What's My Security Policy Doing to My Help Desk w/ Chris Swan

November 15, 2016

What’s My Security Policy Doing to My Help Desk?

Chris Swan (@cpswan), CTO Global Infrastructure Services, CSC

Chris Swan – why me?

Combat Systems Engineer - Royal Navy

Security R&D – Credit Suisse

CTO Security - UBS

CTO – Cohesive Networks

CTO, Global Infrastructure

Services - CSC

@cpswan

Agenda

• Operational Data Mining and the 3rd DevOps Way

• The #1 issue

• A parable about 802.1X

• Finding a better way

Setting the scene:The 3 DevOps Ways andOperational Data Mining

The 3 ways

1.Flow

2.Feedback

3.Continual Learning

& Experimentation

Operational Data Mining (ODM) takes ‘data exhaust’ from service management and ancillary systems

‘Exhausting’ by Ben Salter https://flic.kr/p/8VTaMe

Operational Data Mining focusses on the 3rd Way

1.Flow

2.Feedback

& Experimentation

Data helps us find the constraints, then tells us what to do with them

‘Narrow’ by gwire https://flic.kr/p/4d3N4

Constraint unblocking helps provide better flow and feedback

1.Flow

2.Feedback

& Experimentation

Data provides a means of empowerment to front line staff

“I knew that,

I knew that we needed to do that”

So let’s start with the #1 issue

#1 - Password reset related issues

Account Login Tickets

Escalated to Other Queues

No Resolving Action

Required1

Other, Completed by Service Desk

Service Desk Incident TicketsAugust 2014 – August 2015n = 67k tickets

AD Accounts34%

Rater Portal Accounts

Mainframe Accounts

Other Accounts

Account Reset TicketsAugust 2014 – August 2015n = 21k tickets

1. There are primarily calls chasing other previously opened tickets

For incidents were the Service Desk

is the resolver of the incident,

account issues represent the vast

majority of these tickets

The Service Desk typically spends 5-

10 min of effort on each of these

reset tickets, although occasionally

tickets are re-opened again later if the

user calls back a 2nd or 3rd time.

AD account lockout issues:Multiple incidents in the past year by user

AD account lockout issues: 3+ incidents in the past year

Service desk volume for AD account locking tickets:Users with the same problem 3+ times in last year

A deeper analysis reveals that users often experience these repeat issues in quick succession

• Of those users that have the same issue multiple times, these multiple occurrences often occur in quick succession

• This, along with additional observations in the ticket notes, indicates that the help desk is often not resolving the underlying issue behind the incident which thus subsequently generates more incidents

• Users are often connected to different support personnel on each call, thus the Service Desk often does not notice that they are just constantly unlocking accounts for the same users and thus not actually fixing the root cause of the issue

A parable about WiFi authentication:Why 802.1X for BYOD can be a really bad idea

It all seems so simple

When ‘one password’ lets you down

password

Password

Finding a better way

First it was CESG in the UK

Source: http://www.theregister.co.uk/2016/05/05/stop_resetting_your_password_says_uk_spy_network/

Then NIST in the US

Source: https://nakedsecurity.sophos.com/2016/08/18/nists-new-password-rules-what-you-need-to-know/

This isn’t a withdrawal from password security

My colleagues produced a white paper on this topic

Source: http://assets1.csc.com/cybersecurity/downloads/THE_PROBLEM_WITH_P4__W0RDS_.pdf

Let’s not pretend that this is an easy fix

When systems and culture collide

Wrapping up

Summary

• Operational Data Mining and the 3rd DevOps Way

• The #1 issue

• A parable about 802.1X

• Finding a better way

Thanks to the sponsors and supporters

November 15, 2016

Time for questions?

November 15, 2016

What's My Security Policy Doing to My Help Desk w/ Chris Swan

Software

Transcript of What's My Security Policy Doing to My Help Desk w/ Chris Swan

What's my story session handout

What's my source

Dude, What's My Market Size?

What's My Next Move - CareerOneStop

What's that creature living in my cloud?

What's My Next Move? Workshop

What's In My Analytics Toolbox

What's My Type - Acting to Your Strengths

What's my home worth presentation.

What's in My Keyword Research Ttoolbox

What's New Book 2010 MY

What's In My Content Creation Toolbox

What's my candlewood lake value

What's buggin' my trees

What's my future

"Wait! What's in my Mouth?"

What's My Modularity

What's My Favorite Genre

Questioning Is My Superpower - What's Yours?

My favorite "Black Swan" quotes