Hiện trạng, đảm bảo an toàn thông tin

www.vncert.gov.vn
HIỆN TRẠNG VÀ
ĐẢM BẢO AN TOÀN THÔNG TIN
www.vncert.gov.vn
RỦI RO AN TOÀN THÔNG TIN
VÀ TỘI PHẠM MẠNG
www.vncert.gov.vn
THREATS + VULNAREBILITY -> LOSS OF SENSITIVE DATA
www.vncert.gov.vn
Malicious code
“Cyber Crime is one of the fastest
growing and lucrative industries of our
time” Dave Marcus, director of security
research of McAffee Lab
Malicious code is the most powerful
utilities of cybercrime.
www.vncert.gov.vn
Malicious code

Malicious activities in cyberspace come from many
country.

The amount of new malicious code has been increasing
www.vncert.gov.vn
Malicious code
Exploits detected and blocked by Microsoft antimalware products, 3Q10–2Q11, by targeted platform or technology
(Source : Microsoft)
www.vncert.gov.vn
Malicious code


Number of sites contain virus blocked each day
(Source : Synmatec 11/2011)
www.vncert.gov.vn
Malicious code & cyber crime
www.vncert.gov.vn
Malicious code & cyber crime

Stuxnet
www.vncert.gov.vn
www.vncert.gov.vn
Malicious code & cyber crime
Source : McAffee
www.vncert.gov.vn
Malicious code & cyber crime

Anonymous & Wikileak

Victim (No exception):

Business organization (Paypal, Visa, Master, Bank of
America etc )

FBI

US Government
www.vncert.gov.vn
www.vncert.gov.vn
www.vncert.gov.vn
www.vncert.gov.vn
Malicious code & cyber crime


Cyber crime use malicious code to attack
the important system of Vietnam
“Life and Death Command” Botnet attacked:
-
One of the biggest e-news of Vietnam - Vietnamnet
-
An information security company of Vietnam - BKAV
-
Unikey the most popular keyboard software for Vietnamese
-
Hva a famous hacker forum in vietnam
www.vncert.gov.vn
www.vncert.gov.vn
Action against cybercrime
Source : BBC.Co.uk
www.vncert.gov.vn
Action against cybercrime
Two hackers were arrested in 2010
Stole visa and Master card’s
information
www.vncert.gov.vn
WHAT WE CAN DO TO PROTECT OUR
ORGANIZATION ?
- Specify requirement and target of organization.
- Establish and implement a comprehensive
information security management system (ISMS)
which satisfy specified targets and requirement and
comply with rigorous information security standard
(ISO 27001:2005).

- Take precaution against hackers and potential
cybercrime.
- Train and improve the awareness of all staff.
- Cooperate with information security organization
(Cert/CC, Expert Group, Police etc ).
www.vncert.gov.vn
XÂY DỰNG HỆ THỐNG
BẢO VỆ AN TOÀN THÔNG
TIN TOÀN DiỆN
www.vncert.gov.vn
Các tiêu chuẩn quản lý trong CNTT


COBIT ITIL ISO27001
Function Mapping IT Process
Mapping IT Service Level
Management
Information Security
Framework
Area 4 Process and 34 Domain 9 Process 10 Domain
Issuer ISACA OGC ISO Board
Implementation Information System Audit Manage Service Level
Compliance to security
standard
www.vncert.gov.vn
ISO 27001 và một số điểm cơ bản

Định hướng : Quản lý rủi ro

Mô hình : PDCA (Plan – Do – Check -

Action)

Đảm bảo sự linh hoạt của các tổ chức
trong việc áp dụng.
www.vncert.gov.vn
Quy trình quản lý ISO 27001
www.vncert.gov.vn