State of South Carolina Policy Guidance and Training
|
|
|
- Carol Campbell
- 8 years ago
- Views:
Transcription
1 DRAFT For Discussion Purposes Only State of South Carolina Policy Guidance and Training Policy Workshop All Agencies Information Systems (IS) Acquisitions, Development, and Maintenance Policy April/May 2014
2 DRAFT For Discussion Purposes Only Agenda Questions & Follow-Up Policy Workshop Overview & Timeline Policy Overview: IS Acquisitions, Maintenance, and Development Policy Risk Assessment Framework & IS Acquisitions, Maintenance, and Development Policy Next Steps 2
3 Questions & Follow-Up DRAFT For Discussion Purposes Only
4 DRAFT For Discussion Purposes Only Policy Workshop Q&As The following questions were raised during the Access Control policy workshop for all Agencies: Question #1 For third party hosted systems, does the third party need to be certified (e.g., SSAE 16) or provide reporting back to the Agency? Are there any mandatory requirements from DIS? Answer #1: IS Acquisitions, Maintenance and Development and IT Risk Management policies provide guidance that Agencies need to monitor the third parties on an ongoing basis to ensure compliance with security requirements. Method and approach used is left up to the Agencies discretion. Question #2: Will DIS be recommending an asset management software? Answer #2: DIS has no current recommendations on the asset management software. 4
5 DRAFT For Discussion Purposes Only Policy Workshop Q&As (continued) The following questions were raised during the Access Control policy workshop for all Agencies: Question #3 When will the DIS InfoSec policies become final? Answer #3: Policy comment period has closed. InfoSec policies are being finalized by the DIS. Agencies should not refrain from making progress as no major or substantial changes will be made based on feedback received. All policies have been posted on the DIS website under the Policies tab ( Question #4 When will the training materials be posted on DIS website? Answer #4: The training materials and schedules are uploaded on the DIS website under the Resources tab ( 5
6 DRAFT For Discussion Purposes Only Policy Workshops Overview & Timeline
7 Activities Agencies TO DOs DRAFT For Discussion Purposes Only Policy Workshop: Timeline Objective: Conduct bi-weekly policy workshops with selected agencies to review information security policies, address implementation challenges, risks and assist on gap analysis and action plans with the Agency-designated policy champions. March April May June July August Policy: Policies: Policies: Policies: Policies: Policy: Asset Management Data Protection & Privacy Access Control Information System Acquisition, Development, Maintenance Threat and Vulnerability Management Business Continuity Management IT Risk Strategy Mobile Security HR & Security Awareness Physical & Environmental Security Facilitate bi-weekly Agency group workshops Review statewide policies Address key policy implementation challenges Conduct mini-gap analysis Discuss policy implementation plans Review Statewide policies and conduct mini-gap analysis Actively participate in breakout groups to discuss gaps and implementation challenges Identify remediation strategies and policy implementation plans 7
8 DRAFT For Discussion Purposes Only Policy Overview: IS Acquisitions, Development, and Maintenance Policy
9 DRAFT For Discussion Purposes Only IS Acquisitions Development and Maintenance: Key Requirements Change Management Configuration Change Control Agency shall incorporate the following recommendations for the change control process: Determine the impact on the system and its functionality through change requests; Implement a process to categorize, prioritize and authorize changes to the information system; Formally manage changes to production environment Review and test information systems after major changes to operating systems Obtain management approvals Perform post-implementation reviews 9
10 DRAFT For Discussion Purposes Only IS Acquisitions Development and Maintenance: Configuration Change Control The process below provides a graphic representation of Configuration Change Control Change Requested through change request process Postimplementation review conducted Change categorized, prioritized & authorized Change initiated Obtain management approval for change Change reviewed & tested 10
11 IS Acquisitions Development and Maintenance: Key Requirements (Cont d) DRAFT For Discussion Purposes Only Configuration Management Baseline Configuration Agency shall manage changes to baseline configurations prior to implementing changes through: Identification Review Security impact analysis Testing Approval. Agency shall establish and maintain a central repository of all baseline configurations and restrict access to prevent unauthorized changes. Agency shall retain older versions of baseline configurations. Agency shall review and update baseline configurations periodically. 11
12 DRAFT For Discussion Purposes Only IS Acquisitions Development and Maintenance: Baseline Configuration Management The process below provides a graphic representation of a Baseline Configuration Management Formally Approve Baseline Configurations Manage Changes to Baseline Configurations Maintain Central Repository of All Baseline Configurations Retain Older Versions of Baseline Configurations Review and Update Baseline Configurations 12
13 IS Acquisitions Development and Maintenance: Key Requirements (Cont d) DRAFT For Discussion Purposes Only System Development and Maintenance System Security Plan (SSP) Agency shall ONLY document SSPs for: 1) Mission Critical enterprise information systems, or 2) Systems under development An SSP shall describe the controls for the system life cycle: development, testing, review, approval, etc. (NIST template can be accessed at final.pdf) If a qualifying system is modified, the documentation shall be updated accordingly. Vulnerability Scanning Agency shall perform vulnerability assessments on information systems undergoing significant changes prior to being moved into production. 13
14 IS Acquisitions Development and Maintenance: Key Requirements (Cont d) DRAFT For Discussion Purposes Only System Development and Maintenance Vulnerability Scanning (cont d) Agency shall establish remediation measures to address the findings of vulnerability assessments. Agency shall assess, monitor and address information system-related vulnerability notifications from vendors System and Services Acquisition Policy and Procedures Agency shall ensure that all IT procurement contracts interest. protect State s System Development Life Cycle Agency shall implement security controls at all stages of the information system development life cycle. 14
15 IS Acquisitions Development and Maintenance: Key Requirements (Cont d) DRAFT For Discussion Purposes Only System Development and Maintenance External Information System Services Agency shall monitor outsourced (i.e. third party) software development. Developer Security Testing and Evaluation Agency shall establish separate development, environments. testing, and production Agency shall only use sanitized production data for testing purposes. When production data is temporarily used in testing Agency shall: Obtain management approval Remove post-test data Document related activities environment, the 15
16 IS Acquisitions Development and Maintenance: Key Requirements (Cont d) DRAFT For Discussion Purposes Only System Development and Maintenance Flaw Remediation Agency shall ensure correct processing of user-developed applications and information systems data. Agency shall apply software patches to remove or reduce security weaknesses. Security Alerts, Advisories, and Directives Agency shall collect patch alerts, advisories, and directives on an ongoing basis (frequency will be determined by the Agency). Agency shall designate personnel to monitor vulnerabilities and vendors patches and fixes. 16
17 IS Acquisitions Development and Maintenance: Key Requirements (Cont d) DRAFT For Discussion Purposes Only System Development and Maintenance Software, Firmware, and Information Integrity Agency s upgrades to information systems due to new releases shall be based on: Business requirements for the change; Security of the release (e.g., the number and severity of security problems affecting this version). Agency shall test critical operating system (OS) changes and updates in the test environment ONLY. Information Input Validation Agency shall test the validity of information inputs and outputs. Agency shall detect information system processing errors and inadvertent or deliberate activities. 17
18 IS Acquisitions Development and Maintenance: Key Requirements (Cont d) DRAFT For Discussion Purposes Only System Development and Maintenance Session Authenticity Agency shall identify controls to: Ensure session authenticity; Protect message integrity in applications; and Protect information transmission to and from information systems. Release Management Allocation of Resources Agency shall ensure that production-ready release packages have been deployed using the release management lifecycle. 18
19 IS Acquisitions Development and Maintenance: Key Requirements (Cont d) DRAFT For Discussion Purposes Only Release Management Allocation of Resources Agency s release planning process shall include: Resources required to deploy release; Pass / fail criteria; Build and test plans prior to implementation; Pilot and deployment plans; and Develop requirements for the release. Deploy Test Pilot Plan Release Management Cycle Build Prepare 19
20 IS Acquisitions Development and Maintenance: Key Requirements (Cont d) DRAFT For Discussion Purposes Only Release Management Information System Documentation Agency shall document processes for management of IT release lifecycle and release prioritization. Agency shall ensure that release designs are aligned with the requirements and identifying risks and potential issues. Security Engineering Principles Agency shall use the change request process to deploy releases into production. 20
21 Risk Assessment Framework & IS Acquisitions, Maintenance, and Development Policy DRAFT For Discussion Purposes Only
22 DRAFT For Discussion Purposes Only Risk Assessment Framework The Risk Assessment Framework, based on the National Institute of Standards and Technology (NIST ), was used as the basis to assess risk across the State Agencies using the fifteen (15) security domains (noted below): 22
23 DRAFT For Discussion Purposes Only IS Acquisitions, Development, and Maintenance Policy: Risks & Remediation Strategies Risk assessments conducted with State Agencies uncovered a number of risks in environments with inadequately implemented Access Control Policy and procedures. Remediation strategies were created to help Agencies address gaps and implement necessary safeguards. Examples Overall Risks Identified Gaps Remediation Strategies Sensitive data exposure during code testing Technical risk to security posture of Agency Lack of developer training leads to sub-standard code development 23 Agencies do not conduct code reviews and peer reviews prior to making changes to the production environment Agencies have not established an enterprise-wide Systems Develop Life Cycle (SDLC) Production data is copied into development environments without proper security considerations Developers are not provided information security trainings such as secure coding practices or secure development standards Establish code review and peer review procedures in the system development life cycle Establish a enterprise-wide SDLC Establish three environments - production, test and development to conduct code testing Provide code developers with training related to industry best practices related to secure coding practices and development standards
24 DRAFT For Discussion Purposes Only IS Acquisitions, Development, and Maintenance Policy: Challenges & Remediation Strategies for all Agencies Sample Challenges Examples Potential Solutions Collecting Performance Metrics Lack of a structured communications process Develop a process to collect software metrics and which is approved by management Request end-user participation in the collection of metrics Establish a structured communication process to solicit inputs from end users Encourage period debriefs between the developer community and the end user. Segregation of Duties Establish separate roles for code development and code review Securing code post approval, however, prior to implementation in the production environment Emergency changes to production software Code ready for production could be secured in a test server prior to its release to production Access to this server can be restricted only to authorized personnel Develop an emergency change management process involving only the required number of authorized personnel. Ensure all such changes are reviewed and approved by a member of the security team (i.e., information security officer or equivalent) and approved by an authorized individual (i.e., IT director or equivalent) 24
25 Next Steps DRAFT For Discussion Purposes Only
26 DRAFT For Discussion Purposes Only Next Steps 1. Develop or update Agency s InfoSec policies to align with published State policies 2. Conduct Policy Gap Analysis 3. Develop Policy Implementation Plan of Action 4. Develop processes to enable the implementation of InfoSec Policies 5. Promote Agency-wide InfoSec policies awareness 6. Coordinate with DIS on training and guidance 26
State of South Carolina Policy Guidance and Training
State of South Carolina Policy Guidance and Training Policy Workshop Small Agency Threat and Vulnerability Management Policy May 2014 Agenda Questions & Follow-Up Policy Workshop Overview & Timeline Policy
State of South Carolina Policy Guidance and Training
State of South Carolina Policy Guidance and Training Policy Workshop All Agency Mobile Security July 2014 Agenda Questions & Follow-Up Policy Workshop Overview & Timeline Policy Overview: Mobile Security
State of South Carolina Policy Guidance and Training
State of South Carolina Policy Guidance and Training Policy Workshop All Agencies Human Resource (HR) and Security Awareness July 2014 Agenda Questions & Follow-Up Open Questions Policy Workshop Overview
DIVISION OF INFORMATION SECURITY (DIS)
DIVISION OF INFORMATION SECURITY (DIS) Information Security Policy Information Systems Acquisitions, Development, and Maintenance v1.0 October 15, 2013 Revision History Update this table every time a new
State of South Carolina Policy Guidance and Training
State of South Carolina Policy Guidance and Training Policy Workshop All Agencies Business Continuity Management Policy June 2014 Agenda Questions & Follow-Up Policy Workshop Overview & Timeline Policy
State of South Carolina Policy Guidance and Training
State of South Carolina Policy Guidance and Training Policy Workshop All Agency IT Risk Strategy June 2014 Agenda Questions & Follow-Up Policy Workshop Overview & Timeline Policy Overview: IT Risk Strategy
DIVISION OF INFORMATION SECURITY (DIS) Information Security Policy Threat and Vulnerability Management V1.0 April 21, 2014
DIVISION OF INFORMATION SECURITY (DIS) Information Security Policy Threat and Vulnerability Management V1.0 April 21, 2014 Revision History Update this table every time a new edition of the document is
State of South Carolina Policy Guidance and Training
State of South Carolina Policy Guidance and Training Policy Workshop All Agency Access Control Policy April 2014 Agenda Questions & Follow-Up Policy Overview: Access Control Policy Risk Assessment Framework
DIVISION OF INFORMATION SECURITY (DIS) Information Security Policy IT Risk Strategy V0.1 April 21, 2014
DIVISION OF INFORMATION SECURITY (DIS) Information Security Policy IT Risk Strategy V0.1 April 21, 2014 Revision History Update this table every time a new edition of the document is published Date Authored
IT General Controls Domain COBIT Domain Control Objective Control Activity Test Plan Test of Controls Results
Acquire or develop application systems software Controls provide reasonable assurance that application and system software is acquired or developed that effectively supports financial reporting requirements.
Risk Management Guide for Information Technology Systems. NIST SP800-30 Overview
Risk Management Guide for Information Technology Systems NIST SP800-30 Overview 1 Risk Management Process that allows IT managers to balance operational and economic costs of protective measures and achieve
Office of the Auditor General Performance Audit Report. Statewide UNIX Security Controls Department of Technology, Management, and Budget
Office of the Auditor General Performance Audit Report Statewide UNIX Security Controls Department of Technology, Management, and Budget December 2015 State of Michigan Auditor General Doug A. Ringler,
5 FAH-11 H-500 PERFORMANCE MEASURES FOR INFORMATION ASSURANCE
5 FAH-11 H-500 PERFORMANCE MEASURES FOR INFORMATION ASSURANCE 5 FAH-11 H-510 GENERAL (Office of Origin: IRM/IA) 5 FAH-11 H-511 INTRODUCTION 5 FAH-11 H-511.1 Purpose a. This subchapter implements the policy
State of Oregon. State of Oregon 1
State of Oregon State of Oregon 1 Table of Contents 1. Introduction...1 2. Information Asset Management...2 3. Communication Operations...7 3.3 Workstation Management... 7 3.9 Log management... 11 4. Information
Build (develop) and document Acceptance Transition to production (installation) Operations and maintenance support (postinstallation)
It is a well-known fact in computer security that security problems are very often a direct result of software bugs. That leads security researches to pay lots of attention to software engineering. The
DIVISION OF INFORMATION SECURITY (DIS) Information Security Policy Human Resource (HR) and Security Awareness v1.0 September 25, 2013
DIVISION OF INFORMATION SECURITY (DIS) Information Security Policy Human Resource (HR) and Security Awareness v1.0 September 25, 2013 Revision History Update this table every time a new edition of the
Network Assessment. Prepared For: Prospect Or Customer Prepared By: Your Company Name
Network Assessment Prepared For: Prospect Or Customer Prepared By: Your Company Name Environment Risk and Issue Score Issue Review Next Steps Agenda Environment - Overview Domain Domain Controllers 4 Number
FedRAMP Standard Contract Language
FedRAMP Standard Contract Language FedRAMP has developed a security contract clause template to assist federal agencies in procuring cloud-based services. This template should be reviewed by a Federal
EVALUATION REPORT. Weaknesses Identified During the FY 2014 Federal Information Security Management Act Review. March 13, 2015 REPORT NUMBER 15-07
EVALUATION REPORT Weaknesses Identified During the FY 2014 Federal Information Security Management Act Review March 13, 2015 REPORT NUMBER 15-07 EXECUTIVE SUMMARY Weaknesses Identified During the FY 2014
Information Security for Managers
Fiscal Year 2015 Information Security for Managers Introduction Information Security Overview Enterprise Performance Life Cycle Enterprise Performance Life Cycle and the Risk Management Framework Categorize
U.S. Department of Energy Office of Inspector General Office of Audits & Inspections
U.S. Department of Energy Office of Inspector General Office of Audits & Inspections Audit Report Management of Western Area Power Administration's Cyber Security Program DOE/IG-0873 October 2012 Department
Data Management Policies. Sage ERP Online
Sage ERP Online Sage ERP Online Table of Contents 1.0 Server Backup and Restore Policy... 3 1.1 Objectives... 3 1.2 Scope... 3 1.3 Responsibilities... 3 1.4 Policy... 4 1.5 Policy Violation... 5 1.6 Communication...
How To Manage A Vulnerability Management Program
VULNERABILITY MANAGEMENT A White Paper Presented by: MindPoint Group, LLC 8078 Edinburgh Drive Springfield, VA 22153 (o) 703.636.2033 (f) 866.761.7457 www.mindpointgroup.com blog.mindpointgroup.com SBA
U.S. ELECTION ASSISTANCE COMMISSION OFFICE OF INSPECTOR GENERAL
U.S. ELECTION ASSISTANCE COMMISSION OFFICE OF INSPECTOR GENERAL FINAL REPORT: U.S. Election Assistance Commission Compliance with the Requirements of the Federal Information Security Management Act Fiscal
NATIONAL CREDIT UNION ADMINISTRATION OFFICE OF INSPECTOR GENERAL
NATIONAL CREDIT UNION ADMINISTRATION OFFICE OF INSPECTOR GENERAL INDEPENDENT EVALUATION OF THE NATIONAL CREDIT UNION ADMINISTRATION S COMPLIANCE WITH THE FEDERAL INFORMATION SECURITY MANAGEMENT ACT (FISMA)
PHASE 5: DESIGN PHASE
PHASE 5: DESIGN PHASE During the Design Phase, the system is designed to satisfy the requirements identified in the previous phases. The requirements identified in the Requirements Analysis Phase are transformed
Patch Management. Module 13. 2012 VMware Inc. All rights reserved
Patch Management Module 13 You Are Here Course Introduction Introduction to Virtualization Creating Virtual Machines VMware vcenter Server Configuring and Managing Virtual Networks Configuring and Managing
Standard: Web Application Development
Information Security Standards Web Application Development Standard IS-WAD Effective Date TBD Email security@sjsu.edu # Version 2.0 Contact Mike Cook Phone 408-924-1705 Standard: Web Application Development
Independent Evaluation of NRC s Implementation of the Federal Information Security Modernization Act of 2014 for Fiscal Year 2015
Independent Evaluation of NRC s Implementation of the Federal Information Security Modernization Act of 2014 for Fiscal Year 2015 OIG-16-A-03 November 12, 2015 All publicly available OIG reports (including
Cybersecurity and internal audit. August 15, 2014
Cybersecurity and internal audit August 15, 2014 arket insights: what we are seeing so far? 60% of organizations see increased risk from using social networking, cloud computing and personal mobile devices
North Dakota 2013 IT Security Audit Vulnerability Assessment & Penetration Test Project Briefing
North Dakota 2013 IT Security Audit Vulnerability Assessment & Penetration Test Project Briefing Introduction ManTech Project Manager Mark Shaw, Senior Executive Director Cyber Security Solutions Division
Infrastructure Information Security Assurance (ISA) Process
Infrastructure Information Security Assurance (ISA) Process Handbook AS-805-B March 2005 Transmittal Letter A. Explanation. As part of the Postal Service s efforts to enhance security across all technology
Kenna Platform Security. A technical overview of the comprehensive security measures Kenna uses to protect your data
Kenna Platform Security A technical overview of the comprehensive security measures Kenna uses to protect your data V2.0, JULY 2015 Multiple Layers of Protection Overview Password Salted-Hash Thank you
PII Compliance Guidelines
Personally Identifiable Information (PII): Individually identifiable information from or about an individual customer including, but not limited to: (a) a first and last name or first initial and last
Information Security. Incident Management Program. What is an Incident Management Program? Why is it needed?
Information Security Incident Management Program What is an Incident Management Program? It is a coordinated program of people, processes, tools and technology, which prevents and manages information security
Audit of the Department of State Information Security Program
UNITED STATES DEPARTMENT OF STATE AND THE BROADCASTING BOARD OF GOVERNORS OFFICE OF INSPECTOR GENERAL AUD-IT-15-17 Office of Audits October 2014 Audit of the Department of State Information Security Program
Compliance Guide ISO 27002. Compliance Guide. September 2015. Contents. Introduction 1. Detailed Controls Mapping 2.
ISO 27002 Compliance Guide September 2015 Contents Compliance Guide 01 02 03 Introduction 1 Detailed Controls Mapping 2 About Rapid7 7 01 INTRODUCTION If you re looking for a comprehensive, global framework
Patch Management Procedure. Andrew Marriott andrew.marriott@fylde.gov.uk 01253 658578 PATCH MANAGEMENT PROCEDURE.DOCX Version: 1.1
Title: Patch Management Andrew Marriott andrew.marriott@fylde.gov.uk 01253 658578 PATCH MANAGEMENT PROCEDURE.DOCX Version: 1.1 Contents 1. Introduction... 4 2. Objectives... 4 3. Context... 4 4. Responsibility...
Integrated Governance, Risk and Compliance (igrc) Approach
U.S. Department of Homeland Security (DHS) United States Secret Service (USSS) Integrated Governance, Risk and Compliance (igrc) Approach Concept Paper* *connectedthinking Provided to: Provided by: Mrs.
External Penetration Assessment and Database Access Review
External Penetration Assessment and Database Access Review Performed by Protiviti, Inc. At the request of Internal Audit April 25, 2012 Note: This presentation is intended solely for the use of the management
FSIS DIRECTIVE 1306.3
UNITED STATES DEPARTMENT OF AGRICULTURE FOOD SAFETY AND INSPECTION SERVICE WASHINGTON, DC FSIS DIRECTIVE 1306.3 REVISION 1 12/13/12 CONFIGURATION MANAGEMENT (CM) OF SECURITY CONTROLS FOR INFORMATION SYSTEMS
Evaluation Report. Weaknesses Identified During the FY 2013 Federal Information Security Management Act Review. April 30, 2014 Report Number 14-12
Evaluation Report Weaknesses Identified During the FY 2013 Federal Information Security Management Act Review April 30, 2014 Report Number 14-12 U.S. Small Business Administration Office of Inspector General
Building a Security Program that Protects an Organizations Most Critical Assets
Building a Security Program that Protects an Organizations Most Critical Assets ABOUT BEW GLOBAL WHAT WE WILL COVER TODAY What is a Critical Asset Protection Program Data Loss Prevention & Other Technology
How To Implement An Enterprise Resource Planning Program
ERP Implementation Program Key phases of ERP implementation: Analysis of the company existing or designing new business process descriptions Inventory of the company s existing formal workflows or designing
Publication 805-A Revision: Certification and Accreditation
Postal Bulletin 22358 (3-7-13) Policies, Procedures, and Forms Updates Publication 805-A Revision: Certification and Accreditation Effective immediately, the January 2013 edition of Publication 805-A,
VISP Vendor Information Security Plan: A tool for IT and Institutions to evaluate third party vendor capacity and technology to protect research data
VISP Vendor Information Security Plan: A tool for IT and Institutions to evaluate third party vendor capacity and technology to protect research data 1 Table of Contents Executive Summary... 3 Template
Office of the Auditor General Performance Audit Report. Statewide Oracle Database Controls Department of Technology, Management, and Budget
Office of the Auditor General Performance Audit Report Statewide Oracle Database Controls Department of Technology, Management, and Budget March 2015 071-0565-14 State of Michigan Auditor General Doug
Continuous Monitoring in a Risk Management Framework. US Census Bureau Oct 2012
Monitoring in a Risk Management Framework US Census Bureau Oct 2012 Agenda Drivers for Monitoring What is Monitoring Monitoring in a Risk Management Framework (RMF) RMF Cost Efficiencies RMF Lessons Learned
Department of Veterans Affairs VA Directive 6004 CONFIGURATION, CHANGE, AND RELEASE MANAGEMENT PROGRAMS
Department of Veterans Affairs VA Directive 6004 Washington, DC 20420 Transmittal Sheet September 28, 2009 CONFIGURATION, CHANGE, AND RELEASE MANAGEMENT PROGRAMS 1. REASON FOR ISSUE: This Directive establishes
Development, Acquisition, Implementation, and Maintenance of Application Systems
Development, Acquisition, Implementation, and Maintenance of Application Systems Part of a series of notes to help Centers review their own Center internal management processes from the point of view of
Office of Inspector General
DEPARTMENT OF HOMELAND SECURITY Office of Inspector General Security Weaknesses Increase Risks to Critical United States Secret Service Database (Redacted) Notice: The Department of Homeland Security,
From Chaos to Clarity: Embedding Security into the SDLC
From Chaos to Clarity: Embedding Security into the SDLC Felicia Nicastro Security Testing Services Practice SQS USA Session Description This session will focus on the security testing requirements which
BSM for IT Governance, Risk and Compliance: NERC CIP
BSM for IT Governance, Risk and Compliance: NERC CIP Addressing NERC CIP Security Program Requirements SOLUTION WHITE PAPER Table of Contents INTRODUCTION...................................................
Information Security Risk Assessment Checklist. A High-Level Tool to Assist USG Institutions with Risk Analysis
Information Security Risk Assessment Checklist A High-Level Tool to Assist USG Institutions with Risk Analysis Updated Oct 2008 Introduction Information security is an important issue for the University
FISMA Compliance: Making the Grade
FISMA Compliance: Making the Grade A Qualys Guide to Measuring Risk, Enforcing Policies, and Complying with Regulations EXECUTIVE SUMMARY For federal managers of information technology, FISMA is one of
Submitted by: Christopher Mead, Director, Department of Information Technology
Office of the City Manager INFORMATION CALENDAR March 21, 2006 To: From: Honorable Mayor and Members of the City Council Phil Kamlarz, City Manager Submitted by: Christopher Mead, Director, Department
Vulnerability Audit: Why a Vulnerability Scan Isn t Enough. White Paper
Vulnerability Audit: Why a Vulnerability Scan Isn t Enough White Paper May 10, 2005 TABLE OF CONTENTS Introduction: How Secure Are My Systems?... 3 Vulnerability: The Modern Meaning Of A Muddled Word...
DESIGNATED CONTRACT MARKET OPERATIONAL CAPABILITY TECHNOLOGY QUESTIONNAIRE
DESIGNATED CONTRACT MARKET OPERATIONAL CAPABILITY TECHNOLOGY QUESTIONNAIRE Please provide all relevant documents responsive to the information requests listed within each area below. In addition to the
CTR System Report - 2008 FISMA
CTR System Report - 2008 FISMA February 27, 2009 TABLE of CONTENTS BACKGROUND AND OBJECTIVES... 5 BACKGROUND... 5 OBJECTIVES... 6 Classes and Families of Security Controls... 6 Control Classes... 7 Control
John Essner, CISO Office of Information Technology State of New Jersey
John Essner, CISO Office of Information Technology State of New Jersey http://csrc.nist.gov/publications/nistpubs/800-144/sp800-144.pdf Governance Compliance Trust Architecture Identity and Access Management
FINAL Version 1.0 June 25, 2014
CENTERS for MEDICARE & MEDICAID SERVICES Enterprise Information Security Group 7500 Security Boulevard Baltimore, Maryland 21244-1850 Risk Management Handbook Volume III Standard 7.2 FINAL Version 1.0
Information Security @ Blue Valley Schools FEBRUARY 2015
Information Security @ Blue Valley Schools FEBRUARY 2015 Student Data Privacy & Security Blue Valley is committed to providing an education beyond expectations to each of our students. To support that
Strategic Plan On-Demand Services April 2, 2015
Strategic Plan On-Demand Services April 2, 2015 1 GDCS eliminates the fears and delays that accompany trying to run an organization in an unsecured environment, and ensures that our customers focus on
CYBER AND IT SECURITY: CLOUD SECURITY FINAL SESSION. Architecture Framework Advisory Committee November 4, 2014
CYBER AND IT SECURITY: CLOUD SECURITY FINAL SESSION Architecture Framework Advisory Committee November 4, 2014 1 Agenda TIME TOPICS PRESENTERS 9:00 9:15 Opening Remarks and Introductions Shirley Ivan,
TREASURY INSPECTOR GENERAL FOR TAX ADMINISTRATION
TREASURY INSPECTOR GENERAL FOR TAX ADMINISTRATION The Internal Revenue Service Deployed Two of Its Most Important Modernized Systems September 24, 2008 Reference Number: 2008-20-163 This report has cleared
Critical Controls for Cyber Security. www.infogistic.com
Critical Controls for Cyber Security www.infogistic.com Understanding Risk Asset Threat Vulnerability Managing Risks Systematic Approach for Managing Risks Identify, characterize threats Assess the vulnerability
Information Security and Continuity Management Information Sharing Portal. Category: Risk Management Initiatives
Information Security and Continuity Management Information Sharing Portal Category: Risk Management Initiatives Contact: Chip Moore, CISO State of North Carolina Office of Information Technology Services
Stepping Through the Info Security Program. Jennifer Bayuk, CISA, CISM
Stepping Through the Info Security Program Jennifer Bayuk, CISA, CISM Infosec Program How to: compose an InfoSec Program cement a relationship between InfoSec program and IT Governance design roles and
Attachment A. Identification of Risks/Cybersecurity Governance
Attachment A Identification of Risks/Cybersecurity Governance 1. For each of the following practices employed by the Firm for management of information security assets, please provide the month and year
SMITHSONIAN INSTITUTION
SMITHSONIAN INSTITUTION FEDERAL INFORMATION SECURITY MANAGEMENT ACT (FISMA) 2012 INDEPENDENT EVALUATION REPORT TABLE OF CONTENTS PURPOSE 1 BACKGROUND 1 OBJECTIVES, SCOPE, AND METHODOLOGY 2 SUMMARY OF RESULTS
Security Testing and Vulnerability Management Process. e-governance
Security Testing and Vulnerability Management Process for e-governance Draft DEPARTMENT OF ELECTRONICS AND INFORMATION TECHNOLOGY Ministry of Communication and Information Technology, Government of India.
CITY UNIVERSITY OF HONG KONG. Information System Acquisition, PUBLIC Development and Maintenance Standard
CITY UNIVERSITY OF HONG KONG Development and Maintenance Standard (Approved by the Information Strategy and Governance Committee in December 2013; revision 1.1 approved by Chief Information Officer in
CMS Information Security Risk Assessment (RA) Methodology
DEPARTMENT OF HEALTH & HUMAN SERVICES Centers for Medicare & Medicaid Services 7500 Security Boulevard, Mail Stop N2-14-26 Baltimore, Maryland 21244-1850 CENTERS FOR MEDICARE & MEDICAID SERVICES (CMS)
THE BLUENOSE SECURITY FRAMEWORK
THE BLUENOSE SECURITY FRAMEWORK Bluenose Analytics, Inc. All rights reserved TABLE OF CONTENTS Bluenose Analytics, Inc. Security Whitepaper ISO 27001/27002 / 1 The Four Pillars of Our Security Program
Best Practices in ICS Security for System Operators. A Wurldtech White Paper
Best Practices in ICS Security for System Operators A Wurldtech White Paper No part of this document may be distributed, reproduced or posted without the express written permission of Wurldtech Security
Services Providers. Ivan Soto
SOP s for Managing Application Services Providers Ivan Soto Learning Objectives At the end of this session we will have covered: Types of Managed Services Outsourcing process Quality expectations for Managed
SECURITY CONTROLS AND RISK MANAGEMENT FRAMEWORK
SECURITY CONTROLS AND RISK MANAGEMENT FRAMEWORK BACKGROUND The National Institute of Standards and Technology (NIST) Special Publication 800-53 defines a comprehensive set of controls that is the basis
IT Risk & Security Specialist Position Description
Specialist Position Description February 9, 2015 Specialist Position Description February 9, 2015 Page i Table of Contents General Characteristics... 1 Career Path... 2 Explanation of Proficiency Level
Internal audit of cybersecurity. Presentation to the Atlanta IIA Chapter January 2015
Internal audit of cybersecurity Presentation to the Atlanta IIA Chapter January 2015 Agenda Executive summary Why is this topic important? Cyber attacks: increasing complexity arket insights: What are
The Value of Vulnerability Management*
The Value of Vulnerability Management* *ISACA/IIA Dallas Presented by: Robert Buchheit, Director Advisory Practice, Dallas Ricky Allen, Manager Advisory Practice, Houston *connectedthinking PwC Agenda
STATE OF ARIZONA Department of Revenue
STATE OF ARIZONA Department of Revenue Douglas A. Ducey Governor September 25, 2015 David Raber Director Debra K. Davenport, CPA Auditor General Office of the Auditor General 2910 North 44 th Street, Suite
Domain 1 The Process of Auditing Information Systems
Certified Information Systems Auditor (CISA ) Certification Course Description Our 5-day ISACA Certified Information Systems Auditor (CISA) training course equips information professionals with the knowledge
Security Language for IT Acquisition Efforts CIO-IT Security-09-48
Security Language for IT Acquisition Efforts CIO-IT Security-09-48 Office of the Senior Agency Information Security Officer VERSION HISTORY/CHANGE RECORD Change Number Person Posting Change Change Reason
FREQUENTLY ASKED QUESTIONS
FREQUENTLY ASKED QUESTIONS Continuous Monitoring 1. What is continuous monitoring? Continuous monitoring is one of six steps in the Risk Management Framework (RMF) described in NIST Special Publication
Information Technology General Controls And Best Practices
Paul M. Perry, FHFMA, CITP, CPA Alabama CyberNow Conference April 5, 2016 Information Technology General Controls And Best Practices 1. IT General Controls - Why? 2. IT General Control Objectives 3. Documentation
SIEM Implementation Approach Discussion. April 2012
SIEM Implementation Approach Discussion April 2012 Agenda What are we trying to solve? Summary Observations from the Security Assessments related to Logging & Monitoring Problem Statement Solution Conceptual
U.S. Department of Energy Office of Inspector General Office of Audits & Inspections. Evaluation Report
U.S. Department of Energy Office of Inspector General Office of Audits & Inspections Evaluation Report The Department's Unclassified Cyber Security Program - 2012 DOE/IG-0877 November 2012 MEMORANDUM FOR
University of Pittsburgh Security Assessment Questionnaire (v1.5)
Technology Help Desk 412 624-HELP [4357] technology.pitt.edu University of Pittsburgh Security Assessment Questionnaire (v1.5) Directions and Instructions for completing this assessment The answers provided
Click to edit Master title style. How To Choose The Right MSSP
How To Choose The Right MSSP Meet Eric Eric Devansky Director of Global Security Services 15 Years of experience in the Cyber Security industry CISSP Palo Alto CNSE VMWare VCP Connect with me: @TruShield
WHO WE ARE 3/31/2016. Philip Chukwuma, CTO, Securely Yours LLC Jayne Suess, Senior Security Analyst, Erie Insurance
3/31/2016 Philip Chukwuma, CTO, Securely Yours LLC Jayne Suess, Senior Security Analyst, Erie Insurance WHO WE ARE Philip Chukwuma CTO, Securely Yours, LLC philipchukwuma@securelyyoursllc.com Jayne Suess
Information Technology Strategic Plan 2013 9/23/2013
Information Technology Strategic Plan 2013 9/23/2013 Unit Mission Statement: Information Technology Shared Services is dedicated to providing unparalleled service and support to the UC Davis College of
SANS Top 20 Critical Controls for Effective Cyber Defense
WHITEPAPER SANS Top 20 Critical Controls for Cyber Defense SANS Top 20 Critical Controls for Effective Cyber Defense JANUARY 2014 SANS Top 20 Critical Controls for Effective Cyber Defense Summary In a
SACM Vulnerability Assessment Scenario IETF 94 11/05/2015
SACM Vulnerability Assessment Scenario IETF 94 11/05/2015 What is it? Walks through an automated enterprise vulnerability assessment scenario Begins with an enterprise ingesting a vulnerability report
Patch and Vulnerability Management Program
Patch and Vulnerability Management Program What is it? A security practice designed to proactively prevent the exploitation of IT vulnerabilities within an organization To reduce the time and money spent
NERC CIP VERSION 5 COMPLIANCE
BACKGROUND The North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) Reliability Standards define a comprehensive set of requirements that are the basis for maintaining
U.S. Office of Personnel Management. Actions to Strengthen Cybersecurity and Protect Critical IT Systems
U.S. Office of Personnel Management Actions to Strengthen Cybersecurity and Protect Critical IT Systems June 2015 1 I. Introduction The recent intrusions into U.S. Office of Personnel Management (OPM)
CISM ITEM DEVELOPMENT GUIDE
CISM ITEM DEVELOPMENT GUIDE TABLE OF CONTENTS CISM ITEM DEVELOPMENT GUIDE Content Page Purpose of the CISM Item Development Guide 2 CISM Exam Structure 2 Item Writing Campaigns 2 Why Participate as a CISM
Best Practices in ICS Security for Device Manufacturers. A Wurldtech White Paper
Best Practices in ICS Security for Device Manufacturers A Wurldtech White Paper No part of this document may be distributed, reproduced or posted without the express written permission of Wurldtech Security
CSUSB Web Application Security Standard CSUSB, Information Security & Emerging Technologies Office
CSUSB, Information Security & Emerging Technologies Office Last Revised: 03/17/2015 Draft REVISION CONTROL Document Title: Author: File Reference: CSUSB Web Application Security Standard Javier Torner
Information Protection Framework: Data Security Compliance and Today s Healthcare Industry
Information Protection Framework: Data Security Compliance and Today s Healthcare Industry Executive Summary Today s Healthcare industry is facing complex privacy and data security requirements. The movement