Biomedical Industry Cyber Survey Excel 04 29 2015 (1)

7/26/2019 Biomedical Industry Cyber Survey Excel 04 29 2015 (1)

http://slidepdf.com/reader/full/biomedical-industry-cyber-survey-excel-04-29-2015-1 1/33

U.S. Biomedical Industry Cyber Security Assessment

SCOPE OF ASSESSMENT

RESPONSE TO T IS SUR!E" IS RE#UIRE$ B" %A&

BUR$EN ESTIMATE AN$ RE#UEST FOR COMMENT

BUSINESS CONFI$ENTIA% ' Per Section ()*+d, o- t e $e-ense Production Act

$%e &'S' Department o( Commer)e, Bureau o( *n+u tr an+ Se)urit .B*S/, O((i)e o( $e)%nolo# E aluation .O$E/, in )oor+ination it% ot%er 2e (e+eral ) ber partner , i )on+u)tin# a pilot in+e((e)t o( ) ber e)urit t%reat on t%e &'S' biome+i)al in+u tr ' $%e purpo e o( t%i ur e i to pro i+e t%e &'S' o ernment it% a ba eline un+er tan+in# o( t%e )%allen#e an+ bu ine

e)urit t%reat ' ++itionall , t%e +ata )olle)te+ ill pro i+e an o er ie o( t%e pre enti e mea ure ta2en b or#ani5ation in t%i )riti)al in+u trial e)tor'

$%e abilit o( biome+i)al )ompanie to prote)t t%eir Commer)iall Sen iti e *n(ormation .CS*/ i ital to t%e in+u tr )ontinue+ )ompetiti ene an+ o erall u))e in t%e #lobal mar2etpa e ment, bot% #o ernment an+ in+u tr ill be better in(orme+ %en +e elopin# e((e)ti e poli) re pon e an+ in e tment trate#ie to miti#ate t%e #ro in# ) ber e)urit t%reat, an+ enin+u tr to upport )riti)al national e)urit an+ )i ilian re7uirement '

re pon e to t%i ur e i re7uire+ b la .!0 &'S'C' app' Se)' 1!!/' 8ailure to re pon+ )an re ult in a maximum (ine o( 10,000, impri onment o( up to one ear, or bot%' *n(ormation (urni)on(i+ential an+ ill not be publi %e+ or +i )lo e+ ex)ept in a))or+an)e it% Se)tion 0! o( t%e De(en e "ro+u)tion )t o( 19!0, a amen+e+ .!0 &'S'C pp' Se)' 1!!/' Se)tion 0! pro%ibit t%e pin(ormation unle t%e "re i+ent +etermine t%at it it%%ol+in# i )ontrar to t%e national +e(en e' *n(ormation ill not be %are+ it% an non-#o ernment entit , ot%er t%an in a##re#atpur uant to t%e appropriate exemption (rom +i )lo ure un+er t%e 8ree+om o( *n(ormation )t .8O* /, %oul+ it be t%e ub;e)t o( a 8O* re7ue t'

Not it% tan+in# an ot%er pro i ion o( la , no per on i re7uire+ to re pon+ to nor %all a per on be ub;e)t to a penalt (or (ailure to )ompl it% a )olle)tion o( in(ormation ub;e)t to t%e r<e+u)tion )t unle t%at )olle)tion o( in(ormation +i pla a )urrentl ali+ OMB Control Number'

"ubli) reportin# bur+en (or t%i )olle)tion o( in(ormation i e timate+ to a era#e 1 %our per re pon e, in)lu+in# t%e time (or re ie in# in tru)tion , ear)%in# exi tin# +ata our)e , #at%erian+ )ompletin# an+ re ie in# t%e )olle)tion o( in(ormation' Sen+ )omment re#ar+in# t%i bur+en e timate or an ot%er a pe)t o( t%i )olle)tion o( in(ormation to B*S *n(ormation Colle)tion O*n+u tr an+ Se)urit , &'S' Department o( Commer)e, >a %in#ton, D'C' 0 30, an+ to t%e O((i)e o( Mana#ement an+ Bu+#et, "aper or2 <e+u)tion "ro;e)t .OMB Control No' 0694-0119/, >a %in#



Table o- Contents

eneral *n tru)tion

De(inition

Or#ani5ation *n(ormation

8inan)ial *n(ormation

Emplo ment *n(ormation

Cu tomer

8a)ilitie

Commer)iall Sen iti e *n(ormation .CS*/

Net or2 *n(ormation

Data Stora#e

CS* Data Ex)%an#e

C ber Se)urit "oli) an+ "ro#ram

C ber Se)urit Ser i)e

Criti)al Control

C ber $%reat an+ *n)i+ent

?o <elate+ to C ber tta)2

C ber $%reat 8o)u e+ on Emplo ee

+ an)e+ "er i tent $%reat . "$/

Collaboration an+ "artner %ip

&nite+ State o ernment .&S / i tan)e an+ Outrea)%

Certi(i)ation

BUSINESS CONFIDENTIAL - Per Section 705(d) of the Defen e Prod!ction Act

"re iou "a#e Next

Se)tion *

Se)tion **

Se)tion 1

Se)tion

Se)tion 3

Se)tion 4

Se)tion !

Se)tion 6

Se)tion

Se)tion =

Se)tion 9

Se)tion 10

Se)tion 11

Se)tion 1

Se)tion 13

Se)tion 14

Se)tion 1!

Se)tion 16

Se)tion 1

Se)tion 1=

Se)tion 19

http://var/www/apps/conversion/tmp/scratch_7/


















Section II $e-initions$erm De(inition

+ an)e+ "er i tent $%reat . "$/

+ er ar Comman+ an+ Control .C /

ir appe+ $ pe o( net or2 e)ure+ b 2eepin# it i olate+ (rom ot%er lo)al net or2 an+ t%e *nternet'

ppli)ation Bla)2li tin#

ppli)ation >%iteli tin#

Botnet )olle)tion o( *nternet-)onne)te+ pro#ram )ommuni)atin# it% ot%er imilar pro#ram in or+er to per(orm ta 2 '

Clou+ Stora#e

Commer)iall Sen iti e *n(ormation .CS*/

Criminal S n+i)ate Net or2 or or#ani5ation o( a)tor en#a#e+ in )riminal an+ ne(ariou atta)2 on in(ormation tem '

C ber tta)2

C ber Se)urit

C ber Se)urit Ser i)e "ro i+er

"re iou "a#e Next "a#e

<e(er to a per i tent t pe o( ) ber atta)2 +e i#ne+ to e a+e an or#ani5ation@ pre ent te)%ni)al an+ pro)e)ountermea ure ' "$ are pe)i(i)all +e i#ne+ to b pa (ire all , intru ion +ete)tion tem , an+ anti-mal are pro#ram '

) ber atta)2 t%at utili5e a )ompromi e+ or in(e)te+ )omputer tem t%at t%en allo t%e %a)2er to )ontrol an++ire)t a++itional atta)2 or a)tion a#ain t ot%er tem an+ or net or2 (rom t%at )ompromi e+ tem'

net or2 a+mini tration pra)ti)e u e+ to pre ent t%e exe)ution o( un+e irable pro#ram b pla)in# t%em on anunaut%ori5e+ li t'

net or2 a+mini tration pra)ti)e u e+ to pre ent unaut%ori5e+ pro#ram (rom runnin# b pla)in# appro e+appli)ation on an exe)utable li t'

er i)e mo+el in %i)% +ata i maintaine+, mana#e+, an+ ba)2e+ up remotel an+ ma+e a ailable to u er o era net or2'

"ri ile#e+ or proprietar in(ormation %i)%, i( )ompromi e+ t%rou#% alteration, )orruption, lo , mi u e, orunaut%ori5e+ +i )lo ure, )oul+ )au e eriou %arm to t%e or#ani5ation o nin# it'

n atta)2, ia ) ber pa)e, tar#etin# an enterpri e u e o( ) ber pa)e (or t%e purpo e o( +i ruptin#, +i ablin#,+e tro in#, or mali)iou l )ontrollin# a )omputin# en ironment in(ra tru)tureF or +e tro in# t%e inte#rit o( t%e +ataor tealin# )ontrolle+ in(ormation'

C ber e)urit i t%e bo+ o( te)%nolo#ie , pro)e e an+ pra)ti)e +e i#ne+ to prote)t net or2 , )omputer ,pro#ram an+ +ata (rom atta)2, +ama#e or unaut%ori5e+ a))e '

n in+i i+ual or or#ani5ation t%at pro i+e ) ber e)urit er i)e t%at in)lu+e but are not limite+ to: net or2e)urit en#ineerin#, net or2 e)urit monitorin#, +e(en e an+ te tin#, ) ber e)urit trainin#, an+ poli)

+e elopment, a ell a re pon+in# to, an+ reme+iation o(, ) ber in)i+ent '

$%e politi)all moti ate+ u e o( )omputer an+ in(ormation te)%nolo# to )au e e ere +i ruption or i+e prea+



Section II$erm De(inition

8ull $ime E7ui alent .8$E/ Emplo ee

Ga)2ti i t )omputer %a)2er %o e a)ti it i aime+ at promotin# a o)ial or politi)al )au e'

Gone pot

*n(ormation Se)urit

*n(ormation $e)%nolo# .*$/

*n(ra tru)ture a a Ser i)e

*ntranet

*ntru ion Dete)tion S tem .*DS/

*ntru ion "re ention S tem .*"S/

Hoint Multi $enan)

"re iou "a#e Next "a#e$e-initions (continued)

Emplo ee %o or2 (or 40 %our in a normal or2 ee2' Con ert part-time emplo ee into J(ull-time e7ui alent Jb ta2in# t%eir or2 %our a a (ra)tion o( 40 %our '

+e)o )omputer tem (or trappin# %a)2er or tra)2in# un)on entional or ne %a)2in# met%o+ ' Gone pot are

+e i#ne+ to purpo el en#a#e an+ +e)ei e %a)2er an+ i+enti( mali)iou a)ti itie per(orme+ o er t%e *nternet'Multiple %one pot )an be et on a net or2 to (orm a %one net'

$%e prote)tion o( in(ormation an+ in(ormation tem (rom unaut%ori5e+ a))e , u e, +i )lo ure, +i ruption,mo+i(i)ation, or +e tru)tion in or+er to pro i+e )on(i+entialit , inte#rit , an+ a ailabilit '

n e7uipment or inter)onne)te+ tem or ub tem o( e7uipment t%at i u e+ in t%e automati) a)7ui ition,tora#e, manipulation, mana#ement, mo ement, )ontrol, +i pla , it)%in#, inter)%an#e, tran mi ion, or

re)eption o( +ata or in(ormation' $%e term in(ormation te)%nolo# in)lu+e )omputer , an)illar e7uipment,o(t are, (irm are an+ imilar pro)e+ure , er i)e .in)lu+in# upport er i)e /, an+ relate+ re our)e '

"ro i+e t%e )omputin# in(ra tru)ture, p% i)al or .7uite o(ten/ irtual ma)%ine an+ ot%er re our)e li2e irtual-ma)%ine +i 2 ima#e librar , blo)2 an+ (ile-ba e+ tora#e, (ire all , loa+ balan)er , *" a++re e , irtual lo)al areanet or2 et)' Example : ma5on EC , >in+o 5ure, <a)2 pa)e, oo#le Compute En#ine'

*ntranet i t%e #eneri) term (or a )olle)tion o( pri ate )omputer net or2 it%in an or#ani5ation' n intranet u enet or2 te)%nolo#ie a a tool to (a)ilitate )ommuni)ation bet een people or or2 #roup to impro e t%e +ata

%arin# )apabilit an+ o erall 2no le+#e ba e o( an or#ani5ation@ emplo ee ' *ntranet utili5e tan+ar+ net or2%ar+ are an+ o(t are te)%nolo#ie li2e Et%ernet, >i-8i, $C" *", >eb bro er an+ >eb er er '

+e i)e or o(t are appli)ation t%at monitor net or2 or tem a)ti itie (or mali)iou a)ti itie or poli)iolation an+ pro+u)e report to a mana#ement tation'

net or2 e)urit t%reat pre ention te)%nolo# t%at examine net or2 tra((i) (lo to +ete)t an+ pre entulnerabilit exploit '

Hoint Multi $enan) i an in(ormation net or2 operatin# mo+el in %i)% t o or more or#ani5ation u e %are+in(ra tru)ture, in)lu+in# net or2 %ar+ are an+ o(t are plat(orm , an+ or in(ormation tora#e a et to (a)ilitatemore e((e)ti e )ollaboration an+ to a)%ie e %i#%er operational an+ )o t e((i)ien)ie ' $%i bu ine mo+el )anin)lu+e t%e pro i ionin# o( bu ine an+ re ear)% o(t are tool to enable )ompanie an+ or#ani5ation tooperate on )ommon tem to (a)ilitate )ro or#ani5ational )ollaboration an+ bu ine a)ti itie ' n+, it )an





Section 1.a2 Or3ani4ation In-ormation

'

"ro i+e t%e (ollo in# in(ormation (or our or#ani5ation:

Or#ani5ation Name8a)ilit Name .i( appli)able/Street ++reCitStateKip Co+e>eb ite"%one Number

B'

"ro i+e t%e (ollo in# in(ormation (or our parent or#ani5ation, i( appli)able'

Or#ani5ation NameStreet ++reCitStateCountr"o tal Co+e Kip Co+e

C'

D' * our or#ani5ation publi)l tra+e+ or pri atel %el+L Sto)2 S mbol, i( appli)able:

E'

*+enti( an+ ran2 in +e )en+in# or+er all entitie t%at +ire)tl or in+ire)tl o n or %a e bene(i)ial o ner %ip o( (i e per)ent or more o( our or#ani5ation:

Entit Name Street ++re

1

34!6

=9

10

8'"oint o( )onta)t (or t%i ur e :

Name $itle "%one Number E-ma

'"oint o( )onta)t (or internal ) ber e)urit pro#ram :

Name $itle "%one Number E-ma

"re iou "a#e

Doe t%i ur e re pon e )apture t%e operation o( our %ole or#ani5ation or t%at o( an in+i i+ual bu ine unit +i i ionL

Note: ll +ata in t%i ur e re pon e mu t be reporte+ at t%e ame or#ani5ational le el'

"er)enta#e o( 8inan)ial*ntere t Gel+



'1 "rimar Bu ine ?ine

++itional Bu ine ?ine

3 ++itional Bu ine ?ine

4 ++itional Bu ine ?ine

! ++itional Bu ine ?ine

B'

Doe our or#ani5ation parti)ipate in t%e (ollo in# biome+i)al e#ment L *( e , pro i+e a brie( +e )ription'

1 "%arma)euti)al

Biote)%nolo#

3 Me+i)al De i)e

4 Dia#no ti)

! Ot%er

Comment :


"re iou "a#e Next "a#eSection 1.b2 Or3ani4ation In-ormation (continued)

*+enti( our or#ani5ation@ primar bu ine line an+ pro i+e a brie( +e )ription' *( our or#ani5ation %a a++itional bu ine line li t t%em on line -! an+ pro i+e abrie( +e )ription'

Bu ine ?ine.+rop-+o n/

De )ribe. rite-in/

"arti)ipateL.+rop-+o n/

De )ribe. rite-in/





Section 52 Financial In-ormation

'

Sour)e o( Data:<eportin# S)%e+ule:

1 $otal Net Sale .an+ ot%er re enue/

$otal < D Expen+iture

reporte+ on our in)ome tatement

B'

Sour)e o( Expen+iture Data:<eportin# S)%e+ule:

013 014

1 $otal Operatin# Expen+iture

*n(ormation Se)urit <elate+ Expen+iture

3 C ber Se)urit <elate+ Expen+iture

reporte+ on our in)ome tatement

C' Ga e re)ent ) ber in)i+ent a)ro t%e mar2etpla)e )au e our or#ani5ation to in)rea e it in(ormation e)urit bu+#etL

Comment :


"re iou "a#e

"ro i+e our or#ani5ation@ $otal Net Sale an+ $otal < D Expen+iture (or 014'

Note: <e)or+ in $%ou an+ , e'#' 1 ,000'00 ur e input 1

"ro i+e our or#ani5ation@ $otal Operatin# Expen+iture , *n(ormation Se)urit <elate+ Expen+iture an+ C ber Se)urit <elate+ Expen+iture (or 013 an+ 014 an+ pro i+e a

Note: <e)or+ in $%ou an+ , e'#' 1 ,000'00 ur e input 1





Section 62 Em7loyment In-ormation

'

Sour)e o( Data:<eportin# S)%e+ule:

01!

1 $otal 8ull-$ime E7ui alent .8$E/ Emplo ee

8$E t%at or2 on ) ber e)urit -relate+ a)ti itie

B'

E timate t%e number o( on- ite an+ external 8$E )ontra)tor upportin# ) ber e)urit -relate+ a)ti ite at our or#ani5ation'

1 On-Site Contra)tor

External Contra)tor

C'

8$E Emplo ee On-Site Contra)tor

$otal:

1

3

?ine 1-3 mu t um to 100 0" 0"

Comment :



"ro i+e our or#ani5ation@ $otal 8ull-$ime E7ui alent .8$E/ emplo ee (or 01!' $%en, e timate t%e number o( our 8$E t%at or2 on) ber e)urit -relate+ a)ti itie '

8or 8$E emplo ee an+ on- ite )ontra)tor t%at or2 on ) ber e)urit -relate+ a)ti itie , e timate t%e per)ent t%at are &'S' an+ non-&'S')iti5en '

&'S' Citi5en.a a per)ent o( $otal/

Non-&'S' Citi5en.a a per)ent o( $otal/

&n2no n Citi5en %ip.a a per)ent o( $otal/



Section 82 Customers

'

Doe our or#ani5ation ell to )ommer)ial )u tomer L

1

34!6

=9

10

B'

Doe our or#ani5ation ell +ire)tl or in+ire)tl to t%e &nite+ State o ernment .&S /L

*( e , li t our or#ani5ation@ top ten &S )u tomer b 014 ale , ran2e+ in +e )en+in# or+er' "ro i+e t%e &S )u tomer name, t%e &S Department #en) , an+ lo)ation .)

1

34!6

=9

10

Comment :


"re iou "a#e

*( e ,li t our or#ani5ation@ top ten )ommer)ial )u tomer ba e+ on 014 ale , ran2e+ in +e )en+in# or+er' "ro i+e t%e )u tomername an+ t%eir lo)ation .)it , tate, )ountr /'

Cu tomer Name. rite-in/

Cit. rite-in/

State.+rop-+o n/

&S Cu tomer Name. rite-in/

&S Department #en). rite-in/

Cit. rite-in/





Section *2 Facilities

Doe our or#ani5ation %a e multiple (a)ilitie .in)lu+in# lea e+ an+ o ne+ (a)ilitie /L

?o)ation

1

34!6

=9

1011113141!161

1=19

01

34!

Comment :


"re iou "a#e

*( e , i+enti( all &'S' an+ non-&'S' (a)ilitie ' "ro i+e t%e lo)ation o( t%e (a)ilit an+ in+i)ate it primar operation' *( our or#ani5ation %a more t%an ! (a)ilitie )onta)t B*S

8a)ilit Name. rite-in/ Cit

. rite-in/State

.+rop-+o n/Countr

.+rop-+o n/



Section 92 Commercially Sensiti0e In-ormation +CSI,

'

Commer)iall Sen iti e *n(ormation .CS*/:

Cu tomer )lient in(ormation

8inan)ial in(ormation an+ re)or+

Guman re our)e in(ormation emplo ee +ata

*n(ormation ub;e)t to export )ontrol re#ulation .E < an+ or *$ </

*ntelle)tual propert relate+ in(ormation

Manu(a)turin# an+ pro+u)tion line in(ormation

"atent an+ tra+emar2 in(ormation

<e#ulator )omplian)e in(ormation

<e ear)% an+ +e elopment .< D/ relate+ in(ormation

Suppl )%ain an+ our)in# in(ormation

Ot%er . pe)i( %ere/

Comment :



Doe our or#ani5ation %a e +e(ine+, tru)ture+ met%o+ (or a)ti el prote)tin# t%e (ollo in# t pe o( Commer)iall Sen iti e *n(ormation . ee

+e(inition /L

Ae No.+rop-+o n/

*nternal )ommuni)ation in)lu+in# ne#otiation point , mer#er an+ a)7ui ition plan , an+ or)orporate trate#





Section (.a2 Net:or; In-ormation

' *n+i)ate %o i re pon ible (or our or#ani5ation@ internal *$ net or2 :

B' *n+i)ate %o i re pon ible (or our or#ani5ation@ external *$ net or2 :

C'

*( our or#ani5ation %a an external pro i+er t%at are re pon ible (or it *$ net or2 , pro i+e t%e name an+ t pe o( pro i+er' Next, in+i)ate t%eir lo)at ion an+ ele)t

1

34

!6

=9

1011113

141! P

Comment :

BUSINESS CONF

"re iou "a#e

External *$ Ser i)e "ro i+er . rite-in/

$ pe o( "ro i+er .+rop-+o n/

Cit. rite-in/

State.+rop-+o n/

Countr.+rop-+o



'

Doe our or#ani5ation@ internal an+ or external net or2. / )onne)t to t%e *nternetL

*( e , pro i+e t%e external (a)in# *" ++re .e / an+ publi) +omain name. / belo '

External 8a)in# *" ++re e.e /: "ubli) Domain Name. /:

1 1

3 3

4 4! !

B'

Doe our or#ani5ation %a e ;oint multi tenan) a#reement relate+ to t%e u e o( CS* +ata in t%e (ollo in# . ee +e(inition /L

1 *n(ra tru)ture a a Ser i)e

"lat(orm a a Ser i)e

3 So(t are a a Ser i)e

Comment :


"re iou "a#eSection (.b2 Net:or; In-ormation (continued)

*nternal Net or2.+rop-+o n/ External Net.+rop-+o n





' Doe our or#ani5ation en)r pt it CS* +ataL

B' E timate t%e per)ent o( CS* +ata our or#ani5ation en)r pt :

C'

Doe our or#ani5ation en)r pt CS* +ata in tora#e .at re t/L

*( e , at %at le el o( en)r ptionL

Explain:

D'

Doe our or#ani5ation en)r pt +ata tran mitte+ a)ro internal net or2 L *( e , at %at le el o( en)r ptionL

*( e , at %at le el o( en)r ptionL

Explain:

E'Doe our or#ani5ation allo remote a))e to CS* +ataL

*( e , %o i CS* +ata remotel a))e e+L

8' Doe our or#ani5ation ele)troni)all atermar2 an o( it CS* +ata . ee +e(inition /L

Comment :


"re iou "a#e NexSection (.c2 Net:or; In-ormation (continued)

Doe our or#ani5ation en)r pt +ata meant (or tran mi ion outi +e o( ouror#ani5ation@ net or2 L






'

*+enti( %ere our or#ani5ation pur)%a e an+ or a)7uire o(t are, %ar+ are, an+ portable ele)troni) +e i)e ."ED /' Sele)t all t%at appl :

So(t are

Gar+ are

"ortable Ele)troni) De i)e ."ED /

Ot%er . pe)i( %ere/

B'

*+enti( t%e part re pon ible (or pur)%a in# an+ or a)7uirin# o(t are, %ar+ are, an+ portable ele)troni) +e i)e ."ED / (or our or#ani5ation' Sele)t all t%at appl :

So(t are

Gar+ are

"ortable Ele)troni) De i)e ."ED /

Ot%er . pe)i( %ere/

Comment :

BUSINESS CONFI$ENTIA% ' Per Section ()*+d, o- t e $e-ense Productio

"re iou "a#eSection (.d2 Net:or; In-ormation (continued)

Dire)tl (romManu(a)turer

.+rop-+o n/

ut%ori5e+ Di tributor .+rop-+o n/

Ot%er Di tributor .+rop-+o n/

ut%ori5e+ <e eller .+rop-+o n/

Ot%er <.+rop-+

*nternal Sta(( .+rop-+o n/

Con ultant External Contra)tor .+rop-+o n/





Section <.a2 $ata Stora3e

'Doe our or#ani5ation operate it o n +ata )enter in t%e &'S'L

*( e , %o man +ata )enter +oe our or#ani5ation operate in t%e &'S'L

B'Doe our or#ani5ation operate it o n +ata )enter out i+e t%e &'S'L

*( e , %o man +ata )enter +oe our or#ani5ation operate out i+e t%e &'S'L

C' * our or#ani5ation@ CS* +ata tore+ in lo)ation out i+e t%e &'S' b a parent or#ani5ation an+ or an a((iliate+ ub i+iar L *( e , )omplete D an+ E belo '

D' E timate t%e per)ent o( our or#ani5ation@ CS* +ata t%at i tore+ in lo)ation out i+e t%e &'S' b a parent or#ani5ation or an a((iliate+ ub i+iar :

E'

?i t t%e name o( ea)% parent or#ani5ation an+ or a((iliate+ ub i+ar t%at tore our CS* +ata at lo)ation out i+e t%e &'S', t%eir lo)ation, an+ t%e )ount .ie / %ere t%e CS* +ata i tore+'

1

34!6

=9

10

Comment :

BUSINESS CONFI$ENTIA% ' Per Section ()*+d, o- t e $e-ense Producti

"re iou "a#e

Name o( "arent Or#ani5ation ((iliate+Sub i+iar

. rite-in/

<elation %ip.+rop-+o n/

Cit. rite-in/

State.+rop-+o n/

Countr.+rop-+o n/

Countr

.





'Doe our or#ani5ation u e an external )lou+ er i)e or external +ata tora#e pro i+erL

*( e , +oe our or#ani5ation re tri)t or pro%ibit our external )lou+ er i)e or external +ata tora#e pro i+er. / (rom torin# CS* +ata out i+e o( t%e &'S'L

B'

1

34!6

=9

10

C' E timate t%e per)ent o( our or#ani5ation@ CS* +ata t%at i tore+ it% ea)% o( t%e (ollo in#:

D' Doe our or#ani5ation internall ba)2-up an o( it CS* +ata t%at i tore+ it% an out i+e pro i+erL

E'Doe our or#ani5ation operate an internal )lou+ to tore CS* +ataL

*( e , e timate t%e per)ent o( our or#ani5ation@ CS* +ata t%at i tore+ on our or#ani5ation@ internal )lou+:

8' *n t%e next ear, ill our or#ani5ation@ +eman+ (or )lou+ tora#e in)rea e, +e)rea e, or remain t%e ameL

Comment :

BUSINESS CONFI$ENTIA% ' Per Section ()*+d

"re iou "a#eSection <.b2 $ata Stora3e (continued)

*( our or#ani5ation %a external )lou+ er i)e an+ or external +ata tora#e pro i+er. /, li t t%e name, t pe, an+ lo)ation o( ea)% pro i+er' 8or ea)% i+enti(ie+ pro i+er, in+i)*( our or#ani5ation@ CS* +ata i tore+ out i+e o( t%e &'S', in+i)ate t%e )ountr .ie / %ere our CS* +ata i tore+'

Name o( "ro i+er . rite-in/

$ pe o( "ro i+er .+rop-+o n/

Cit. rite-in/

State.+rop-+o n/

Coun.+rop-+





Section =.a2 CSI $ata E>c an3es

' a )on+ition o( +oin# bu ine it% a non-&'S' entit , %a our or#ani5ation e er been re7ue te+ or re7uire+ to #rant a))e to our or#ani5ation@ CS* +ataL

B' a )on+ition o( +oin# bu ine it% a non-&'S' entit , %a our or#ani5ation e er been re7ue te+ or re7uire+ to #rant a))e to our or#ani5ation@ net or2 L

C'

*( our or#ani5ation an ere+ e to eit%er ue tion or B, li t t%e name o( t%e non-&'S' entit an+ t%eir lo)ation' $%en, in+i)ate i( a))e a eit%er re7ue te+ or re7

?o)ation ))e <e pon e

1

34!6

=9

10

Comment :

"re iou "a#e

Name o( non-&'S' Entit. rite-in/

Cit. rite-in/

Countr.+rop-+o n/

))e toor#ani5ation@

net or2 re7ue te+or re7uire+L

.+rop-+o n/

Or#ani5ationre pon e re#ar+in#

net or2.+rop-+o n/

))e to CS* +atare7ue te+ or

re7uire+L.+rop-+o n/





'

Doe our or#ani5ation ex)%an#e our CS* +ata it% an external or#ani5ation .in)lu+in# upplier , )u tomer , ub)ontra)tor , non-&'S' o ne+ parent )ompan , et)'/ or

*( e , li t t%e name o( all t%e external or#ani5ation it% %i)% ou ex)%an#e CS* +ata an+ i+enti( t%eir lo)ation' Next, in+i)ate %at t pe o( CS* +ata ou ex)%a

?o)ation

1

34!6

=9

1011113

141!1611=19

01

34!

Comment :

"re iou "a#eSection =.b2 CSI $ata E>c an3es (continued)

Name o( External Or#ani5ation. rite-in/

$ pe o( External Or#ani5ation.+rop-+o n/

Cit. rite-in/

State.+rop-+o n/

Cou.+rop-





Section 1).a2 Cyber Security Policy and Pro3rams

'

Doe our or#ani5ation %a e a ritten *$ a))eptable u e poli) L

*( e , %o (re7uentl i it re ie e+ an+ or up+ate+L

Explain:

B'

Doe our or#ani5ation emplo a +e(ine+ et o( ritten ) ber e)urit pra)ti)e an+ pro)e+ure L

*( e , %o (re7uentl i it re ie e+ an+ or up+ate+L

Explain:

C'Doe our or#ani5ation pro i+e ) ber e)urit *$ trainin# to emplo ee L

Explain:

D'>%at per)ent o( emplo ee re)ei e ) ber e)urit trainin# pro i+e+ b our or#ani5ationL

Go (re7uentl i t%i trainin# re7uire+L

E'>%at per)ent o( our or#ani5ation@ internal )ontra)tor re)ei e ) ber e)urit trainin# pro i+e+ b our or#ani5ationL

Go (re7uentl i t%i trainin# re7uire+L

8'Explain:

'

Doe our or#ani5ation limit emplo ee a))e to CS* +ata ia t%e (ollo in# )ontrol :

"rin)iple o( lea t pri ile#e

Separation o( +utie

<otation o( +utie

$ime o( +a re tri)tion

<ole or <ule et ba e+ a))e )ontrol

) (


re emplo ee at our or#ani5ation pro i+e+ it% ritten in tru)tion on %o to be t in(orm mana#ement o( u pe)te+ or 2no n ) bere)urit in)i+ent L

'Ae No.+rop-+o n/

Explain. rite-in/






'

Doe our or#ani5ation (a)e an o( t%e (ollo in# )%allen#e %en prote)tin# it operation a#ain t ) ber e)urit ri 2 L *( e , explain'

C%allen#e

*na+e7uate an+ or timel t%reat in(ormation

*n u((i)ient bu+#et re our)e

?a)2 o( traine+ ) ber e)urit per onnel

Ot%er . pe)i( %ere/

B'Doe our or#ani5ation )urrentl %a e a ) ber e)urit in uran)e poli) L

*( e , explain'

Comment :


"re iou "a#e Next "a#eSection 1).b2 Cyber Security Policy and Pro3rams (continued)

Ae No.+rop-+o n/

Explanation. rite-in/

?o prioriti5ation o( ) ber e)urit b enior

or#ani5ational lea+er %ip"oor )ollaboration on ) ber e)urit i uea)ro bu ine line

?a)2 o( bu -in (rom emplo ee to a+%ere to) ber e)urit poli)ie an+ pra)ti)e

?imite+ 2no le+#e o( ) ber e)urit i ue an+ri 2





Section 112 Cyber Security Ser0ices

' *+enti( t%e primar pro i+er. / o( our or#ani5ation@ ) ber e)urit er i)e :

B'

*+enti( all external ) ber e)urit pro i+er , t%eir lo)ation, an+ ele)t t%e er i)e. / t%e pro i+e to our or#ani5ation'

1 Net or2 +e(en eNet or2 monitorin#

3 $rainin#

4 <e pon e an+ reme+iation

! Net or2 en#ineerin#6 Ot%er

=9

10

Comment :

BUSINESS CONFI$ENTIA% ' Per Section ()*+d, o- t e $e-ense Produc

"re iou "a#e

Name o( External C ber Se)urit"ro i+er

. rite-in/

Cit. rite-in/

State.+rop-+o n/

Countr.+rop-+o n/

Ser i)e "ro i+e+ 1.+rop-+o n/





Section 152 Critical Controls

'

*+enti( %i)% o( t%e (ollo in# ) ber e)urit )ontrol our or#ani5ation a)ti el emplo b i+enti( in# %et%er t%e are per(orme+ b internal ta((, )ontra)tor , bot%, or neit%er'

C ber Se)urit Control

))ount Monitorin# an+ Control ppli)ation So(t are Se)uritBoun+ar De(en eContinuou Iulnerabilit e ment an+ <eme+iationControlle+ ))e Ba e+ on t%e Nee+ to QnoControlle+ & e o( +mini trati e "ri ile#eData "rote)tionData <e)o er Capabilit*n)i+ent <e pon e an+ Mana#ement*n entor o( ut%ori5e+ an+ &naut%ori5e+ De i)e*n entor o( ut%ori5e+ an+ &naut%ori5e+ So(t are?imitation an+ Control o( Net or2 "ort , "roto)ol , an+ Ser i)eMaintenan)e, Monitorin#, an+ nal i o( u+it ?o#Mal are De(en e"enetration $e t an+ <e+ $eam Exer)i eSe)ure Con(i#uration (or Gar+ are an+ So(t are on Mobile De i)e , ?aptop , >or2 tation , an+ Ser erSe)ure Con(i#uration (or Net or2 De i)e u)% a 8ire all , <outer , an+ S it)%eSe)ure Net or2 En#ineerin#Se)urit S2ill e ment an+ ppropriate $rainin# to 8ill ap>irele ))e ControlOt%er . pe)i( %ere/Ot%er . pe)i( %ere/

B'Doe our or#ani5ation in)orporate a %one pot me)%ani m it%in it *$ in(ra tru)ture . ee +e(inition /L

Explain:

Comment :


"re iou "a#e Next "

"er(orme+ b :.+rop-+o n/





Section 16.a2 Cyber T reats and Incidents

'

Commer)ial )ompetitor .+ome ti)/

Commer)ial )ompetitor .(orei#n/

C ber )riminal

Ga)2ti i t

*n i+er t%reat

Nation- tate a)torOt%er . pe)i( %ere/

B'

Countr 1

Countr

Countr 3

Countr 4

Countr !

C'

Go )on)erne+ i our or#ani5ation about ea)% o( t%e (ollo in# ) ber in)i+ent L

*n)i+ent $ pe Con)ern

$ar#ete+ atta)2

Net or2 intru ion

Di tribute+ Denial o( Ser i)e .DDoS/ atta)2"%i %in# atta)2

Ot%er . pe)i( %ere/

Ot%er . pe)i( %ere/

D'

<ate t%e importan)e o( ea)% o( t%e (ollo in# element a part o( our or#ani5ation@ o erall ) ber e)urit plan'

"rote)tin# a#ain t t%e lo o( in)ome mar2et %are

"rote)tin# a#ain t t%e lo )ompromi e o( CS* +ata

Compl in# it% le#al re#ulator re7uirement

"rote)tin# or#ani5ation reputation bran+

En urin# )ontinuit o( bu ine operation

Ot%er . pe)i( %ere/


On a )ale (rom 1 . er lo t%reat/ to ! . er %i#% t%reat/ in+i)ate t%e +e#ree to %i)% ea)% o( t%e (ollo in# t pe o( a)tor repre ent a t%reat to our or#ani5ationCS* +ata:

re t%ere an pe)i(i) nation- tate a)tor t%at po e a %i#% t%reat to our or#ani5ationL*( e , pe)i( belo '





'

Mali)iou C ber *n)i+ent ble to +ete)t pre ent in)i+entL$otal Number o( Mali)iou C ber *n)i+ent

013 014 01! .to +a

+ er ar Comman+ an+ Control .C /Bein# t%e re)ipient o( pear p%i %in# me a#e

Bein# (rau+ulentl repre ente+ a a en+er o( p%i %in# me a#e

Bot 5ombie it%in t%e or#ani5ationDenial o( er i)e atta)2Exploit o( )lient eb bro er Exploit o( DNS er er Exploit o( u er@ o)ial net or2 pro(ileExploit o( irele net or2

*n i+er abu e o( *nternet a))e or e-mail?aptop or mobile %ar+ are t%e(t or loMal are in(e)tion"a or+ ni((in#S tem penetration b out i+er $%e(t o( or unaut%ori5e+ a))e to intelle)tual propert b ) ber mean

$%e(t o( or unaut%ori5e+ a))e to "er onall *+enti(iable *n(ormation ."**/

$%e(t o( or unaut%ori5e+ a))e to "rote)te+ Gealt% *n(ormation ."G*/

&naut%ori5e+ a))e or pri ile#e e )alation b in i+er Ot%er . pe)i( %ere/Ot%er . pe)i( %ere/Ot%er . pe)i( %ere/

Comment :


"re iou "a#e NSection 16.b2 Cyber T reats and Incidents (continued)

*n+i)ate %et%er or not our or#ani5ation or e)urit pro i+er i able to +ete)t an+ or pre ent t%e (ollo in# t pe o( mali)iou ) ber in)i+ent '

*( e , e timate t%e number o( mali)iou ) ber in)i+ent pre ente+ an+ or +ete)te+ (or 013, 014, an+ 01! .to +ate/'

Extortion or bla)2mail a o)iate+ it% t%reat o( atta)2 or relea e o( tolen+ata

$%e(t o( or unaut%ori5e+ a))e to intelle)tual propert b mean ot%er t%an) ber





Section 182 %oss Related to Cyber Attac;s

'

Durin# t%e la t 36 mont% , %a our or#ani5ation experien)e+ an o( t%e (ollo in# #lobal mar2et anomalie po ibl a o)iate+ it% t%e )ompromi e o( CS* +ataL *( e , explain'

nomal

Emer#en)e o( ne +ome ti) )ompetitionEmer#en)e o( ne (orei#n )ompetition

Compromi e+ ne#otiation tal2in# point or en iti e internal +ata

Departure o( 2e emplo ee. /

Ot%er . pe)i( %ere/Ot%er . pe)i( %ere/Ot%er . pe)i( %ere/

B'

Durin# t%e la t 36 mont% , %a our or#ani5ation experien)e+ an o( t%e (ollo in# impa)t +ue to mali)iou ) ber a)ti it L *( e , in+i)ate t%e impa)t le el an+ explain'

*mpa)t

Di ruption to normal operation be)au e o( tem a ailabilit problem

Dama#e or t%e(t o( *$ a et an+ in(ra tru)ture*n)urre+ )o t o( +ama#e a e ment an+ reme+iationBu ine interruptionEx(iltration o( CS* +ata$%e(t o( per onnel in(ormationDama#e to o(t are an+ or our)e )o+e

$%e(t o( o(t are an+ or our)e )o+eDama#e to )ompan pro+u)tion )apabilitie or temDe tru)tion o( in(ormation a et<eputation lo , mar2et %are, an+ bran+ +ama#eOt%er . pe)i( %ere/

"re iou "a#e

Experien)e+L.+rop-+o n/

Explain. rite-in/

ppearan)e o( imilar pro+u)t or a)ti itie .potentiall on an a))elerate+)%e+ule/

ppearan)e o( a))e to internal 2no le+#e o( pen+in# mer#er an+a)7ui ition or ot%er bu ine enture

ppearan)e o( a))e to internal 2no le+#e o( uppl a#reement , pri)in#,or ot%er bu ine a)ti itCompetitor patent pro+u)t imme+iatel be(ore our or#ani5ation inten+e+to +o o

"art .ie / in7uirin# about or in e tin# in our or#ani5ation be(ore or a(ter aerie o( ) ber a)ti it i +ete)te+

"art .ie / intere te+ in pur)%a in# our or#ani5ation be(ore or a(ter aerie o( ) ber a)ti it i +ete)te+

Ae No.+rop-+o n/

*mpa)t ?e el.+rop-+o n/

Explain. rite-in/

& er i+le time an+ lo t pro+u)ti it be)au e o( +o ntime or tem

per(orman)e +ela





Section 1*2 Cyber T reats Focused on Em7loyees

'Doe our or#ani5ation %a e a ritten emplo ee )on+u)t poli) relate+ to o)ial me+ia .?in2e+*n, 8a)eboo2, $ itter, et)'/L

Explain:

B'Doe our or#ani5ation allo a))e to o)ial me+ia .?in2e+*n, 8a)eboo2, $ itter, et)'/ an+ per onal e-mail eb ite ia )ompan net or2 an+ or +e i)e L

Explain:

C'Ga e an o( our emplo ee reporte+ bein# approa)%e+ on o)ial me+ia .?in2e+*n, 8a)eboo2, $ itter et)'/ (or CS* relate+ in(ormationL

Explain:

D'Doe our or#ani5ation %a e a brin# our o n +e i)e poli) L

Explain:

E'Do emplo ee ta2e "ortable Ele)troni) De i)e ."ED / t%at )ontain CS* in(ormation to (orei#n )ountrie L

Explain:

8'Doe our or#ani5ation %a e a poli) relate+ to emplo ee brin#in# "ED t%at )ontain CS* in(ormation to (orei#n )ountrie L

Explain:

'Doe our or#ani5ation %a e a poli) to )%e)2 "ED %en emplo ee return (rom (orei#n tra elL

Explain:

G' Explain:

Comment :


"re iou "a#e

Ga e an o( our emplo ee reporte+ t%e t%e(t or potential )ompromi e .unaut%ori5e+ a))e / o( t%eir "ED %ile tra elin# to (orei#n )ountrie L *( e , explain an+ in)lu+et%e lo)ation. / o( t%e in)i+ent. /'



Section 192 Ad0anced Persistent T reat +APT,

' Can our or#ani5ation +ete)t an + an)e+ "er i tent $%reat . ee +e(inition /L

B' Durin# t%e pa t 36 mont% , %a our or#ani5ation been ub;e)t to an + an)e+ "er i tent $%reat . "$/L

C' Go man eparate "$-relate+ in)i+ent +i+ our or#ani5ation (a)e o er t%e pa t 36 mont% L

D'

*+enti( t%e impa)t our or#ani5ation experien)e+ (rom "$-relate+ in)i+ent . ele)t all t%at appl /:

*$ +o ntimeCo t o( +ama#e a e ment an+ reme+iationBu ine interruption

Ex(iltration o( CS* +ata$%e(t o( per onnel in(ormationDama#e to *$ in(ra tru)tureDama#e to o(t are an+ or our)e )o+e$%e(t o( o(t are an+ or our)e )o+eDama#e to )ompan pro+u)tion )apabilitie or temDe tru)tion o( in(ormation a etOt%er . pe)i( %ere/Ot%er . pe)i( %ere/

Comment :





Section 1(2 Collaboration and Partners i7

'

Doe our or#ani5ation belon# to an (ormal or in(ormal #o ernment or in+u tr ) ber e)urit relate+ in(ormation %arin# or relate+ #roup L

*( e , li t t%e name an+ t pe o( #roup. / our or#ani5ation parti)ipate in an+ pro i+e a brie( +e )r iption o( it a)ti itie '

roup Name $ pe o( roup De )ripti

1

3

4!6

=9

10

B'Doe our or#ani5ation utili5e e)tor pe)i(i) ) ber e)urit be t pra)ti)e or tan+ar+ L *( e , explain'

Explain:

C'* our or#ani5ation a are o( t%e National *n titute o( Stan+ar+ an+ $e)%nolo# .N*S$/ C ber Se)urit 8rame or2 . ee +e(inition /L

Explain:

D'Doe our or#ani5ation emplo an o( t%e N*S$ C ber Se)urit 8rame or2@ re)ommen+e+ )ontrol L

Explain:

E'Doe our or#ani5ation %a e a &'S' o ernment )ontra)t t%at re7uire ou to %a e )ertain ) ber e)urit pra)ti)e in pla)eL

Explain:

8'Do out i+e or#ani5ation or en+or uppl our or#ani5ation it% t%e late t in(ormation re#ar+in# ) ber-relate+ t%reat , intelli#en)e, an+ or in+i)ator o( )ompromi eL

Explain:

'Doe our or#ani5ation rel on t%e &'S' o ernment (or t%e late t in(ormation re#ar+in# ) ber-relate+ t%reat , intelli#en)e, an+ or in+i)ator o( )ompromi eL

Explain:

"re iou "a#e



Section 1<.a2 United States /o0ernment +US/, Assistance and Outreac

' Doe our or#ani5ation 2no %at #o ernment a#en)ie to )onta)t to report an+ or obtain a i tan)e relate+ to ) ber e)urit in)i+ent L

B' Ga our or#ani5ation i+enti(ie+ an point o( )onta)t at an #o ernment a#en)ie to report an+ or obtain a i tan)e relate+ to ) ber e)urit in)i+ent L

C'

#en) Name

1 De(en e Se)urit Ser i)e .DSS/Department o( Gomelan+ Se)urit .DGS/

'a *n+u trial Control S tem C ber Emer#en) <e pon e $eam .*CS-CE<$/'b &nite+ State Computer Emer#en) <ea+ine $eam .&S-CE<$/3 8e+eral Bureau o( *n e ti#ation .8B*/4 ?o)al or State ?a En(or)ement! National *n titute o( Stan+ar+ an+ $e)%nolo# .N*S$/6 &nite+ State Se)ret Ser i)e

Ot%er . pe)i( %ere/= Ot%er . pe)i( %ere/9 Ot%er . pe)i( %ere/

10 Ot%er . pe)i( %ere/

Comment :


"re iou "a#e

Ga our or#ani5ation e er )onta)te+ t%e #o ernment to report an+ or obtain a i tan)e relate+ to ) ber e)urit in)i+ent L*( e , i+enti( t%e rea on (or )onta)t an+ explain'

<ea on (or Conta)t.+rop-+o n/



'

>oul+ our or#ani5ation be intere te+ in t%e (ollo in#:

1 <e)ei in# a++itional ) ber e)urit relate+ in(ormation an+ be t pra)ti)e (rom t%e &S

Collaboratin# it% ot%er )ompanie (or ) ber e)urit relate+ be t pra)ti)e

3 "ro i+in# ) ber e)urit relate+ in(ormation, a i tan)e, an+ or trainin# to ot%er member o( our in+u tr

4 <e)ei in# ) ber e)urit relate+ in(ormation, a i tan)e, an+ or trainin# to ot%er member o( our in+u tr

! "arti)ipatin# in a ) ber e)urit relate+ mentorin# pro#ram it% anot%er )ompan

6 "arti)ipatin# in &S ) ber e)urit relate+ te)%ni)al a+ i or panel or2in# #roup

Comment :


"re iou "a#eSection 1<.b2 United States /o0ernment +US/, Assistance and Outreac (continued)





Section 1=2 Certi-ication

Or#ani5ation Name

Or#ani5ation@ *nternet ++re

Name o( ut%ori5in# O((i)ial

$itle o( ut%ori5in# O((i)ial

Email ++re

"%one Number an+ Exten ionDate Certi(ie+

*n t%e box belo , pro i+e an a++itional )omment or an ot%er in(ormation ou i % to in)lu+e re#ar+in# t%i ur e a e ment'


"re iou "a#e

$%e un+er i#ne+ )erti(ie t%at t%e in(ormation %erein upplie+ in re pon e to t%i 7ue tionnaire i )omplete an+ )orre)t to t%e be t o( %i %er 2no le+#e' *t i a )riminalo((en e to ill(ull ma2e a (al e tatement or repre entation to an +epartment or a#en) o( t%e &nite+ State o ernment a to an matter it%in it ;uri +i)tion .1=&'S'C' ' 1001 .19=4 S&""' 119 //

Go man %our +i+ it ta2e to )omplete t%i ur e L



Biomedical Industry Cyber Survey Excel 04 29 2015 (1)

Documents

Transcript of Biomedical Industry Cyber Survey Excel 04 29 2015 (1)