundreds of web servers and multiple data centers around the country and now around the world and so I don't know where you're at right now I personally have to be standing in San Antonio where it was about a hundred degrees today and about four thousand percent humidity booths outside for a very short period of time came right back in but you know when I'm here in San Antonio I open a browser i type in amazon i don't happen to know where their nearest data center is let's just say it's up in austin texas normally i would connect to a data center in austin texas and i would obtain the webpage from there but that that data center goes down maybe I'm going to connect their data center in Denver instead and it's all automated I don't even know this is happening do you think it was inexpensive to build out that kind of an infrastructure where where it's a virtual guarantee that a customer is going to see that webpage every single time there was a lot of effort a lot of expense went into that they had to invent something it's called cloud computing if you really do look at the history of cloud computing was pretty much invented by Amazon in order to support their business so so you know then why did they do that because they've got a five hundred and thirty three thousand dollar per minute motivation that's basically what it comes down to now they do care about the other two integrity if the book is supposed to cost a hundred dollars they don't want me to buy it for two and the confidentiality you want me to have to buy stuff with my credit card number not yours so they do care that you know I'm only on my own account and so forth so they do care about the other two okay but for their online sales you would absolutely wait I think the the availability is number one without question so when we kind of look at this so far so good we bring in all of our different pie charts for all the different organizations for some reason didn't come in there but everything so far is accurate and easy okay but it's also greatly simplified okay you know all what about that so let's let's let's take another look here okay so coming back the Amazons pot shirt this is a copy and paste from earlier with one little exception notice up in the in the in the corner there in the upper right hand corner I have underlined and changed the color for CIA in general pointing out that up to this point we have been talking about how I would apply it a confidentiality integrity availability prioritization at various companies in a general sense but when we start taking that and we started drilling down on it a little bit okay let's take the the same Amazon pie chart again that is specific to their online sales keep the online purchases flowing protect their prices and their customer data okay but when we bring in their cloud the pie chart changes pretty dramatically with cloud availability has got to be very important when you know cloud customers need to access their data they need to access their data they don't want to have to wait around for it and of course keeping the customer data confidential and protected and so forth their service level agreements say that they will provide a level of security so that would make that important but protecting the integrity of customers data that's more of the customer's job that's why not Amazon's job too much okay so you'd see a really different pie chart looking specifically at their cloud service and then if you were to go to their products things like their echo and their Kindle and so forth now we're going to see a different charge yet in fact it's almost backwards of what the first chart is confidentiality protecting the R&D was Amazon the first company to come out with an e-reader Oh the first well-known one was called nook and it came out from Barnes and Noble and if as I say I've given this talk probably I don't know close to a dozen times now that I've had between 10 and 75 peoples in the room when I've done this talk and at this point I say you know how many of you have an e-reader that you read books on and almost everybody of course reads your hand and I'll say now how do you have a nook no hands are in the air how many of it have a Kindle all the hands go back up I mean all keys get one or two hands on the neck but the Nook was first to market but it's not the market leader and part of the reason is because Amazon innovated and they made their ereader better and they made it the one everybody wanted and part of that meant that they had to protect their research and development from their competitors and that meant they had to protect the confidentiality of the R&D okay now integrity maintaining the product quality their Quality Assurance QA and of course keep the product shipping so availablee does matter but as with pretty much any R&D you're gonna see confidentiality is going to be your number-one concern that's going to be a pretty standard thing but notice up in the upper right corner it's now pointing out we're looking at the CIA bisect or take any company especially larger companies that operate in many different industry sectors then you're going to see different prioritization you're going to want to prioritize the CIA in different ways in different sectors different parts of the company okay but that's like by sector okay we can tak
this same concept and extend it on by department okay so if we go over to payroll well veil ability is going to be number one you got to keep the paychecks going if you stop paying people they stop coming to work one of the first times I did this talk I haven't be standing in front of about 60 or 70 FBI agents and it was during the Laska or my shutdown and they all kind of started laughing so for most people when you stop paying them they stop coming to work okay see you do have to keep the paychecks flowing okay and they have to be accurate I don't know if you've ever had to deal with this I have my own company payroll for myself and my wife or were the only two employees and I actually hire somebody to do it for me because we kept messing it up it is so complex and I'd like to think we're not dumb people but it is so complex when you have to file this and how you have to withhold for that and and I finally just threw up my hands and and you know ask an expert please take care of this for me okay and it's the best money I've spent okay so there the integrity on these things you know the W tubes they have got to be correct and and etc the the 941 checks have got to pay the correct amounts and so I believe they the list goes on but and then you know like I say the confidentiality has to matter too in some companies in the government sector this is a minor issue everybody a role in the government sector is public knowledge everybody knows what everybody gets paid but in the private sector that's not the case I've actually had to sign non-disclosure agreements when I've gone to work for companies saying that I would not let my my co-workers know how much I am being paid because if I negotiated better and I'm getting paid more than the guy sitting next to me during the same job they didn't want that guy to know about it and so you know confidentiality does have a play there not to mention you know people have a right to privacy as far as the payroll goes but so under payroll I think that's how you would divvy the the pie chart up under accounting in general I think that well integrity has got to have the biggest slice because again you got to have very strong integrity with our financials they have to be accurate and pristine but okay now this pie chart is going to look different in a privately held company than in a publicly held company and a publicly held company and company traded on the stock market there are very very stringent rules about when you can report what to the public as far as how your you know your earnings are going and so forth you have new quarterly reports and animal reports and those reports have to be released on a very specific day and what you put in them is not optional they dictate all that to you and if you don't follow those rules the fines can go into the millions tens of millions and in some cases actually hundreds of millions of dollars okay so in a publicly traded company confidentiality would need every bit of that much of that slice to PI privately held company doesn't have those rules hanging over them those potential fines yeah I might have just a PI a bit there okay but again availability the accounting data has got to be available in order for management to make decisions based on that data so it does have its importance as well when we move over to the human resource department I give a lot of thought to this one it's the only PI I don't know if you've caught this yet it's the only PI in the entire presentation that is three equal parts okay there is your triad I guess okay but yeah in the human resource department keeping employees you know the information their Social Security numbers their payroll etc that would all have to be very confidential payroll records I've got to be you know maintained correctly again it ties back into the integrity for payroll and then availability this is a mistake a lot of companies make when they're looking at their disaster recovery planning they have their critical records program where you know if the Hurricanes are common the way it is right now on the Gulf if the hurricanes are coming in what critical records do we need to evacuate to make sure that they survived the disaster and they leave Human Resources records out of that it's a massive mistake after the hurricane you're sitting there going now who worked for me and what was I pay it okay then you know I have to basically walk up to the people you think work for you go okay first off what you do for me and second off how much should I pay I paid you that Wow you know so protecting the availability of human resources records is pretty important it really is okay so that one I actually do you know I had a hard time coming with anything other than three equal parts I thought all three pieces were pretty even there okay but so take that concept now I'm giving you three examples payroll accounting human resources obviously our ideas when I have something different the management suite is going to have something different every department within the organization is going to have they a different chart a different prioritization and where you really have to watch for the problems is well okay a perfect example in fact perhaps I might add a slide on this one it's come up in a couple of talks what happens when there's a disagreement if you will between basically the R&D department and the sales department the R&D department wants to keep the new product that they just are working on developing they want to keep it a secret so their competitors can't steal it but the sales department wants to go out and start selling it well you kind of have to tell your customer something about the product if you're going to sell them the product so those two wind up at odds with each other on a pretty regular basis and that's when security has to step in and be the mediator okay it's pretty much how that has to work okay but you know there I was using Amazon's payroll accounting and Human Resources an example I pick any company I don't care I really don't think you're going to change the pie charts to awful much when you go from one company to another as I said the accounting pie chart would have changed a little bit from a publicly traded company to a privately held company but other than that these pie charts are probably going to stay pretty static for everyone involved okay now a final thought here my original plan for this talk when I was very first putting it together I was going to have right here at least one example the game zero priority weight to one of the three either to see the eye or the a I was going to give you one example and I racked my brains I called every friend I have in this industry and after 35 years I'll have a few and I just I can't come up with it good like any good pie you've got to have all the ingredients and I could not come up with a really truly good example of where you wouldn't want that least this vo a little bit of the CD ima confidentiality integrity availability you need all three and every every every time ok I've had a couple of people propose like one individual for example said that he worked for a while in construction that's a that's a career I never had and he said the blueprints once you were on there on the job site the blueprints anybody could see up but after I started talking with him a little bit I said so if I work for your biggest competitor I'm able to walk onto the job site and see the blueprints and he's go well no we put much on the job site if you work for our competitor ok so the the the confidentiality is still being protected there it's just that anyone they do allow on the job site is allowed to see them so and of course we went on to talk further while the blueprints are being created they're closely guarded secrets so as they say when you really dig into them I've had a few people make some proposals in the various talks about that but but as we talked about them they agreed that ya know there's at least a little piece of one of the three and every example ok so kind of in summary ok stop stop focusing on the CIA is a triad I use the phrase earlier it is an unattainable ideal and that statement comes from years of trying to make it work as a triad and failing in every case because once again keys perfect world everybody gets eight hundred percent of their but they're their staff and request by nine percent of their budget request that's not where we live we live in the real world 50% of our staff requests 20% of our budget requests we don't have the resources to obtain that ideal we just can't do it so a bad to-do list of get to everything now let's have a good priority a good to-do list prioritize instead of trying to look at the CIA as a tryout of three equal parts start looking at the CIA as a method of prioritization and my experience shows that if you do that if you apply it at your company in general then the industry sectors that your organization if you you know if you have a large organization so you're in more than one energy sector all the way down to the department level and use it as a method to figure out what are the priorities for the for each of these departments and and industry sectors and so forth and when you do it that way the CIA takes you a long way as I said at the beginning it's not the CIA's fall CIA confidentiality integrity availability I still believe we need to protect all three I hope nothing in this talk has led you to think that I think otherwise but but I don't think we can apply it as a triad I think we can apply it as prioritization now with that as you can tell by this slide we've come to the end of the slides and I'm ready to take any questions you might want to throw into the chat room here feel free Carol keep I'm tempted to dive into that I'm attempted to type into the questions window and I are there questions in there I don't see anything yes I agree I'm okay I try to type in it it wouldn't let me some hoping that someone is able to type into it I will say do keep in mind you have my email address key that not IP dot-com if for some reason you're unable to type into the questions window I'm not sure what's going on there but if indeed you're unable to type your questions here and would like them answered feel free to email me and I will get back to you just as quickly as I possibly can with the with the best answer I can even if it comes down and sometimes I'll get a question from student the best way to answer it is you know let's get a phone call and work more late or recently zoom and I've answered a few questions that way but I am seeing a couple in the questions window now not the chat window but the questions window I'm not seeing either okay the first ones should be HTTP URL cos age 37 Oh 80 take you to a safe browsing extension yes that's a good question you do want to be careful with these shortened URLs it's a very good point so is tinyurl.com so I have ch3 708 e notice that is a lowercase o that takes you to a Dropbox folder I have shared with the world the same place that you are code takes you by the way it's a Dropbox folder I have shared with the world I only put things up there if I'm okay with everybody having them and so I put like this talk if you would like to download it from there Carol I believe you're also going to make it available for download too I believe I think but this talk I do three or four other night talks those are up there and a ton of other stuff that I put up there through the years all right thanks yes I put in the chat window that a copy of the slides and recording of this webcast will be available for viewing later today and can be found on the sans registration page so someone else says great presentation and the last question I see is a quick question is this triad valid for mission critical infrastructure well first I the the point of the talk is that it's not a triad it's a method of prioritization but would this method of prioritization be valid for mission-critical infrastructure if I understand the question correctly yeah it's this any place we are going to implement security I think this you know when you are when you are faced with an insurmountable challenge you have to figure out how it's about and one of my favorite quotes one of my other night talks is the 14 absolute truths of security and the fourteenth absolute truth of security says that a problem without a solution is not a problem it is a reality to be dealt with they came from Anwar Sadat but security has become a problem without a solution it is a reality we have to deal with we do not have the budget we do not have the manpower we the staffing we are always going to be short-handed and under and under budget and that means that we have to figure out a way to prioritize and make sure that we are implementing the right things and using the the you know making the best use of the the the limited resources we do have and that's why I'm such a huge advocate of taking the CI a and instead of trying to look that as an unattainable ideal of a try at looking at it as a method of prioritizing our security program so yes whether it's well pretty much everything's mission-critical anymore but whether you're looking at a mission-critical or anything else basically if you're trying to miss security I think this this still has validity other questions that's all I see Keith you can take it from here okay I'm not sure why I'm not seeing them in the chat window also Carol I hope I get a copy that can be recording I've never really heard myself before hey I hope you guys have enjoyed the talk here cya by using CIA but using it correctly for a change and kind of taking one of our industry's accepted norms conventional wisdom that CIA should be applied as three equal parts turning it on its ear and basically saying that's absolutely wrong and I have had some people firmly disagree with me on this and then as I said at the beginning that's okay but I honestly do believe it's better used as a method of prioritization I hope you've come away with an understanding near that I hope you have something here you're able to take back to the office tomorrow or you're working from home through happens to be your next security implementation let's put it that way and something that will help you to prioritize the resources you have available to you with that I'm going to thank you very much for your time I'm sure each and every one of you have something else you would rather be doing right about now so I'll go ahead and let you go but thank you for your time and I hope you've enjoyed
