2 Copyright 2015 M. E. Kabay. All rights reserved. 4 Copyright 2015 M. E. Kabay. All rights reserved.
|
|
|
- Caitlin Wilcox
- 8 years ago
- Views:
Transcription
1 CSH5 Chapter 40 Managing Patches & Vulnerabilities Peter Mell & Karen Kent Scarfone Topics Introduction to Patch & Vulnerability Management Why Use Automated Patching Solutions? Patch & Vulnerability Management Process Patch & Vulnerability Management Issues Summary of Major Recommendations 1 Copyright 2015 M. E. Kabay. All rights reserved. 2 Copyright 2015 M. E. Kabay. All rights reserved. Introduction to Patch & Vulnerability Management Vulnerabilities Flaws Can be exploited by malicious entities Obtain unauthorized access / privileges Patches Code to fix flaws / bugs Can add functionality Or repair flaws May lag behind vulnerability disclosures Patch & vulnerability management Systematic processes to prevent exploits Why Use Automated Patching Solutions? (1) Vulnerabilities increasing rapidly * Jan Dec 2007: US National Vulnerability Database* 6691 new vulnerabilities (557/mo, 18/day) Jan Dec 2008: 5632 Jan Dec 2009: 5773 Damage can be severe: denial of service, data loss, loss of reputation, loss of business. Cost of not mitigating damage = WTR W = workstations T = time spent fixing problems or lost productivity R = cost/hour of T 3 Copyright 2015 M. E. Kabay. All rights reserved. 4 Copyright 2015 M. E. Kabay. All rights reserved. Why Use Automated Patching Solutions (2) Manual monitoring for new patches and applying may be labor intensive E.g., 10 min/day 10 min/patch per workstation and these costs may add up Yet still remain cheaper than disaster However, automated patching can be more cost effective Automatically attend to new patches Deploy them across entire network Also more reliable and quicker than manual Examples of Automated Patch Management Tools PatchEasy Symantec Altiris Suite Desktop Central 7 Shavlik NetChk Protect These are examples, not endorsements. 5 Copyright 2015 M. E. Kabay. All rights reserved. 6 Copyright 2015 M. E. Kabay. All rights reserved.
2 Patch Easy Symantec Altiris Suite 7 Copyright 2015 M. E. Kabay. All rights reserved. 8 Copyright 2015 M. E. Kabay. All rights reserved. Desktop Central 7 Shavlik NetChk Protect 9 Copyright 2015 M. E. Kabay. All rights reserved. 10 Copyright 2015 M. E. Kabay. All rights reserved. Patch & Vulnerability Management Process Recommended Process Creating a System Inventory Monitoring for Vulnerabilities, Remediations & Threats Prioritizing Vulnerability Remediation Creating Organization-Specific Remediation DB Testing Remediations Deploying Vulnerability Remediations Distributing Vulnerability & Remediation Info to Admins Verifying Remediation Vulnerability Remediation Training Recommended Process Overview Patch & Vulnerability Group (PVG) System Administrators (Sysadmins) 11 Copyright 2015 M. E. Kabay. All rights reserved. 12 Copyright 2015 M. E. Kabay. All rights reserved.
3 Overview of Process Create central, autonomous group for managing patches and vulnerabilities May have single PVG or several in hierarchy Shift patch administrators from sysadmins to PVG Reduce duplication of effort Save money Reduce errors Use standardized configurations for workstations and servers to degree possible Keep careful track of inventory and topology Patch & Vulnerability Group (PVG) Define PVG to include INFOSEC + OPS Sysadmin Intrusion detection Firewall management Operating systems experts Vulnerability scanners May be full- or part-time depending on size, complexity of organization & systems May rotate staff into group to spread knowledge 13 Copyright 2015 M. E. Kabay. All rights reserved. 14 Copyright 2015 M. E. Kabay. All rights reserved. PVG Duties 1. Create system inventory 2. Monitor for vulnerabilities, remediations & threats 3. Prioritize vulnerability remediation 4. Create organization-specific remediation database 5. Conduct generic testing of remediations 6. Deploy vulnerabilities remediations 7. Distribute vulnerability & remediation information to local system administrators 8. Perform automated deployment of patches 9. Configure automatic update of applications wherever possible & appropriate 10. Verify vulnerability remediation through NW & host vulnerability scanning 11. Vulnerability remediation training 15 Copyright 2015 M. E. Kabay. All rights reserved. System Administrators (Sysadmins) Responsible for ensuring that IT resources follow standard configuration defined for organization Ensure that resources participate in automated patching system Or if using manual patching, coordinate with PVG Handle exceptions Trial systems Experimental configurations Prototypes under development 16 Copyright 2015 M. E. Kabay. All rights reserved. Creating a System Inventory Essential to know exactly what needs protection IT Inventory Update constantly / real-time Usually prefer organization-wide DB Suggested fields on p Preferably use automated inventory agents Also use bar codes on all components Systems, peripherals. Cabling Network elements (routers, switches ) Grouping & Prioritizing IT Resources Elements in inventory need priority levels Reflect degree of criticality Impact of compromise Dependencies critical patch for recovery Can use FIPS PUB 199 Standards for Security Categorization of Federal Information and Information Systems See next slide 17 Copyright 2015 M. E. Kabay. All rights reserved. 18 Copyright 2015 M. E. Kabay. All rights reserved.
4 Get to Know the NIST CSRC NIST CSRC: FIPS Copyright 2015 M. E. Kabay. All rights reserved. 20 Copyright 2015 M. E. Kabay. All rights reserved. Use of IT Inventory & Scope of Related Duties Inventory is foundation of PVG operations Ensure PVG knows which vulnerabilities to look for & to respond to Checklist for ensuring that all vulnerable systems remediated Publication allows sysadmins to spot missing or incorrect components & fix DB Managers, security personnel can also use information productively But restrict access according to permissions as appropriate E.g., division / department / workgroup Monitoring for Vulnerabilities, Remediations & Threats Types of Security Concerns Vulnerabilities Remediations Threats (exploits, malware) Be on lookout for unauthorized Hardware Software Configurations 21 Copyright 2015 M. E. Kabay. All rights reserved. 22 Copyright 2015 M. E. Kabay. All rights reserved. Tools for Monitoring Vulnerabilities, Remediations & Threats CERT-CC Vendor Websites & mailing lists (productspecific newsletters) Third-party Web sites (e.g., SANS, CERT-CC, various alert newsletters) Vulnerability scanners Vulnerability databases National Vulnerability Database Enterprise patch management tools Other notification tools 23 Copyright 2015 M. E. Kabay. All rights reserved. 24 Copyright 2015 M. E. Kabay. All rights reserved.
5 SANS Internet Storm Center The Register 25 Copyright 2015 M. E. Kabay. All rights reserved. 26 Copyright 2015 M. E. Kabay. All rights reserved. Prioritizing Vulnerability Remediation Determine significance of threat or vulnerability Determine existence, extent & spread of related malware & exploits Determine risks involved in applying patch or nonpatch remediation Use external sources of information PVG is not a research group Creating Organization- Specific Remediation DB Enterprise patch-management tools establish DB for known inventory in organization May have to maintain own small DB or manual list of exceptions Include threat assessment information Useful in business-continuity (BC) & disaster recovery planning (DRP) Include copy of every patch used or planned Can avoid problems of rush on Website 27 Copyright 2015 M. E. Kabay. All rights reserved. 28 Copyright 2015 M. E. Kabay. All rights reserved. Testing Remediations Standardized configurations allow easy testing of patches on isolated systems Keep standard for test & development only Avoid danger of installing bad patch on production systems Eliminate need for redundant, costly testing on all local systems But critically important to maintain validity of system image so that patches really going to standard configs! See extensive list of precautions for testing on pp of text Deploying Vulnerability Remediations 3 primary methods of remediation Applying security patch ( fix or hotfix ) Modifies defective code Be sure to download only from safe sites vendor site usually safe Configuration adjustment Change parameter(s); e.g., Disabling services Changing firewall settings Altering router settings Modifying registry settings Software removal Generally advised to run only essential processes / services on production systems 29 Copyright 2015 M. E. Kabay. All rights reserved. 30 Copyright 2015 M. E. Kabay. All rights reserved.
6 Delaying Patch Installations Some patches have been discovered to be defective Caused more problems than they solved Therefore some admins are gun-shy: delay installation of patches by reflex PVG should document, analyze & discuss deviations from recommended installations Threat level Risk of compromise Consequences of compromise Distributing Vulnerability & Remediation Info to Admins Primary mechanism: automated patch management software (PMS) Emergencies (e.g., failure of PMS) may require alternative channels Plan for these backup channels in advance Maintain security Establish authenticity of patch instruction Establish authenticity & integrity of patch itself 31 Copyright 2015 M. E. Kabay. All rights reserved. 32 Copyright 2015 M. E. Kabay. All rights reserved. Verifying Remediation Must be sure patches have in fact been installed Correctly & On all appropriate targets Performing Vulnerability Scanning Automated systems can locate unpatched vulnerabilities independently Also map network topology to identify undocumented systems Reviewing Patch Logs Useful in detailed forensic-level analysis Help identify installation problems, aborts Checking Patch Levels NAC* can check for patch levels (e.g., CISCO Clean Access Agent) *Network Access Agent 33 Copyright 2015 M. E. Kabay. All rights reserved. Vulnerability Remediation Training Corporate policy may allow software other than what the PVG controls to be used Thus PVG will have to train local sysadmins in patching process Must identify which software requires manual monitoring for patches Centralized patch distribution may not apply to all systems Then users may be involved in collaboration to update systems Critically important to convince users & sysadmins of value of cooperation 34 Copyright 2015 M. E. Kabay. All rights reserved. Patch & Vulnerability Management Issues Enterprise Patching Solutions Types of Patching Solutions Nonagent Patching Solutions Agent-Based Patching Solutions Advantages & Disadvantages Integrated SW Inventory Capabilities 40.4 is beyond the level expected for an undergraduate IA mgmt course. Integrated Vulnerability Scanning Capabilities Deployment Strategies Reducing Need to Patch by Smart Purchasing Using Standardized Configurations Patching After Security Compromise Summary of Major Recommendations (1) 1. Create patch & vulnerability group 2. Continuously monitor for vulnerabilities, remediations & threats 3. Prioritize patch application & use phased deployments as appropriate 4. Test patches prior to deployment 5. Deploy enterprise-wide automated patching solutions 6. Use automatically updating applications as appropriate 7. Create inventory of all IT assets 35 Copyright 2015 M. E. Kabay. All rights reserved. 36 Copyright 2015 M. E. Kabay. All rights reserved.
7 Summary of Major Recommendations (2) 8. Use standardized configurations for IT resources as much as possible 9. Verify that vulnerabilities have been remediated. 10.Consistently measure effectiveness of organization s patch & vulnerability management program and apply corrective actions as necessary 11.Train applicable staff on vulnerability monitoring and remediation techniques 12.Periodically test effectiveness of organization s patch and vulnerability management program. Now go and study 37 Copyright 2015 M. E. Kabay. All rights reserved. 38 Copyright 2015 M. E. Kabay. All rights reserved.
Patch and Vulnerability Management Program
Patch and Vulnerability Management Program What is it? A security practice designed to proactively prevent the exploitation of IT vulnerabilities within an organization To reduce the time and money spent
Critical Security Controls
Critical Security Controls Session 2: The Critical Controls v1.0 Chris Beal Chief Security Architect MCNC chris.beal@mcnc.org @mcncsecurity on Twitter The Critical Security Controls The Critical Security
Information and Communication Technology. Patch Management Policy
BELA-BELA LOCAL MUNICIPALITY - - Chris Hani Drive, Bela- Bela, Limpopo. Private Bag x 1609 - BELA-BELA 0480 - Tel: 014 736 8000 Fax: 014 736 3288 - Website: www.belabela.gov.za - - OFFICE OF THE MUNICIPAL
Critical Controls for Cyber Security. www.infogistic.com
Critical Controls for Cyber Security www.infogistic.com Understanding Risk Asset Threat Vulnerability Managing Risks Systematic Approach for Managing Risks Identify, characterize threats Assess the vulnerability
Information Security Risk Assessment Checklist. A High-Level Tool to Assist USG Institutions with Risk Analysis
Information Security Risk Assessment Checklist A High-Level Tool to Assist USG Institutions with Risk Analysis Updated Oct 2008 Introduction Information security is an important issue for the University
Creating a Patch and Vulnerability Management Program
Special Publication 800-40 Version 2.0 (Draft) Creating a Patch and Vulnerability Management Program Recommendations of the National Institute of Standards and Technology (NIST) Peter Mell Tiffany Bergeron
Guide to Vulnerability Management for Small Companies
University of Illinois at Urbana-Champaign BADM 557 Enterprise IT Governance Guide to Vulnerability Management for Small Companies Andrew Tan Table of Contents Table of Contents... 1 Abstract... 2 1. Introduction...
Cisco Advanced Services for Network Security
Data Sheet Cisco Advanced Services for Network Security IP Communications networking the convergence of data, voice, and video onto a single network offers opportunities for reducing communication costs
Host Hardening. Presented by. Douglas Couch & Nathan Heck Security Analysts for ITaP 1
Host Hardening Presented by Douglas Couch & Nathan Heck Security Analysts for ITaP 1 Background National Institute of Standards and Technology Draft Guide to General Server Security SP800-123 Server A
THE TOP 4 CONTROLS. www.tripwire.com/20criticalcontrols
THE TOP 4 CONTROLS www.tripwire.com/20criticalcontrols THE TOP 20 CRITICAL SECURITY CONTROLS ARE RATED IN SEVERITY BY THE NSA FROM VERY HIGH DOWN TO LOW. IN THIS MINI-GUIDE, WE RE GOING TO LOOK AT THE
SECURITY PATCH MANAGEMENT INSTALLATION POLICY AND PROCEDURES
REQUIREMENT 6.1 TO 6.2 SECURITY PATCH MANAGEMENT INSTALLATION POLICY AND PROCEDURES 6.1 TO 6.2 OVERVIEW In accordance with Payment Card Industry Data Security Standards (PCI DSS) requirements, [company
AHS Flaw Remediation Standard
AGENCY OF HUMAN SERVICES AHS Flaw Remediation Standard Jack Green 10/14/2013 The purpose of this procedure is to facilitate the implementation of the Vermont Health Connect s security control requirements
AUTOMATING THE 20 CRITICAL SECURITY CONTROLS
AUTOMATING THE 20 CRITICAL SECURITY CONTROLS Wolfgang Kandek, CTO Qualys Session ID: Session Classification: SPO-T07 Intermediate 2012 the Year of Data Breaches 2013 continued in a similar Way Background
Looking at the SANS 20 Critical Security Controls
Looking at the SANS 20 Critical Security Controls Mapping the SANS 20 to NIST 800-53 to ISO 27002 by Brad C. Johnson The SANS 20 Overview SANS has created the 20 Critical Security Controls as a way of
5 Steps to Advanced Threat Protection
5 Steps to Advanced Threat Protection Agenda Endpoint Protection Gap Profile of Advanced Threats Consensus Audit Guidelines 5 Steps to Advanced Threat Protection Resources 20 Years of Chasing Malicious
CONTINUOUS DIAGNOSTICS BEGINS WITH REDSEAL
CONTINUOUS DIAGNOSTICS BEGINS WITH REDSEAL WHAT IS CDM? The continuous stream of high profile cybersecurity breaches demonstrates the need to move beyond purely periodic, compliance-based approaches to
Ovation Security Center Data Sheet
Features Scans for vulnerabilities Discovers assets Deploys security patches transparently Allows only white-listed applications to run in workstations Provides virus protection for Ovation Windows workstations
SANS Top 20 Critical Controls for Effective Cyber Defense
WHITEPAPER SANS Top 20 Critical Controls for Cyber Defense SANS Top 20 Critical Controls for Effective Cyber Defense JANUARY 2014 SANS Top 20 Critical Controls for Effective Cyber Defense Summary In a
The Protection Mission a constant endeavor
a constant endeavor The IT Protection Mission a constant endeavor As businesses become more and more dependent on IT, IT must face a higher bar for preparedness Cyber preparedness is the process of ensuring
Computer Security: Principles and Practice
Computer Security: Principles and Practice Chapter 17 IT Security Controls, Plans and Procedures First Edition by William Stallings and Lawrie Brown Lecture slides by Lawrie Brown Implementing IT Security
Cybersecurity Health Check At A Glance
This cybersecurity health check provides a quick view of compliance gaps and is not intended to replace a professional HIPAA Security Risk Analysis. Failing to have more than five security measures not
TECHNICAL VULNERABILITY & PATCH MANAGEMENT
INFORMATION SECURITY POLICY TECHNICAL VULNERABILITY & PATCH MANAGEMENT ISO 27002 12.6.1 Author: Owner: Organisation: Document No: Chris Stone Ruskwig TruePersona Ltd SP-12.6.1 Version No: 1.1 Date: 1 st
Payment Card Industry Data Security Standard
Symantec Managed Security Services support for IT compliance Solution Overview: Symantec Managed Services Overviewview The (PCI DSS) was developed to facilitate the broad adoption of consistent data security
Unified Security Anywhere HIPAA COMPLIANCE ACHIEVING HIPAA COMPLIANCE WITH MASERGY PROFESSIONAL SERVICES
Unified Security Anywhere HIPAA COMPLIANCE ACHIEVING HIPAA COMPLIANCE WITH MASERGY PROFESSIONAL SERVICES HIPAA COMPLIANCE Achieving HIPAA Compliance with Security Professional Services The Health Insurance
Ovation Security Center Data Sheet
Features Scans for vulnerabilities Discovers assets Deploys security patches easily Allows only white-listed applications in workstations to run Provides virus protection for Ovation Windows stations Aggregates,
Patch Management Policy
Patch Management Policy L2-POL-12 Version No :1.0 Revision History REVISION DATE PREPARED BY APPROVED BY DESCRIPTION Original 1.0 2-Apr-2015 Process Owner Management Representative Initial Version No.:
University of Pittsburgh Security Assessment Questionnaire (v1.5)
Technology Help Desk 412 624-HELP [4357] technology.pitt.edu University of Pittsburgh Security Assessment Questionnaire (v1.5) Directions and Instructions for completing this assessment The answers provided
Data Management Policies. Sage ERP Online
Sage ERP Online Sage ERP Online Table of Contents 1.0 Server Backup and Restore Policy... 3 1.1 Objectives... 3 1.2 Scope... 3 1.3 Responsibilities... 3 1.4 Policy... 4 1.5 Policy Violation... 5 1.6 Communication...
How To Manage A System Vulnerability Management Program
System Vulnerability Management Definitions White Paper October 12, 2005 2005 Altiris Inc. All rights reserved. ABOUT ALTIRIS Altiris, Inc. is a pioneer of IT lifecycle management software that allows
Attachment A. Identification of Risks/Cybersecurity Governance
Attachment A Identification of Risks/Cybersecurity Governance 1. For each of the following practices employed by the Firm for management of information security assets, please provide the month and year
SWAP EXECUTION FACILITY OPERATIONAL CAPABILITY TECHNOLOGY QUESTIONNAIRE
SWAP EXECUTION FACILITY OPERATIONAL CAPABILITY TECHNOLOGY QUESTIONNAIRE Please provide all relevant documents responsive to the information requests listed within each area below. In addition to the specific
IT ASSET MANAGEMENT Securing Assets for the Financial Services Sector
IT ASSET MANAGEMENT Securing Assets for the Financial Services Sector V.2 Final Draft May 1, 2014 financial_nccoe@nist.gov This revision incorporates comments from the public. Page Use case 1 Comments
PATCH MANAGEMENT. February 2008. The Government of the Hong Kong Special Administrative Region
PATCH MANAGEMENT February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in part without
CDM Hardware Asset Management (HWAM) Capability
CDM Hardware Asset Management (HWAM) Capability Department of Homeland Security Office of Cybersecurity and Communications Federal Network Resilience Table of Contents 1 PURPOSE AND SCOPE... 2 2 THREAT
Larry Wilson Version 1.0 November, 2013. University Cyber-security Program Critical Asset Mapping
Larry Wilson Version 1.0 November, 2013 University Cyber-security Program Critical Asset Mapping Part 3 - Cyber-Security Controls Mapping Cyber-security Controls mapped to Critical Asset Groups CSC Control
UMHLABUYALINGANA MUNICIPALITY PATCH MANAGEMENT POLICY/PROCEDURE
UMHLABUYALINGANA MUNICIPALITY PATCH MANAGEMENT POLICY/PROCEDURE Originator Patch Management Policy Approval and Version Control Approval Process: Position or Meeting Number: Date: Recommended by Director
Security Standard: Servers, Server-based Applications and Databases
Security Standard: Servers, Server-based Applications and Databases Scope This standard applies to all servers (including production, training, test, and development servers) and the operating system,
Cyber Risk Mitigation via Security Monitoring. Enhanced by Managed Services
Cyber Risk Mitigation via Security Monitoring Enhanced by Managed Services Focus: Up to But Not Including Corporate and 3 rd Party Networks Level 4 Corporate and 3 rd Party/Vendor/Contractor/Maintenance
Securing the University Network
Securing the University Network Abstract Endpoint policy compliance solutions take either a network-centric or device-centric approach to solving the problem. The body of this paper addresses these two
NERC CIP VERSION 5 COMPLIANCE
BACKGROUND The North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) Reliability Standards define a comprehensive set of requirements that are the basis for maintaining
Taxonomy of Intrusion Detection System
Taxonomy of Intrusion Detection System Monika Sharma, Sumit Sharma Abstract During the past years, security of computer networks has become main stream in most of everyone's lives. Nowadays as the use
INCIDENT RESPONSE CHECKLIST
INCIDENT RESPONSE CHECKLIST The purpose of this checklist is to provide clients of Kivu Consulting, Inc. with guidance in the initial stages of an actual or possible data breach. Clients are encouraged
CS 356 Lecture 25 and 26 Operating System Security. Spring 2013
CS 356 Lecture 25 and 26 Operating System Security Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control
Cybersecurity and internal audit. August 15, 2014
Cybersecurity and internal audit August 15, 2014 arket insights: what we are seeing so far? 60% of organizations see increased risk from using social networking, cloud computing and personal mobile devices
DESIGNATED CONTRACT MARKET OPERATIONAL CAPABILITY TECHNOLOGY QUESTIONNAIRE
DESIGNATED CONTRACT MARKET OPERATIONAL CAPABILITY TECHNOLOGY QUESTIONNAIRE Please provide all relevant documents responsive to the information requests listed within each area below. In addition to the
Application White Listing and Privilege Management: Picking Up Where Antivirus Leaves Off
Application White Listing and Privilege Management: Picking Up Where Antivirus Leaves Off Times have Changed & A/V Executives Agree An A/V product as your sole endpoint protection solution isn t enough.
OPERATIONAL CAPABILITY TECHNOLOGY QUESTIONNAIRE
OPERATIONAL CAPABILITY TECHNOLOGY QUESTIONNAIRE Please provide all relevant documents responsive to the information requests listed within each area below. In addition to the specific documents requested,
Executive Summary Program Highlights for FY2009/2010 Mission Statement Authority State Law: University Policy:
Executive Summary Texas state law requires that each state agency, including Institutions of Higher Education, have in place an Program (ISP) that is approved by the head of the institution. 1 Governance
Breaking down silos of protection: An integrated approach to managing application security
IBM Software Thought Leadership White Paper October 2013 Breaking down silos of protection: An integrated approach to managing application security Protect your enterprise from the growing volume and velocity
Towards End-to-End Security
Towards End-to-End Security Thomas M. Chen Dept. of Electrical Engineering Southern Methodist University PO Box 750338 Dallas, TX 75275-0338 USA Tel: 214-768-8541 Fax: 214-768-3573 Email: tchen@engr.smu.edu
SECURING YOUR SMALL BUSINESS. Principles of information security and risk management
SECURING YOUR SMALL BUSINESS Principles of information security and risk management The challenge Information is one of the most valuable assets of any organization public or private, large or small and
Check Point and Security Best Practices. December 2013 Presented by David Rawle
Check Point and Security Best Practices December 2013 Presented by David Rawle Housekeeping o Mobiles on Silent o No File Alarms planned o Fire exits are in front and behind and down the stairs o Downstairs
Complete Patch Management
Complete Management Targeted, Reliable and Cost-efficient In- Depth CSI Corporate Software Inspector Empower your IT-Operations and Security Teams with the most reliable Vulnerability & Management solution
Addressing the SANS Top 20 Critical Security Controls for Effective Cyber Defense
A Trend Micro Whitepaper I February 2016 Addressing the SANS Top 20 Critical Security Controls for Effective Cyber Defense How Trend Micro Deep Security Can Help: A Mapping to the SANS Top 20 Critical
Introduction. Special thanks to the following individuals who were instrumental in the development of the toolkits:
Introduction In this digital age, we rely on our computers and devices for so many aspects of our lives that the need to be proactive and vigilant to protect against cyber threats has never been greater.
Managing Vulnerabilities for PCI Compliance White Paper. Christopher S. Harper Managing Director, Agio Security Services
Managing Vulnerabilities for PCI Compliance White Paper Christopher S. Harper Managing Director, Agio Security Services PCI STRATEGY Settling on a PCI vulnerability management strategy is sometimes a difficult
TEMPLE UNIVERSITY POLICIES AND PROCEDURES MANUAL
TEMPLE UNIVERSITY POLICIES AND PROCEDURES MANUAL Title: Computer and Network Security Policy Policy Number: 04.72.12 Effective Date: November 4, 2003 Issuing Authority: Office of the Vice President for
Use of the Common Vulnerabilities and Exposures (CVE) Vulnerability Naming Scheme
NIST Special Publication 800-51 Use of the Common Vulnerabilities and Exposures (CVE) Vulnerability Naming Scheme Recommendations of the National Institute of Standards and Technology Peter Mell Tim Grance
Managed Antivirus Quick Start Guide
Quick Start Guide Managed Antivirus In 2010, GFI Software enhanced its security product offering with the acquisition of Sunbelt Software and specifically its VIPRE product suite. Like GFI Software, Sunbelt
Name. Description. Rationale
Complliiance Componentt Description DEEFFI INITION Network-Based Intrusion Detection Systems (NIDS) Network-Based Intrusion Detection Systems (NIDS) detect attacks by capturing and analyzing network traffic.
Security Management. Keeping the IT Security Administrator Busy
Security Management Keeping the IT Security Administrator Busy Dr. Jane LeClair Chief Operating Officer National Cybersecurity Institute, Excelsior College James L. Antonakos SUNY Distinguished Teaching
Cyber Security Incident Handling Policy. Information Technology Services Center (ITSC) of The Hong Kong University of Science and Technology
Cyber Security Incident Handling Policy Information Technology Services Center (ITSC) of The Hong Kong University of Science and Technology Date: Oct 9, 2015 i Document Control Document Owner Classification
ITL BULLETIN FOR SEPTEMBER 2012 REVISED GUIDE HELPS ORGANIZATIONS HANDLE SECURITY-RELATED INCIDENTS
ITL BULLETIN FOR SEPTEMBER 2012 REVISED GUIDE HELPS ORGANIZATIONS HANDLE SECURITY-RELATED INCIDENTS Shirley Radack, Editor Computer Security Division Information Technology Laboratory National Institute
Software Asset Management (SWAM) Capability Description
Software Asset Management (SWAM) Capability Description Purpose Provides an organization visibility into the software installed and operating on their network(s) so they can appropriately manage authorized
Management (CSM) Capability
CDM Configuration Settings Management (CSM) Capability Department of Homeland Security National Cyber Security Division Federal Network Security Network & Infrastructure Security Table of Contents 1 PURPOSE
ensure prompt restart of critical applications and business activities in a timely manner following an emergency or disaster
Security Standards Symantec shall maintain administrative, technical, and physical safeguards for the Symantec Network designed to (i) protect the security and integrity of the Symantec Network, and (ii)
SIMATIC. Process Control System PCS 7 Configuration Symantec Endpoint Protection (V12.1) Preface 1. Virus scanner administration 2.
Preface 1 Virus scanner administration 2 SIMATIC Configuration 3 Process Control System PCS 7 Configuration Symantec Endpoint Protection (V12.1) Commissioning Manual 04/2013 A5E03874574-02 Legal information
Threat Management: Incident Handling. Incident Response Plan
In order to meet the requirements of VCCS Security Standards 13.1 Reporting Information Security Events, and 13.2 Management of Information Security Incidents, SVCC drafted an (IRP). Incident handling
FIREWALL CHECKLIST. Pre Audit Checklist. 2. Obtain the Internet Policy, Standards, and Procedures relevant to the firewall review.
1. Obtain previous workpapers/audit reports. FIREWALL CHECKLIST Pre Audit Checklist 2. Obtain the Internet Policy, Standards, and Procedures relevant to the firewall review. 3. Obtain current network diagrams
WHITE PAPER AUTOMATED, REAL-TIME RISK ANALYSIS AND REMEDIATION
WHITE PAPER AUTOMATED, REAL-TIME RISK ANALYSIS AND REMEDIATION Table of Contents Executive Summary...3 Vulnerability Scanners Alone Are Not Enough...3 Real-Time Change Configuration Notification is the
CHAPTER 3 : INCIDENT RESPONSE FIVE KEY RECOMMENDATIONS GLOBAL THREAT INTELLIGENCE REPORT 2015 :: COPYRIGHT 2015 NTT INNOVATION INSTITUTE 1 LLC
: INCIDENT RESPONSE FIVE KEY RECOMMENDATIONS 1 FIVE KEY RECOMMENDATIONS During 2014, NTT Group supported response efforts for a variety of incidents. Review of these engagements revealed some observations
AN OVERVIEW OF VULNERABILITY SCANNERS
AN OVERVIEW OF VULNERABILITY SCANNERS February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole
SECURITY BEST PRACTICES FOR CISCO PERSONAL ASSISTANT (1.4X)
WHITE PAPER SECURITY BEST PRACTICES FOR CISCO PERSONAL ASSISTANT (1.4X) INTRODUCTION This document covers the recommended best practices for hardening a Cisco Personal Assistant 1.4(x) server. The term
How to Develop an Effective Vulnerability Management Process
Research Publication Date: 1 March 2005 ID Number: G00124126 How to Develop an Effective Vulnerability Management Process Mark Nicolett IT organizations should develop vulnerability management processes
Secure Content Automation Protocol (SCAP): How it is increasingly used to automate enterprise security management activities
Secure Content Automation Protocol (SCAP): How it is increasingly used to automate enterprise security management activities Sean Barnum sbarnum@mitre.org September 2011 Overview What is SCAP? Why SCAP?
Checklist for Vulnerability Assessment
Checklist for Vulnerability Assessment Implement processes to test for the presence of wireless access points (802.11), and detect and identify all authorized and unauthorized wireless access points on
Enterprise Cybersecurity Best Practices Part Number MAN-00363 Revision 006
Enterprise Cybersecurity Best Practices Part Number MAN-00363 Revision 006 April 2013 Hologic and the Hologic Logo are trademarks or registered trademarks of Hologic, Inc. Microsoft, Active Directory,
O N L I N E I N C I D E N T R E S P O N S E C O M M U N I T Y
Automate Response Congratulations on selecting IncidentResponse.com to retrieve your custom incident response workflow guide. This guide has been created especially for you for use in within your security
Vulnerability Audit: Why a Vulnerability Scan Isn t Enough. White Paper
Vulnerability Audit: Why a Vulnerability Scan Isn t Enough White Paper May 10, 2005 TABLE OF CONTENTS Introduction: How Secure Are My Systems?... 3 Vulnerability: The Modern Meaning Of A Muddled Word...
System Security Policy Management: Advanced Audit Tasks
System Security Policy Management: Advanced Audit Tasks White Paper October 6, 2005 2005 Altiris Inc. All rights reserved. ABOUT ALTIRIS Altiris, Inc. is a pioneer of IT lifecycle management software that
What s Wrong with Information Security Today? You are looking in the wrong places for the wrong things.
What s Wrong with Information Security Today? You are looking in the wrong places for the wrong things. AGENDA Current State of Information Security Data Breach Statics Data Breach Case Studies Why current
modules 1 & 2. Section: Information Security Effective: December 2005 Standard: Server Security Standard Revised: Policy Ref:
SERVER SECURITY STANDARD Security Standards are mandatory security rules applicable to the defined scope with respect to the subject. Overview Scope Purpose Instructions Improperly configured systems,
PROTECTING INFORMATION SYSTEMS WITH FIREWALLS: REVISED GUIDELINES ON FIREWALL TECHNOLOGIES AND POLICIES
PROTECTING INFORMATION SYSTEMS WITH FIREWALLS: REVISED GUIDELINES ON FIREWALL TECHNOLOGIES AND POLICIES Shirley Radack, Editor Computer Security Division Information Technology Laboratory National Institute
Security aspects of e-tailing. Chapter 7
Security aspects of e-tailing Chapter 7 1 Learning Objectives Understand the general concerns of customers concerning security Understand what e-tailers can do to address these concerns 2 Players in e-tailing
NETWORK AND CERTIFICATE SYSTEM SECURITY REQUIREMENTS
NETWORK AND CERTIFICATE SYSTEM SECURITY REQUIREMENTS Scope and Applicability: These Network and Certificate System Security Requirements (Requirements) apply to all publicly trusted Certification Authorities
HIGH-RISK SECURITY VULNERABILITIES IDENTIFIED DURING REVIEWS OF INFORMATION TECHNOLOGY GENERAL CONTROLS
Department of Health and Human Services OFFICE OF INSPECTOR GENERAL HIGH-RISK SECURITY VULNERABILITIES IDENTIFIED DURING REVIEWS OF INFORMATION TECHNOLOGY GENERAL CONTROLS AT STATE MEDICAID AGENCIES Inquiries
Risk-based solutions for managing application security
IBM Software Thought Leadership White Paper September 2013 Risk-based solutions for managing application security Protect the enterprise from the growing volume and velocity of threats with integrated
Supplier Information Security Addendum for GE Restricted Data
Supplier Information Security Addendum for GE Restricted Data This Supplier Information Security Addendum lists the security controls that GE Suppliers are required to adopt when accessing, processing,
IT Best Practices Audit TCS offers a wide range of IT Best Practices Audit content covering 15 subjects and over 2200 topics, including:
IT Best Practices Audit TCS offers a wide range of IT Best Practices Audit content covering 15 subjects and over 2200 topics, including: 1. IT Cost Containment 84 topics 2. Cloud Computing Readiness 225
Patch Management Procedure. Andrew Marriott andrew.marriott@fylde.gov.uk 01253 658578 PATCH MANAGEMENT PROCEDURE.DOCX Version: 1.1
Title: Patch Management Andrew Marriott andrew.marriott@fylde.gov.uk 01253 658578 PATCH MANAGEMENT PROCEDURE.DOCX Version: 1.1 Contents 1. Introduction... 4 2. Objectives... 4 3. Context... 4 4. Responsibility...
The Business Case for Security Information Management
The Essentials Series: Security Information Management The Business Case for Security Information Management sponsored by by Dan Sullivan Th e Business Case for Security Information Management... 1 Un
Guideline on Vulnerability and Patch Management
CMSGu2014-03 Mauritian Computer Emergency Response Team CERT-MU SECURITY GUIDELINE 2011-02 Enhancing Cyber Security in Mauritius Guideline on Vulnerability and Patch Management National Computer Board
LAMAR STATE COLLEGE - ORANGE INFORMATION RESOURCES SECURITY MANUAL. for INFORMATION RESOURCES
LAMAR STATE COLLEGE - ORANGE INFORMATION RESOURCES SECURITY MANUAL for INFORMATION RESOURCES Updated: June 2007 Information Resources Security Manual 1. Purpose of Security Manual 2. Audience 3. Acceptable
State of South Carolina Policy Guidance and Training
State of South Carolina Policy Guidance and Training Policy Workshop Small Agency Threat and Vulnerability Management Policy May 2014 Agenda Questions & Follow-Up Policy Workshop Overview & Timeline Policy
Report of Evaluation OFFICE OF INSPECTOR GENERAL. OIG 2014 Evaluation of the Farm Credit OIG 2014 Administration s. Management Act.
OFFICE OF INSPECTOR GENERAL Report of Evaluation OIG 2014 Evaluation of the Farm Credit OIG 2014 Administration s Evaluation of the Farm Compliance Credit Administration s with the Federal Information
GFI White Paper PCI-DSS compliance and GFI Software products
White Paper PCI-DSS compliance and Software products The Payment Card Industry Data Standard () compliance is a set of specific security standards developed by the payment brands* to help promote the adoption
Course Title: Penetration Testing: Network & Perimeter Testing
Course Title: Penetration Testing: Network & Perimeter Testing Page 1 of 7 Course Description: The Security Analyst Series from EC-Council Press is comprised of five books covering a broad base of topics
Complete Managed Services. Proposal for managed services for the City of Tontitown
Complete Managed Services Proposal for managed services for the City of Tontitown Complete Managed Services Components Windows Server 2008, Windows Server 2012 1. Proactive Maintenance of Server(s) Proactive
FISMA / NIST 800-53 REVISION 3 COMPLIANCE
Mandated by the Federal Information Security Management Act (FISMA) of 2002, the National Institute of Standards and Technology (NIST) created special publication 800-53 to provide guidelines on security
Cautela Labs Cloud Agile. Secured.
Cautela Labs Cloud Agile. Secured. Vulnerability Management Scanning and Assessment Service Vulnerability Management Services New network, application and database vulnerabilities emerge every day. Because