Metrics to Assess and Manage Software Application Security Risk. M. Sahinoglu, S. Stockton, S. Morton, P. Vasudev, M. Eryilmaz

Save this PDF as:
 WORD  PNG  TXT  JPG

Size: px
Start display at page:

Download "Metrics to Assess and Manage Software Application Security Risk. M. Sahinoglu, S. Stockton, S. Morton, P. Vasudev, M. Eryilmaz"

Transcription

1 Metrics to Assess and Manage Software Application Security Risk M. Sahinoglu, S. Stockton, S. Morton, P. Vasudev, M. Eryilmaz Auburn University at Montgomery (AUM) and ATILIM University, Ankara Abstract: Software application security risk is of critical importance to modern enterprises and organizations. The very existence of these entities often depends on the successful and secure operation of mission critical applications such as the outer space explorations and high assurance scenarios regarding the surgery table for one striking example. Software application security risk is concerned primarily with how security personnel, facility managers, network personnel, management, and other interested parties rate their experience with the various aspects of software security risk, and overall management and maintenance, including issues such as continuity or availability of service, security design and configuration to name a few. To address this need, the principal author has built the fundamental (probability and gametheory related) computational aspects and an associated automated software tool for quantitative risk management. This tool, the Risk-o-Meter (RoM) provides measurable risk, advice for cost and risk mitigation on vulnerabilities and threats associated with the implementation and operation of software applications. I. INTRODUCTION The identification and management of risk is a critical part of operating an IT system. While there are many approaches to identifying and managing risk, many managers focus only on the security of the software and often neglect the other aspects of system operations. Additionally, once all risks are identified, formulating a costoptimized solution to mitigate undesirable risks to a tolerable level is often an ad-hoc process. In this research, we adopt a model of software application risk that quantifies the user s experience with six crucial aspects of the software application security environment. However we will add an original concept of quantification to the existing model through a designed algorithm by the principal author to calculate the software application security risk index [1]. To accomplish this task, numerical and/or cognitive data was collected to supply the input parameters to calculate the quantitative security risk index for software applications. This paper will not only present a quantitative model but also provide a remedial cost-optimized gametheoretic analysis about how to bring

2 an undesirable risk down to a locallydetermined tolerable level. II. METHODOLOGY This applied research paper implements a methodology on how to reduce the risk associated with the Software Application Security Risk associated with implementing and operating an Information Technology (IT) system. A software-centered composite security approach is proposed to aid security personnel, facility managers, and network personnel within an organization. In order to control the risk associated with the implementation of an IT system, concepts such as continuity of operations, security design and configuration of the software, the U.S. Department of Defense s Enclave Boundary Defense construct, a system s identification and authentication process, the physical environment where the system will be operated, and the personnel associated with operating the system (to name a few), should be considered. The primary author s innovation, i.e. RoM (Risk-O-Meter), an automated software tool based on game theory, will provide IT managers a measurable assessment of the current security posture of their implemented IT system by detailing associated cost and risk mitigation suggestions for countering identified vulnerabilities and threats associated with the IT system. The RoM will greatly facilitate the assessment and enhancement of the current security of an implemented IT system. Additionally, the Risk of Operation or Unavailability metric out of 100% will be assessed to provide a remedial cost-optimized gametheoretic analysis to bring an undesirable risk down to a user determined tolerable level [2]. While the Risk-O-Meter can be applied to virtually any organization subject to systemic threats/vulnerabilities to their business operations, this particular implementation focuses on six key areas critical in ensuring Software Application security. Continuity: Regardless of the quality of a given software application, continuous and uninterrupted operations are critical for mission critical applications. In order to achieve such availability, alternate site planning, backup and restoration processes, exercises and drills, enclave boundary defense, and disaster planning have to be considered. Each of these areas must be addressed to ensure optimal user availability of the application. Security Design and Configuration: This area focuses on secure-by-design and subsequent configuration of the software itself as well as the platform you choose to run the application on. This entails industry best practices for acquisition standards and configuration specifications, as well as compliance testing, operational best security practices, and proper implementation of nonrepudiation.

3 Enclave Boundary Defense: Unless the software application operates in a stand-alone environment, the security defenses of the enclave it runs within are crucial to the overall security health of an application. This is the first line of defense and determines what barriers are in place to prevent unauthorized access to the platform running the application and to ensure authorized access is securely administered. This key area focuses on overall boundary defense, connection rules, remote access, encryption, confidentiality, and proper network and system auditing. Identification and Authentication: While boundary defenses provide an excellent defense for software systems, one key to a secure system is to ensure that individuals who are allowed access to the application can be identified and authenticated. This key area focuses on account control, use of individual accounts, key management, tokencertificate standards, and group authentication. Physical Environment: While much attention is given to keeping unauthorized/unwanted individuals from gaining access to systems via electronic means, the facilities that house these platforms must also be protected to prevent system compromise. Additionally, the facilities must also be evaluated for their ability to protect the individuals responsible for maintaining the application and ensuring the application remains online and available to users. This key area focuses on the physical protection provided to an application and covers access to the facilities, protection against data interception, emergency lighting and power, use of screen locks, and storage of data/hardware. Personnel: Personnel, in various forms, are often the biggest threat to software applications. While there are many opportunities for individuals to impact the security of an application while it is being developed, tested and fielded, this area focuses on the personnel that may impact the operational security of an application. This key area focuses on personnel access to information, maintenance personnel, IA training, rules of behavior, and background checks. While it is critical to ensure that applications are secure-by-design, the daily challenge is to ensure that a given software application remains operationally secure on a daily basis. This research focuses on the areas vital to secure application operations and provides field managers with an analysis they can use to more efficiently secure their operational environments, including cloud [3].

4 III. VULNERABILITY AND THREAT ASSESSMENT STRUCTURE As previously noted, six vulnerabilities are assessed: Continuity, Security Design and Configuration, Enclave Boundary Defense, Identification and Authentication, Physical and Environmental, and Personnel. Within each vulnerability category, questions pertain to specific threats and countermeasures. For example, within the Continuity vulnerability, users are asked questions regarding Alternate Sites, Backup and Restoration, and Exercises and Drills threats and countermeasures. Within the Enclave Boundary Defense vulnerability, users are asked questions regarding Boundary Defense, Connection Rules, and Remote Access threats and countermeasures. Within the Physical and Environmental vulnerability, users are asked questions regarding Access to Facilities, Data Interception, and Emergency Lighting threats and countermeasures. See Figure 1 below for the Software Application Security Risk diagram detailing vulnerabilities and threats. The user s responses are then used as input for the RoM to generate a quantitative software application security risk index using a gametheoretical mathematical algorithm. Steve Stockton CSIS6952 Continuity Alternate Site Backup & Restoration Exercises & Drills Enclave Boundary Defense Disaster Planning Security Design and Configuration Acquisition Standards Configuration Specifications Compliance Testing Best Security Practices Non-Repudiation Software Application Risk Diagram Enclave Boundary Defense Identification and Authentication Boundary Defense Connection Rules Remote Access Confidentiality - Encryption Auditing Account Control Individual Accounts Key Management Token-Certificate Standards Group Authentication Physical Environment Access to Facilities Data Interception Emergency Lighting Screen Locks Storage Personnel Access to Information Maintenance Personnel IA Training Rules of Behavior Background Checks Figure 1: Software Application Security Risk Tree Diagram

5 IV. SAMPLE ASSESSMENT QUESTIONS Questions are designed to elicit the user s response regarding the perceived risk to software application security from particular threats, and the countermeasures the users may employ to counteract those threats. For example, in the Identification and Authentication vulnerability, questions regarding Account Control include both threat and countermeasure questions. Threat questions would include: Is a comprehensive account management process unimplemented? Are controls lacking to ensure that only authorized users can gain access to workstations, applications, and networks? During the creation of a new account for a system user, does the registration process leave the required information uncollected? While countermeasure questions would include: Are default accounts removed/disabled during installation of servers and workstations? Are accounts disabled and user IDs and passwords removed within 48 hours of notification that a user no longer requires or is authorized system access? Do system administrators immediately disable any account through which unauthorized user activity has been detected? V. RISK CALCULATION AND MITIGATION Essentially, the users are responding yes or no to these questions. These responses are used to calculate residual risk. Using a game-theoretical mathematical approach, the calculated risk index is used to generate an optimization or lowering of risk to desired levels [1]. Further, mitigation advice will be generated to guide security personnel, facility managers, network personnel, management, and other interested parties. Or more specifically, in what areas can the risk be reduced to optimized or desired levels (such as from 37% to 27% in the screenshot representing the median response from the study participants). See Figure 2 below for the screenshot of the Median Software Application Security Risk Meter Results Table displaying threat, countermeasure, and residual risk indices, optimization options, as well as risk mitigation advice. For this study, a random sample of 31 respondents was taken. Their residual risk results are tabulated and presented in Appendix A at the end of this paper. Respondents experience in software application security risk included both corporate and governmental.

6 Figure 2: Median Software Application Security Risk Meter Results Table

7 VI. CONCLUSION The Software Application Security Risk Meter breaks new ground in that it provides a quantitative assessment of risk to the user as well as recommendations for mitigating that risk. As such, it will be a highly useful tool for security personnel, facility managers, network personnel, management, and other interested parties seeking to minimize and mitigate software application security risk in an objective, quantitatively based manner. Future work will involve the incorporation of new questions so as to better refine user responses and subsequent calculation of risk and mitigation recommendations. Minimization and mitigation of software application security risk will greatly benefit not only the organizations deploying the applications, but society at large through the minimization of security breaches leading to monetary loss and ID theft. The Software Application Security Risk Meter tool and its future refinement provide the means to do so as there are and always will be software application security risks in cyberspace [4,5]. VII. REFERENCES [1] M. Sahinoglu, Trustworthy Computing, John Wiley, [2] M. Sahinoglu, An Input-Output Measurable Design for the Security Meter Model to Quantify and Manage Software Security Risk, IEEE Transactions on Instrumentation and Measurement, Vol. 57, No. 6, pp , June [3] K. Hashizume, D. G. Rosdao, E. Fernandez-Medina, E. B. Fernandez, An Analysis of Security Issues for Cloud Computing, Journal of Internet Services and Applications,, 2013; doi: / t/4/1/5 (Accessed 12/18/2013) [4] 3/Top-10-Security-Risks (Accessed 12/18/2013) [5] M. Sahinoglu, L. Cueva-Parra, D. Ang, Game-theoretic computing in risk analysis, WIREs Comput. Stat 2012, doi: /wics, 1205, or/onlinelibrarytps.asp?doi= /wics.1205&ArticleID=961931

8 Appendix A: Respondent Residual Risk Results Table SURVEY TAKER RESIDUAL RISK % RANKED OVERALL (OUT OF 31) REMARKS Company A th 1 st out of 11 within Company A Company A st 11 th out of 11 within Company A Company A th 8 th out of 11 within Company A Company A th ~OVERALL 4 th out of 11 within Company A AVERAGE Company A th 5 th out of 11within Company A Company A th 10 th out of 11 within Company A Company A th 9 th out of 11 within Company A Company A th 2 nd out of 11 within Company A Company A th 7 th out of 11 within Company A Company A st 6 th out of 11 within Company A (Group Median for Company A) Company A th 3 rd out of 11 within Company A Company B th 5 th out of 11 within Company B Company B nd 2 nd out of 11 within Company B Company B th 4 th out of 11 within Company B Company B th 6 th out of 11 within Company B (Group Median for Company B) Company B st 1 st out of 11 within Company B Company B th 8 th out of 11 within Company B Company B th 7 th out of 11 within Company B Company B th 10 th out of 11 within Company B Company B rd 3 rd out of 11 within Company B Company B th 9 th out of 11 within Company B Company B th 11 th out of 11 within Company B Company C rd 8 th out of 9 within Company C Company C th 3 rd out of 9 within Company C Company C nd 7 th out of 9 within Company C Company C th 1 st out of 9 within Company C Company C th 5 th out of 9 within Company C (Group Median for Company C) Company C th = OVERALL MEDIAN 4 th out of 9 within Company C Company C th 9 th out of 9 within Company C Company C th 6 th out of 9 within Company C Company C th 2 nd out of 9 within Company C Table 1. Companies (A, B, C) Survey Results for the Risk-O-Meter study, ranked within and overall, where Median: 37.06% (C6) and Average: 38.58% (A4: 39.47% is the result that comes the closest).

UF IT Risk Assessment Standard

UF IT Risk Assessment Standard UF IT Risk Assessment Standard Authority This standard was enacted by the UF Senior Vice President for Administration and the UF Interim Chief Information Officer on July 10, 2008 [7]. It was approved

More information

PDS (The Planetary Data System) Information Technology Security Plan for The Planetary Data System: [Node Name]

PDS (The Planetary Data System) Information Technology Security Plan for The Planetary Data System: [Node Name] PDS (The Planetary Data System) Information Technology Security Plan for The Planetary Data System: [Node Name] [Date] [Location] 1 Prepared by: [Author] [Title] Date Approved by: [Name] [Title] Date 2

More information

Chapter 6: Fundamental Cloud Security

Chapter 6: Fundamental Cloud Security Chapter 6: Fundamental Cloud Security Nora Almezeini MIS Department, CBA, KSU From Cloud Computing by Thomas Erl, Zaigham Mahmood, and Ricardo Puttini(ISBN: 0133387526) Copyright 2013 Arcitura Education,

More information

Bellevue University Cybersecurity Programs & Courses

Bellevue University Cybersecurity Programs & Courses Undergraduate Course List Core Courses: CYBR 250 Introduction to Cyber Threats, Technologies and Security CIS 311 Network Security CIS 312 Securing Access Control CIS 411 Assessments and Audits CYBR 320

More information

Cloud Database Storage Model by Using Key-as-a-Service (KaaS)

Cloud Database Storage Model by Using Key-as-a-Service (KaaS) www.ijecs.in International Journal Of Engineering And Computer Science ISSN:2319-7242 Volume 4 Issue 7 July 2015, Page No. 13284-13288 Cloud Database Storage Model by Using Key-as-a-Service (KaaS) J.Sivaiah

More information

Department of Information Technology Active Directory Audit Final Report. August 2008. promoting efficient & effective local government

Department of Information Technology Active Directory Audit Final Report. August 2008. promoting efficient & effective local government Department of Information Technology Active Directory Audit Final Report August 2008 promoting efficient & effective local government Executive Summary Active Directory (AD) is a directory service by Microsoft

More information

Information Security Handbook

Information Security Handbook Information Security Handbook Adopted 6/4/14 Page 0 Page 1 1. Introduction... 5 1.1. Executive Summary... 5 1.2. Governance... 5 1.3. Scope and Application... 5 1.4. Biennial Review... 5 2. Definitions...

More information

nwstor Storage Security Solution 1. Executive Summary 2. Need for Data Security 3. Solution: nwstor isav Storage Security Appliances 4.

nwstor Storage Security Solution 1. Executive Summary 2. Need for Data Security 3. Solution: nwstor isav Storage Security Appliances 4. CONTENTS 1. Executive Summary 2. Need for Data Security 3. Solution: nwstor isav Storage Security Appliances 4. Conclusion 1. EXECUTIVE SUMMARY The advantages of networked data storage technologies such

More information

Network and Security Controls

Network and Security Controls Network and Security Controls State Of Arizona Office Of The Auditor General Phil Hanus IT Controls Webinar Series Part I Overview of IT Controls and Best Practices Part II Identifying Users and Limiting

More information

Office of Inspector General

Office of Inspector General DEPARTMENT OF HOMELAND SECURITY Office of Inspector General Security Weaknesses Increase Risks to Critical United States Secret Service Database (Redacted) Notice: The Department of Homeland Security,

More information

Network & Information Security Policy

Network & Information Security Policy Policy Version: 2.1 Approved: 02/20/2015 Effective: 03/02/2015 Table of Contents I. Purpose................... 1 II. Scope.................... 1 III. Roles and Responsibilities............. 1 IV. Risk

More information

SRA International Managed Information Systems Internal Audit Report

SRA International Managed Information Systems Internal Audit Report SRA International Managed Information Systems Internal Audit Report Report #2014-03 June 18, 2014 Table of Contents Executive Summary... 3 Background Information... 4 Background... 4 Audit Objectives...

More information

Security Threat Risk Assessment: the final key piece of the PIA puzzle

Security Threat Risk Assessment: the final key piece of the PIA puzzle Security Threat Risk Assessment: the final key piece of the PIA puzzle Curtis Kore, Information Security Analyst Angela Swan, Director, Information Security Agenda Introduction Current issues The value

More information

Risk Management Guide for Information Technology Systems. NIST SP800-30 Overview

Risk Management Guide for Information Technology Systems. NIST SP800-30 Overview Risk Management Guide for Information Technology Systems NIST SP800-30 Overview 1 Risk Management Process that allows IT managers to balance operational and economic costs of protective measures and achieve

More information

SAGEPOT: A TOOL FOR SECURITY ASSESSMENT AND GENERATION OF POLICY TEMPLATES

SAGEPOT: A TOOL FOR SECURITY ASSESSMENT AND GENERATION OF POLICY TEMPLATES ABSTRACT SAGEPOT: A TOOL FOR SECURITY ASSESSMENT AND GENERATION OF POLICY TEMPLATES K. Saleh, A. Meliani, Y. Emad and A. AlHajri American University of Sharjah, Department of Computer Science Box 26666,

More information

Network Security Administrator

Network Security Administrator Network Security Administrator Course ID ECC600 Course Description This course looks at the network security in defensive view. The ENSA program is designed to provide fundamental skills needed to analyze

More information

Get Confidence in Mission Security with IV&V Information Assurance

Get Confidence in Mission Security with IV&V Information Assurance Get Confidence in Mission Security with IV&V Information Assurance September 10, 2014 Threat Landscape Regulatory Framework Life-cycles IV&V Rigor and Independence Threat Landscape Continuously evolving

More information

IT Best Practices Audit TCS offers a wide range of IT Best Practices Audit content covering 15 subjects and over 2200 topics, including:

IT Best Practices Audit TCS offers a wide range of IT Best Practices Audit content covering 15 subjects and over 2200 topics, including: IT Best Practices Audit TCS offers a wide range of IT Best Practices Audit content covering 15 subjects and over 2200 topics, including: 1. IT Cost Containment 84 topics 2. Cloud Computing Readiness 225

More information

Securing the Service Desk in the Cloud

Securing the Service Desk in the Cloud TECHNICAL WHITE PAPER Securing the Service Desk in the Cloud BMC s Security Strategy for ITSM in the SaaS Environment Introduction Faced with a growing number of regulatory, corporate, and industry requirements,

More information

Technical Standards for Information Security Measures for the Central Government Computer Systems

Technical Standards for Information Security Measures for the Central Government Computer Systems Technical Standards for Information Security Measures for the Central Government Computer Systems April 21, 2011 Established by the Information Security Policy Council Table of Contents Chapter 2.1 General...

More information

HIPAA Security COMPLIANCE Checklist For Employers

HIPAA Security COMPLIANCE Checklist For Employers Compliance HIPAA Security COMPLIANCE Checklist For Employers All of the following steps must be completed by April 20, 2006 (April 14, 2005 for Large Health Plans) Broadly speaking, there are three major

More information

IBX Business Network Platform Information Security Controls. 2015-02- 20 Document Classification [Public]

IBX Business Network Platform Information Security Controls. 2015-02- 20 Document Classification [Public] IBX Business Network Platform Information Security Controls 2015-02- 20 Document Classification [Public] Table of Contents 1. General 2 2. Physical Security 2 3. Network Access Control 2 4. Operating System

More information

PCI Solution for Retail: Addressing Compliance and Security Best Practices

PCI Solution for Retail: Addressing Compliance and Security Best Practices PCI Solution for Retail: Addressing Compliance and Security Best Practices Executive Summary The Payment Card Industry (PCI) Data Security Standard has been revised to address an evolving risk environment

More information

i-pcgrid Workshop 2015 Cyber Security for Substation Automation The Jagged Line between Utility and Vendors

i-pcgrid Workshop 2015 Cyber Security for Substation Automation The Jagged Line between Utility and Vendors March 25-27, 2014 Steven A. Kunsman i-pcgrid Workshop 2015 Cyber Security for Substation Automation The Jagged Line between Utility and Vendors ABB Inc. March 26, 2015 Slide 1 Cyber Security for Substation

More information

Business Continuity Plan

Business Continuity Plan Business Continuity Plan October 2007 Agenda Business continuity plan definition Evolution of the business continuity plan Business continuity plan life cycle FFIEC & Business continuity plan Questions

More information

Auburn Montgomery. Registration and Security Policy for AUM Servers

Auburn Montgomery. Registration and Security Policy for AUM Servers Auburn Montgomery Title: Responsible Office: Registration and Security Policy for AUM Servers Information Technology Services I. PURPOSE To outline the steps required to register and maintain departmental

More information

Four Top Emagined Security Services

Four Top Emagined Security Services Four Top Emagined Security Services. www.emagined.com Emagined Security offers a variety of Security Services designed to support growing security needs. This brochure highlights four key Emagined Security

More information

Best Practices For Department Server and Enterprise System Checklist

Best Practices For Department Server and Enterprise System Checklist Best Practices For Department Server and Enterprise System Checklist INSTRUCTIONS Information Best Practices are guidelines used to ensure an adequate level of protection for Information Technology (IT)

More information

ISO 27001 Controls and Objectives

ISO 27001 Controls and Objectives ISO 27001 s and Objectives A.5 Security policy A.5.1 Information security policy Objective: To provide management direction and support for information security in accordance with business requirements

More information

Data Leakage Detection in Cloud Computing using Identity Services

Data Leakage Detection in Cloud Computing using Identity Services International Journal of Computer Sciences and Engineering Open Access Research Paper Volume-4, Issue-04 E-ISSN: 2347-2693 Data Leakage Detection in Cloud Computing using Identity Services K. Mythili 1*,

More information

CLOUD Computing: Cost-Effective Risk Management with Additional Product Deployment

CLOUD Computing: Cost-Effective Risk Management with Additional Product Deployment Available online at www.sciencedirect.com ScienceDirect Procedia Computer Science 00 (2015) 000 000 www.elsevier.com/locate/procedia The 2015 International Conference on Soft Computing and Software Engineering

More information

MCR Checklist for Automated Information Systems (Major Applications and General Support Systems)

MCR Checklist for Automated Information Systems (Major Applications and General Support Systems) MCR Checklist for Automated Information Systems (Major Applications and General Support Systems) Name of GSS or MA being reviewed: Region/Office of GSS or MA being reviewed: System Owner: System Manager:

More information

Walton Centre. Document History Date Version Author Changes 01/10/04 1.0 A Cobain L Wyatt 31/03/05 1.1 L Wyatt Update to procedure

Walton Centre. Document History Date Version Author Changes 01/10/04 1.0 A Cobain L Wyatt 31/03/05 1.1 L Wyatt Update to procedure Page 1 Walton Centre Access and Authentication (network) Document History Date Version Author Changes 01/10/04 1.0 A Cobain L Wyatt 31/03/05 1.1 L Wyatt Update to procedure Page 2 Table of Contents Section

More information

University of Sunderland Business Assurance Information Security Policy

University of Sunderland Business Assurance Information Security Policy University of Sunderland Business Assurance Information Security Policy Document Classification: Public Policy Reference Central Register Policy Reference Faculty / Service IG 003 Policy Owner Assistant

More information

IT Security Standard: Computing Devices

IT Security Standard: Computing Devices IT Security Standard: Computing Devices Revision History: Date By Action Pages 09/30/10 ITS Release of New Document Initial Draft Review Frequency: Annually Responsible Office: ITS Responsible Officer:

More information

PASTA Abstract. Process for Attack S imulation & Threat Assessment Abstract. VerSprite, LLC Copyright 2013

PASTA Abstract. Process for Attack S imulation & Threat Assessment Abstract. VerSprite, LLC Copyright 2013 2013 PASTA Abstract Process for Attack S imulation & Threat Assessment Abstract VerSprite, LLC Copyright 2013 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

More information

LAMAR STATE COLLEGE - ORANGE INFORMATION RESOURCES SECURITY MANUAL. for INFORMATION RESOURCES

LAMAR STATE COLLEGE - ORANGE INFORMATION RESOURCES SECURITY MANUAL. for INFORMATION RESOURCES LAMAR STATE COLLEGE - ORANGE INFORMATION RESOURCES SECURITY MANUAL for INFORMATION RESOURCES Updated: June 2007 Information Resources Security Manual 1. Purpose of Security Manual 2. Audience 3. Acceptable

More information

Enlisted Information Dominance Warefare Specialist (EIDWS) Common Core

Enlisted Information Dominance Warefare Specialist (EIDWS) Common Core Enlisted Information Dominance Warefare Specialist (EIDWS) Common Core Fleet Weather Center Norfolk 1 References: Joint DoDIIS/Cryptologic SCI Information Systems Security Standards DCID 6/3 SECNAVINST

More information

CLOUD MIGRATION. Celina Alexandre M6807

CLOUD MIGRATION. Celina Alexandre M6807 CLOUD MIGRATION M6807 S Content 1. Introduction 2. Methodology 3. Requirements Definition Phase 3.1. Strategy 3.2. Knowledge 06/05/15 2 Content 4. Analysis Phase 4.1. Aplications and Systems 4.2. Development

More information

BMC s Security Strategy for ITSM in the SaaS Environment

BMC s Security Strategy for ITSM in the SaaS Environment BMC s Security Strategy for ITSM in the SaaS Environment TABLE OF CONTENTS Introduction... 3 Data Security... 4 Secure Backup... 6 Administrative Access... 6 Patching Processes... 6 Security Certifications...

More information

Ohio Supercomputer Center

Ohio Supercomputer Center Ohio Supercomputer Center Intrusion Prevention and Detection No: Effective: OSC-12 5/21/09 Issued By: Kevin Wohlever Director of Supercomputer Operations Published By: Ohio Supercomputer Center Original

More information

This policy applies to all DRC employees, contractors, volunteers, interns and other agents of the state.

This policy applies to all DRC employees, contractors, volunteers, interns and other agents of the state. STATE OF OHIO SUBJECT: PAGE 1 OF 9 DRC Sensitive Data Security Requirements NUMBER: 05-OIT-23 DEPARTMENT OF REHABILITATION AND CORRECTION RULE/CODE REFERENCE: RELATED ACA STANDARDS: SUPERSEDES: 05-OIT-23

More information

Using Data Encryption to Achieve HIPAA Safe Harbor in the Cloud

Using Data Encryption to Achieve HIPAA Safe Harbor in the Cloud Using Data Encryption to Achieve HIPAA Safe Harbor in the Cloud 1 Contents The Obligation to Protect Patient Data in the Cloud................................................... Complying with the HIPAA

More information

Information Technology Branch Access Control Technical Standard

Information Technology Branch Access Control Technical Standard Information Technology Branch Access Control Technical Standard Information Management, Administrative Directive A1461 Cyber Security Technical Standard # 5 November 20, 2014 Approved: Date: November 20,

More information

HUMAN RESOURCES MANAGEMENT NETWORK (HRMN) SELF-SERVICE

HUMAN RESOURCES MANAGEMENT NETWORK (HRMN) SELF-SERVICE PERFORMANCE AUDIT OF HUMAN RESOURCES MANAGEMENT NETWORK (HRMN) SELF-SERVICE DEPARTMENT OF CIVIL SERVICE July 2004 ...The auditor general shall conduct post audits of financial transactions and accounts

More information

ISO/IEC 27002:2013 WHITEPAPER. When Recognition Matters

ISO/IEC 27002:2013 WHITEPAPER. When Recognition Matters When Recognition Matters WHITEPAPER ISO/IEC 27002:2013 INFORMATION TECHNOLOGY - SECURITY TECHNIQUES CODE OF PRACTICE FOR INFORMATION SECURITY CONTROLS www.pecb.com CONTENT 3 4 5 6 6 7 7 7 7 8 8 8 9 9 9

More information

¼ããÀ ããè¾ã ¹ãÆãä ã¼ãîãä ã ããõà ãäìããä ã½ã¾ã ºããñ à Securities and Exchange Board of India

¼ããÀ ããè¾ã ¹ãÆãä ã¼ãîãä ã ããõà ãäìããä ã½ã¾ã ºããñ à Securities and Exchange Board of India CIRCULAR CIR/MRD/DP/13/2015 July 06, 2015 To, All Stock Exchanges, Clearing Corporation and Depositories. Dear Sir / Madam, Subject: Cyber Security and Cyber Resilience framework of Stock Exchanges, Clearing

More information

University of Pittsburgh Security Assessment Questionnaire (v1.5)

University of Pittsburgh Security Assessment Questionnaire (v1.5) Technology Help Desk 412 624-HELP [4357] technology.pitt.edu University of Pittsburgh Security Assessment Questionnaire (v1.5) Directions and Instructions for completing this assessment The answers provided

More information

QUANTITATIVE MODEL FOR INFORMATION SECURITY RISK MANAGEMENT

QUANTITATIVE MODEL FOR INFORMATION SECURITY RISK MANAGEMENT QUANTITATIVE MODEL FOR INFORMATION SECURITY RISK MANAGEMENT Rok Bojanc ZZI d.o.o. rok.bojanc@zzi.si Abstract: The paper presents a mathematical model to improve our knowledge of information security and

More information

---Information Technology (IT) Specialist (GS-2210) IT Security Competency Model---

---Information Technology (IT) Specialist (GS-2210) IT Security Competency Model--- ---Information Technology (IT) Specialist (GS-2210) IT Security Model--- TECHNICAL COMPETENCIES Computer Forensics Knowledge of tools and techniques pertaining to legal evidence used in the analysis of

More information

Cloud Computing Concept, Technology & Architecture

Cloud Computing Concept, Technology & Architecture Cloud Computing Concept, Technology & Architecture Chapter 06 Fundamental Cloud Security 課程名稱 : 雲端管理系統 授課教師 : 高勝助 Contents Security topics and concepts relevant and distinct to cloud computing are introduced,

More information

3rd Party Assurance & Information Governance 2014-2016 outlook IIA Ireland Annual Conference 2014. Straightforward Security and Compliance

3rd Party Assurance & Information Governance 2014-2016 outlook IIA Ireland Annual Conference 2014. Straightforward Security and Compliance 3rd Party Assurance & Information Governance 2014-2016 outlook IIA Ireland Annual Conference 2014 Continuous Education Services (elearning/workshops) Compliance Management Portals Information Security

More information

Information Security Program CHARTER

Information Security Program CHARTER State of Louisiana Information Security Program CHARTER Date Published: 12, 09, 2015 Contents Executive Sponsors... 3 Program Owner... 3 Introduction... 4 Statewide Information Security Strategy... 4 Information

More information

UF Risk IT Assessment Guidelines

UF Risk IT Assessment Guidelines Who Should Read This All risk assessment participants should read this document, most importantly, unit administration and IT workers. A robust risk assessment includes evaluation by all sectors of an

More information

Best Practices for PCI DSS V3.0 Network Security Compliance

Best Practices for PCI DSS V3.0 Network Security Compliance Best Practices for PCI DSS V3.0 Network Security Compliance January 2015 www.tufin.com Table of Contents Preparing for PCI DSS V3.0 Audit... 3 Protecting Cardholder Data with PCI DSS... 3 Complying with

More information

Ensuring Security in Cloud with Multi-Level IDS and Log Management System

Ensuring Security in Cloud with Multi-Level IDS and Log Management System Ensuring Security in Cloud with Multi-Level IDS and Log Management System 1 Prema Jain, 2 Ashwin Kumar PG Scholar, Mangalore Institute of Technology & Engineering, Moodbidri, Karnataka1, Assistant Professor,

More information

Cybersecurity Practices of Ohio Investment Advisers; A Summary of Survey Responses

Cybersecurity Practices of Ohio Investment Advisers; A Summary of Survey Responses Cybersecurity Practices of Ohio Investment Advisers; A Summary of Survey Responses October 2014 A Pilot Survey to Compile Cybersecurity Information In July 2014, the Ohio Division of Securities participated

More information

AHLA. JJ. Keeping Your Cloud Services Provider from Raining on Your Parade. Jean Hess Manager HORNE LLP Ridgeland, MS

AHLA. JJ. Keeping Your Cloud Services Provider from Raining on Your Parade. Jean Hess Manager HORNE LLP Ridgeland, MS AHLA JJ. Keeping Your Cloud Services Provider from Raining on Your Parade Jean Hess Manager HORNE LLP Ridgeland, MS Melissa Markey Hall Render Killian Heath & Lyman PC Troy, MI Physicians and Hospitals

More information

Office of the Auditor General Performance Audit Report. Statewide UNIX Security Controls Department of Technology, Management, and Budget

Office of the Auditor General Performance Audit Report. Statewide UNIX Security Controls Department of Technology, Management, and Budget Office of the Auditor General Performance Audit Report Statewide UNIX Security Controls Department of Technology, Management, and Budget December 2015 State of Michigan Auditor General Doug A. Ringler,

More information

Host Hardening. Presented by. Douglas Couch & Nathan Heck Security Analysts for ITaP 1

Host Hardening. Presented by. Douglas Couch & Nathan Heck Security Analysts for ITaP 1 Host Hardening Presented by Douglas Couch & Nathan Heck Security Analysts for ITaP 1 Background National Institute of Standards and Technology Draft Guide to General Server Security SP800-123 Server A

More information

INCIDENT RESPONSE CHECKLIST

INCIDENT RESPONSE CHECKLIST INCIDENT RESPONSE CHECKLIST The purpose of this checklist is to provide clients of Kivu Consulting, Inc. with guidance in the initial stages of an actual or possible data breach. Clients are encouraged

More information

Security Issues in Cloud Computing

Security Issues in Cloud Computing Security Issues in Computing CSCI 454/554 Computing w Definition based on NIST: A model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources

More information

Contact: Henry Torres, (870) 972-3033

Contact: Henry Torres, (870) 972-3033 Information & Technology Services Management & Security Principles & Procedures Executive Summary Contact: Henry Torres, (870) 972-3033 Background: The Security Task Force began a review of all procedures

More information

The Commonwealth of Massachusetts

The Commonwealth of Massachusetts A. JOSEPH DeNUCCI AUDITOR The Commonwealth of Massachusetts AUDITOR OF THE COMMONWEALTH ONE ASHBURTON PLACE, ROOM 1819 BOSTON, MASSACHUSETTS 02108 TEL. (617) 727-6200 No. 2008-1308-4T OFFICE OF THE STATE

More information

VMware vcloud Air SOC 1 Control Matrix

VMware vcloud Air SOC 1 Control Matrix SOC 1 Control Objectives/Activities Matrix goes to great lengths to ensure the security and availability of vcloud Air services. In this effort, we have undergone a variety of industry standard audits,

More information

GE Measurement & Control. Cyber Security for NEI 08-09

GE Measurement & Control. Cyber Security for NEI 08-09 GE Measurement & Control Cyber Security for NEI 08-09 Contents Cyber Security for NEI 08-09...3 Cyber Security Solution Support for NEI 08-09...3 1.0 Access Contols...4 2.0 Audit And Accountability...4

More information

Report on Hong Kong SME Cloud Adoption and Security Readiness Survey

Report on Hong Kong SME Cloud Adoption and Security Readiness Survey Report on Hong Kong SME Cloud Adoption and Security Readiness Survey Collaborated by Internet Society Hong Kong and Cloud Security Alliance (HK & Macau Chapter) Sponsored by Microsoft Hong Kong Jointly

More information

Information and Communication Technology. Patch Management Policy

Information and Communication Technology. Patch Management Policy BELA-BELA LOCAL MUNICIPALITY - - Chris Hani Drive, Bela- Bela, Limpopo. Private Bag x 1609 - BELA-BELA 0480 - Tel: 014 736 8000 Fax: 014 736 3288 - Website: www.belabela.gov.za - - OFFICE OF THE MUNICIPAL

More information

IT Architecture FOR DUMHIE5* by Kalani Kirk Hausman. and Susan L. Cook WILEY. Wiley Publishing/ Inc.

IT Architecture FOR DUMHIE5* by Kalani Kirk Hausman. and Susan L. Cook WILEY. Wiley Publishing/ Inc. IT Architecture FOR DUMHIE5* by Kalani Kirk Hausman and Susan L. Cook WILEY Wiley Publishing/ Inc. Table of Contents»»» #*»* * *«Introduction 7 About This Book 1 Conventions Used in This Book 2 What You're

More information

3. Are employees set as Administrator level on their workstations? a. Yes, if it is necessary for their work. b. Yes. c. No.

3. Are employees set as Administrator level on their workstations? a. Yes, if it is necessary for their work. b. Yes. c. No. As your trusted financial partner, Maps Credit Union is committed to helping you assess and manage risks associated with your business online banking. We recommend that you do a periodic risk assessment

More information

74. Selecting Web Services with Security Compliances: A Managerial Perspective

74. Selecting Web Services with Security Compliances: A Managerial Perspective 74. Selecting Web Services with Security Compliances: A Managerial Perspective Khaled Md Khan Department of Computer Science and Engineering Qatar University k.khan@qu.edu.qa Abstract This paper proposes

More information

Supplier Security Assessment Questionnaire

Supplier Security Assessment Questionnaire HALKYN CONSULTING LTD Supplier Security Assessment Questionnaire Security Self-Assessment and Reporting This questionnaire is provided to assist organisations in conducting supplier security assessments.

More information

Securing Information in LiveBackup

Securing Information in LiveBackup . Atempo, Inc. Securing Information in LiveBackup How LiveBackup secures data in transmission and storage Date: December 7, 2007 Author: Amy Gracer, Version: alb.lbsg.311.2 en Copyright 2008 Atempo Inc.

More information

Security Features: Lettings & Property Management Software

Security Features: Lettings & Property Management Software Security Features: Lettings & Property Management Software V 2.0 (23/02/2015) Table of Contents Introduction to Web Application Security... 2 Potential Security Vulnerabilities for Web Applications...

More information

OPERATIONAL CAPABILITY TECHNOLOGY QUESTIONNAIRE

OPERATIONAL CAPABILITY TECHNOLOGY QUESTIONNAIRE OPERATIONAL CAPABILITY TECHNOLOGY QUESTIONNAIRE Please provide all relevant documents responsive to the information requests listed within each area below. In addition to the specific documents requested,

More information

MICHIGAN AUDIT REPORT OFFICE OF THE AUDITOR GENERAL THOMAS H. MCTAVISH, C.P.A. AUDITOR GENERAL

MICHIGAN AUDIT REPORT OFFICE OF THE AUDITOR GENERAL THOMAS H. MCTAVISH, C.P.A. AUDITOR GENERAL MICHIGAN OFFICE OF THE AUDITOR GENERAL AUDIT REPORT THOMAS H. MCTAVISH, C.P.A. AUDITOR GENERAL The auditor general shall conduct post audits of financial transactions and accounts of the state and of all

More information

USING SECURITY METRICS TO ASSESS RISK MANAGEMENT CAPABILITIES

USING SECURITY METRICS TO ASSESS RISK MANAGEMENT CAPABILITIES Christina Kormos National Agency Phone: (410)854-6094 Fax: (410)854-4661 ckormos@radium.ncsc.mil Lisa A. Gallagher (POC) Arca Systems, Inc. Phone: (410)309-1780 Fax: (410)309-1781 gallagher@arca.com USING

More information

AUDITING A BCP PLAN. Thomas Bronack Auditing a BCP Plan presentation Page: 1

AUDITING A BCP PLAN. Thomas Bronack Auditing a BCP Plan presentation Page: 1 AUDITING A BCP PLAN Thomas Bronack Auditing a BCP Plan presentation Page: 1 What are the Objectives of a Good BCP Plan Protect employees Restore critical business processes or functions to minimize the

More information

FORT HAYS STATE UNIVERSITY CREDIT CARD SECURITY POLICY

FORT HAYS STATE UNIVERSITY CREDIT CARD SECURITY POLICY FORT HAYS STATE UNIVERSITY CREDIT CARD SECURITY POLICY Page 1 of 6 Summary The Payment Card Industry Data Security Standard (PCI DSS), a set of comprehensive requirements for enhancing payment account

More information

FIREWALL CHECKLIST. Pre Audit Checklist. 2. Obtain the Internet Policy, Standards, and Procedures relevant to the firewall review.

FIREWALL CHECKLIST. Pre Audit Checklist. 2. Obtain the Internet Policy, Standards, and Procedures relevant to the firewall review. 1. Obtain previous workpapers/audit reports. FIREWALL CHECKLIST Pre Audit Checklist 2. Obtain the Internet Policy, Standards, and Procedures relevant to the firewall review. 3. Obtain current network diagrams

More information

Top Three POS System Vulnerabilities Identified to Promote Data Security Awareness

Top Three POS System Vulnerabilities Identified to Promote Data Security Awareness CISP BULLETIN Top Three POS System Vulnerabilities Identified to Promote Data Security Awareness November 21, 2006 To support compliance with the Cardholder Information Security Program (CISP), Visa USA

More information

Building Secure Cloud Applications. On the Microsoft Windows Azure platform

Building Secure Cloud Applications. On the Microsoft Windows Azure platform Building Secure Cloud Applications On the Microsoft Windows Azure platform Contents 1 Security and the cloud 3 1.1 General considerations 3 1.2 Questions to ask 3 2 The Windows Azure platform 4 2.1 Inside

More information

SITA Security Requirements for Third-Party Service Providers that Access, Process, Store or Transmit Data on Behalf of SITA

SITA Security Requirements for Third-Party Service Providers that Access, Process, Store or Transmit Data on Behalf of SITA SITA Information Security SITA Security Requirements for Third-Party Service Providers that Access, Process, Store or Transmit Data on Behalf of SITA September, 2012 Contents 1. Introduction... 3 1.1 Overview...

More information

MICHIGAN AUDIT REPORT PERFORMANCE AUDIT OF THE QUALIFIED VOTER FILE AND DIGITAL DRIVER'S LICENSE SYSTEMS

MICHIGAN AUDIT REPORT PERFORMANCE AUDIT OF THE QUALIFIED VOTER FILE AND DIGITAL DRIVER'S LICENSE SYSTEMS MICHIGAN OFFICE OF THE AUDITOR GENERAL AUDIT REPORT PERFORMANCE AUDIT OF THE QUALIFIED VOTER FILE AND DIGITAL DRIVER'S LICENSE SYSTEMS DEPARTMENT OF STATE AND DEPARTMENT OF INFORMATION TECHNOLOGY March

More information

Pointsec Enterprise Encryption and Access Control for Laptops and Workstations

Pointsec Enterprise Encryption and Access Control for Laptops and Workstations Pointsec Enterprise Encryption and Access Control for Laptops and Workstations Overview of PC Security Since computer security has become increasingly important, almost all of the focus has been on securing

More information

H Y T RUST: S OLUTION B RIEF. Solve the Nosy Neighbor Problem in Multi-Tenant Environments

H Y T RUST: S OLUTION B RIEF. Solve the Nosy Neighbor Problem in Multi-Tenant Environments H Y T RUST: S OLUTION B RIEF Solve the Nosy Neighbor Problem in Multi-Tenant Environments Summary A private cloud with multiple tenants such as business units of an enterprise or customers of a cloud service

More information

Managing Cloud Computing Risk

Managing Cloud Computing Risk Managing Cloud Computing Risk Presented By: Dan Desko; Manager, Internal IT Audit & Risk Advisory Services Schneider Downs & Co. Inc. ddesko@schneiderdowns.com Learning Objectives Understand how to identify

More information

Critical Controls for Cyber Security. www.infogistic.com

Critical Controls for Cyber Security. www.infogistic.com Critical Controls for Cyber Security www.infogistic.com Understanding Risk Asset Threat Vulnerability Managing Risks Systematic Approach for Managing Risks Identify, characterize threats Assess the vulnerability

More information

Ohio Supercomputer Center

Ohio Supercomputer Center Ohio Supercomputer Center Portable Security Computing No: Effective: OSC-09 05/27/09 Issued By: Kevin Wohlever Director of Supercomputer Operations Published By: Ohio Supercomputer Center Original Publication

More information

SUBJECT: SECURITY OF ELECTRONIC MEDICAL RECORDS COMPLIANCE WITH THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (HIPAA)

SUBJECT: SECURITY OF ELECTRONIC MEDICAL RECORDS COMPLIANCE WITH THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (HIPAA) UNIVERSITY OF PITTSBURGH POLICY SUBJECT: SECURITY OF ELECTRONIC MEDICAL RECORDS COMPLIANCE WITH THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (HIPAA) DATE: March 18, 2005 I. SCOPE This

More information

10 Hidden IT Risks That Threaten Your Financial Services Firm

10 Hidden IT Risks That Threaten Your Financial Services Firm Your firm depends on intelligence. But can you count on your technology? You may not be in the intelligence technology business, but it s probably impossible to imagine your business without IT. Today,

More information

IT General Controls Domain COBIT Domain Control Objective Control Activity Test Plan Test of Controls Results

IT General Controls Domain COBIT Domain Control Objective Control Activity Test Plan Test of Controls Results Acquire or develop application systems software Controls provide reasonable assurance that application and system software is acquired or developed that effectively supports financial reporting requirements.

More information

Executive Summary Program Highlights for FY2009/2010 Mission Statement Authority State Law: University Policy:

Executive Summary Program Highlights for FY2009/2010 Mission Statement Authority State Law: University Policy: Executive Summary Texas state law requires that each state agency, including Institutions of Higher Education, have in place an Program (ISP) that is approved by the head of the institution. 1 Governance

More information

ISO27001 Controls and Objectives

ISO27001 Controls and Objectives Introduction This reference document for the University of Birmingham lists the control objectives, specific controls and background information, as given in Annex A to ISO/IEC 27001:2005. As such, the

More information

THE TOP SECURITY QUESTIONS YOU SHOULD ASK A CLOUD COMMUNICATIONS PROVIDER

THE TOP SECURITY QUESTIONS YOU SHOULD ASK A CLOUD COMMUNICATIONS PROVIDER THE TOP SECURITY QUESTIONS YOU SHOULD ASK A CLOUD COMMUNICATIONS PROVIDER How to ensure a cloud-based phone system is secure. BEFORE SELECTING A CLOUD PHONE SYSTEM, YOU SHOULD CONSIDER: DATA PROTECTION.

More information

SECURITY. Risk & Compliance Services

SECURITY. Risk & Compliance Services SECURITY Risk & Compliance s V1 8/2010 Risk & Compliances s Risk & compliance services Summary Summary Trace3 offers a full and complete line of security assessment services designed to help you minimize

More information

Hengtian Information Security White Paper

Hengtian Information Security White Paper Hengtian Information Security White Paper March, 2012 Contents Overview... 1 1. Security Policy... 2 2. Organization of information security... 2 3. Asset management... 3 4. Human Resources Security...

More information

U.S. Department of Energy Office of Inspector General Office of Audits & Inspections

U.S. Department of Energy Office of Inspector General Office of Audits & Inspections U.S. Department of Energy Office of Inspector General Office of Audits & Inspections Audit Report Management of Western Area Power Administration's Cyber Security Program DOE/IG-0873 October 2012 Department

More information

Meeting the Challenges of Remote Data Protection: Requirements and Best Practices

Meeting the Challenges of Remote Data Protection: Requirements and Best Practices Meeting the Challenges of Remote Data Protection: Requirements and Best Practices A Whitepaper by Stefan Utzinger, NovaStor CEO (March 2011) Table of Contents EXECUTIVE SUMMARY... 2 INTRODUCTION: THE CHALLENGE

More information