Cyber Security at the University and its Impact on Software Developers

Question 1

Purpose of Cyber Security

Answer 1

Cyber Security is key to defending our information assets against a growing number of threat actors with varying levels of motivation, skill and resources.

Question 2

Cyber Security challenges

Answer 2

the threats are increasing exponentially and likely to continue increase

• Required skills are beginning less now it is possible to buy ready-made attacks from the dark web … “Hack-as-a-Service” and “Ransomware-as-a-Service”

Question 3

Risk Management approaches

Answer 3

basic steps:
* Identify
* Assess
* Treat
* Monitor and Report

There are different types of risk:
* Operational
* Financial
* Reputational
* Market – usually found in Financial Services

Question 4

Identifying Risks

Answer 4

How we identify potential risks
* Vulnerability scans
* IT operational teams
* IT projects

Question 5

Assessing Risks

Answer 5

A risk is a possible event which could cause harm or loss

the key objective is to assess the two factors that influence risk
* Likelihood – how likely is it that the event will actually happen
* Impact – the amount of harm or loss that the event will cause

Question 6

Treating Risks

Answer 6

There are different types of mitigating actions
* Acceptance – live with the risk because it is within the risk appetite
* Transference – move some or all of the risk to another party
* Avoidance – don’t to the activity in the first place so the event cannot happen
* Reduction – change something you are doing or add extra controls to reduce the likelihood, impact or both

Question 7

Monitoring and Reporting Risks

Answer 7

Need a way to report on risk especially to senior management
* Visual diagrams make great impression and are easier to consume
* Plotting Inherent Risk and also Residual Risk clearly shows the impact of the mitigating actions

Question 8

Secure Software Development Lifecycle (SDLC)

Answer 8

should ensure that the resulting software is Secure by Design and by Default

SDLC needs to take into account:
* Inception
* Analysis including definition of requirements
* Design
* Coding
* Testing – from unit testing through to user acceptance testing
* Operations and maintenance
* Retirement and decommissioning

Question 9

Open Worldwide Application Security (OWASP) Foundation

Answer 9

Works to improve the security of software through:
* Community-led open-source software projects
* Worldwide chapters and members
* Local and global conferences

Key Projects are:
* OSWAP Top Ten – 10 most critical web application security risks
* OSWAP SAMM – Software Assurance Maturity Model