Managing Network-related Risk for SMEs
|
|
|
- Jessica Campbell
- 10 years ago
- Views:
Transcription
1 Managing Network-related Risk for SMEs SANS Information Security Webcast 20 Mar 2012 Geneva, Switzerland version 1b Jim Herbeck Managing Partner, Nouvel Strategies Member of Faculty, SANS Institute SANS Webcast archive: Slide handout (English): Slide handout (French): 1 Welcome to the webcast! Java-based Elluminate platform - audio, whiteboard, interaction Interaction - polling: answer questions - emoticons: provide feedback - chat: ask questions After the webcast - replay webcast archive - download handout 2
2 Agenda Initial words Defining network-related risk Likelihood and severity for SMEs Controlling network-related risk for SMEs Final words 3 Managing risk vs. controlling risk Managing risk is jargon used by managers. Controlling risk is jargon used by auditors and finance people. Both mean essentially the same thing, however controlling risk has some semantic advantages: - defining control objectives to control risk. - defining controls to meet control objectives. 4
3 Review from previous webcast: Security controls, organized by category Function Administrative Technical Physical Description Decisions by management, personnel, legal, or purchasing. Also includes developing policies, standards, policies, or processes. Activities involving computer hardware, software, applications, or network infrastructure. Badges, gates, locks, alarms, or guards. 5 Review from previous webcast: Security controls, organized by action Action Preventative Deterrent Detective Corrective Recovery Description To stop the occurrence of undesirable events. To discourage the occurrence of undesirable events. To notice the occurrence of undesirable events. To respond to the occurrence of undesirable events, to prevent damage. To restore after damage caused by the occurrence of undesirable events. 6
4 Review from previous webcast: Security control matrix Administrative Technical Physical Preventative Deterrent Detective Corrective Recovery 7 Agenda Initial words Defining network-related risk Likelihood and severity for SMEs Controlling network-related risk for SMEs Final words 8
5 Where can you find a pragmatic, business-oriented, standards-based list of network-related risk? CPI-RISC* Information Risk Framework originally released in 2010 defines 33 risk areas, organized into 7 business functions: - management - personnel - legal - facilities - finance - IT - purchasing based on ISO 27001, ISO 27002, and SANS 20 Critical Security Controls (v3.0) * CPI-RISC: Continuous Process Improvement Risk, Information Security, and Compliance 9 CPI-RISC* Information Risk Framework: ITS4 summarizes network-related risk Based on ISO 27001, ISO 27002, and SANS 20 Critical Security Controls (v3.0) A (ISO 27001) or (ISO 27002) A (ISO 27001) or (ISO 27002) A (ISO 27001) or (ISO 27002) A (ISO 27001) or (ISO 27002) A (ISO 27001) or (ISO 27002) A (ISO 27001) or (ISO 27002) SANS CC4 SANS CC5 SANS CC13 SANS CC14 SANS CC16 * CPI-RISC: Continuous Process Improvement Risk, Information Security, and Compliance 10
6 Summarized for civilians: Network-related risk As a result of inadequate network security or network flaws: - the risk of the loss of confidentiality or integrity of information resources - the risk of the inability to use network or network services 11 Controls for reducing network-related risk implementing a securely designed network implementing a securely designed wireless network implementing a securely designed network perimeter using secure network device configurations preventing unauthorized access to network services 12
7 What criteria are used to categorize network-related risks? Attack vector: - risks associated with network-based attacks Responsible person/third party: - risks managed by network manager/network service provider Control type: - risks managed with network equipment (routers, access points, firewalls, IDSs, IPSs, etc.) Doesn t include: - malicious software risk (controlled by system admins) - phishing risk (controlled by finance processes) 13 Agenda Initial words Defining network-related risk Likelihood and severity for SMEs Controlling network-related risk for SMEs Final words 14
8 Why do we care about likelihood and severity? Likelihood of Occurrence High Medium Low Areas of Concern Low Medium High Severity of Impact / Consequences 15 istockphoto/luis Pedrosa What s the most serious network-related risk? unauthorized, remote access of information resources via the network - could compromise confidentiality - could compromise integrity - could compromise availability What s worse? undetected, unauthorized, remote access of information resources via the network - advanced persistent threat (APT) nightmare scenario 16
9 Realistically, what s the impact for an SME? direct loss: financial - ebanking username/password could be stolen. - Fraudulent invoices could be created and paid. indirect loss: embarrassment, loss of reputation, loss of customers, loss of income, legal penalties, SLA / contractual problems - Customer information could be stolen. - Network services could be modified (website defaced). - Network services could be interrupted (server crash). 17 Agenda Initial words Defining network-related risk Likelihood and severity for SMEs Controlling network-related risk for SMEs Final words 18
10 What are the steps for controlling any risk? 1. Identify the risk. 2. Determine the risk management decision and define the control objectives. 3. Select controls to be used for achieving control objectives. - Choose a variety of control types. 4. Develop the plan for implementing controls. - Implementation plan may span multiple years. 19 Steps 1, 2, and 3: Controlling network-related risk 1. Identify risk - risk: attack via the network 2. Define decision / control objective - decision: to prevent attacks - control objective: to reduce the likelihood and severity of attack via the network 3. Select controls - implement a network policy - implement a securely designed network - implement a securely designed wireless network - implement a securely designed network perimeter - use secure network device configurations - prevent unauthorized access to network services 20
11 Implementing a Network Policy* [administrative/preventive control] To reduce the likelihood and severity of attack via the network: - A securely designed network shall be implemented. - A securely designed wireless network shall be implemented. - A securely designed network perimeter shall be implemented. - Secure network device configurations shall be used. - Access controls shall be used to prevent unauthorized access to network services. * Network Policy: network-related portion of the information security policy 21 Implementing a securely designed network and a securely designed wireless network [technical/preventive control] A network manager or network service provider should design and implement the organization s internal network: - determine security requirements for all network services - specify the appropriate use of: - encryption (router/switch/vpn concentrator) - network segmentation (router/switch) - network access control devices (firewall) The secure network plan and requirements should be documented. 22
12 Implementing a secure network perimeter [technical/preventive, technical/detective, technical/corrective control] A network manager or network service provider should design and implement the organization s connection to any external networks and the Internet: - determine security requirements for all network services - specify the appropriate use of: - encryption (router/switch/vpn concentrator) - network segmentation (router/switch) - network access control devices (firewall) - network proxy (router/switch/firewall) - network attack detection devices (IDS) - network attack response devices (IPS) The secure network plan and requirements should be documented. 23 Using secure network device configurations [technical/preventive, technical/detective, technical/corrective control] Ensure network device configurations correctly implement the security requirements. Ensure network devices themselves are resistant to attack. Good resource for SMEs: the Center for Internet Security benchmarks. 24
13 Preventing unauthorized access to network services (inbound/ingress filtering) [technical/preventive, technical/detective control] Control inbound access to network services based on business requirements: - old way: black list (list of forbidden access/sites) - new way: white list (list of allowed access/sites) Monitor access logs to detect unauthorized access. 25 Preventing unauthorized access to network services (outbound/egress filtering) [technical/preventive, technical/detective control] Control outbound access to network services based on business requirements: - old way (black list) vs. new way (white list) Monitor access logs to detect unauthorized access. Good resource for SMEs: OpenDNS - controls external access by filtering DNS resolution - free entry level service 26
![25 Preventing unauthorized access to network services (outbound/egress filtering) [technical/preventive, technical/detective control] Control outbound access to network services based on business](/docs-images/45/10120597/images/page_13.jpg "requirements: - old way (black list) vs. new way (white list) Monitor access logs to detect unauthorized access.")
14 Summarized for civilians: Controlling network-related risk 1. Write a network policy. 2. Proactively plan, implement, and manage secure network: - Define role for network management (internal/external). - Define and document security requirements for network and all network services. - Implement secure network (wired/wireless) according to requirements: - Include segregation, DMZ, proxies, firewalls, IDSs, or IPSs as required. 3. Implement network access control: - Write network access standard (network access policy) to define network access required by business applications and business processes. - Implement network access control on firewall and network devices according to network access standard. - Perform ingress and egress filtering. - Block access to ports/services/websites that don t have a documented business purpose. 27 Reviewing the control matrix: Has anything been missed? Administrative Technical Physical Preventative Deterrent Detective Corrective Recovery N/A [Access warnings] N/A [Incident plan] N/A [DRP plan] N/A [Backup plan] [Backup system] N/A 28
15 Step 4: Developing multi-year implementation plan Determine how many years your implementation plan will span. Based on constraints, plan what to implement each year: - implement preventive controls first Don t forget verifying control effectiveness: - network scanning and vulnerability assessment tools can verify if network access controls are working - the Center for Internet Security has benchmark scoring tools that can verify secure configurations 29 Agenda Initial words Defining network-related risk Likelihood and severity for SMEs Controlling network-related risk for SMEs Final words 30
16 Network-related risk is evolving. Is your information security program evolving? Cloud computing Social networking Instant messaging Data leakage / data loss prevention 31 Upcoming Webcasts for SMEs Apr, 2012 Managing Legal, Regulatory, and Compliance Risk for SMEs May, 2012 Managing System-related Risk for SMEs Jun, 2012 Managing Third Party Risk for SMEs 32
17 Managing Networkrelated risk for SMEs SANS Information Security Webcast 20 Mar 2012 Geneva, Switzerland version 1b Jim Herbeck Managing Partner, Nouvel Strategies Member of Faculty, SANS Institute SANS Webcast archive: Slide handout (English): Slide handout (French): 33
FRAMEWORK. Continuous Process Improvement Risk, Information Security, and Compliance
FRMEWORK Continuous Process Improvement Risk, Information Security, and Compliance The pragmatic, business-oriented, standardsbased methodology for managing information. CPI-RISC Information Risk Framework
Computer Security CS 426 Lecture 36. CS426 Fall 2010/Lecture 36 1
Computer Security CS 426 Lecture 36 Perimeter Defense and Firewalls CS426 Fall 2010/Lecture 36 1 Announcements There will be a quiz on Wed There will be a guest lecture on Friday, by Prof. Chris Clifton
Architecture. The DMZ is a portion of a network that separates a purely internal network from an external network.
Architecture The policy discussed suggests that the network be partitioned into several parts with guards between the various parts to prevent information from leaking from one part to another. One part
Network and Security Controls
Network and Security Controls State Of Arizona Office Of The Auditor General Phil Hanus IT Controls Webinar Series Part I Overview of IT Controls and Best Practices Part II Identifying Users and Limiting
74% 96 Action Items. Compliance
Compliance Report PCI DSS 2.0 Generated by Check Point Compliance Blade, on July 02, 2013 11:12 AM 1 74% Compliance 96 Action Items Upcoming 0 items About PCI DSS 2.0 PCI-DSS is a legal obligation mandated
Network Security: 30 Questions Every Manager Should Ask. Author: Dr. Eric Cole Chief Security Strategist Secure Anchor Consulting
Network Security: 30 Questions Every Manager Should Ask Author: Dr. Eric Cole Chief Security Strategist Secure Anchor Consulting Network Security: 30 Questions Every Manager/Executive Must Answer in Order
FIREWALL CHECKLIST. Pre Audit Checklist. 2. Obtain the Internet Policy, Standards, and Procedures relevant to the firewall review.
1. Obtain previous workpapers/audit reports. FIREWALL CHECKLIST Pre Audit Checklist 2. Obtain the Internet Policy, Standards, and Procedures relevant to the firewall review. 3. Obtain current network diagrams
2 0 1 4 F G F O A A N N U A L C O N F E R E N C E
I T G OV E R NANCE 2 0 1 4 F G F O A A N N U A L C O N F E R E N C E RAJ PATEL Plante Moran 248.223.3428 [email protected] This presentation will discuss current threats faced by public institutions,
March 2012 www.tufin.com
SecureTrack Supporting Compliance with PCI DSS 2.0 March 2012 www.tufin.com Table of Contents Introduction... 3 The Importance of Network Security Operations... 3 Supporting PCI DSS with Automated Solutions...
Larry Wilson Version 1.0 November, 2013. University Cyber-security Program Critical Asset Mapping
Larry Wilson Version 1.0 November, 2013 University Cyber-security Program Critical Asset Mapping Part 3 - Cyber-Security Controls Mapping Cyber-security Controls mapped to Critical Asset Groups CSC Control
External Supplier Control Requirements
External Supplier Control s Cyber Security For Suppliers Categorised as Low Cyber Risk 1. Asset Protection and System Configuration Barclays Data and the assets or systems storing or processing it must
SPEAR PHISHING UNDERSTANDING THE THREAT
SPEAR PHISHING UNDERSTANDING THE THREAT SEPTEMBER 2013 Due to an organisation s reliance on email and internet connectivity, there is no guaranteed way to stop a determined intruder from accessing a business
Consensus Policy Resource Community. Lab Security Policy
Lab Security Policy Free Use Disclaimer: This policy was created by or for the SANS Institute for the Internet community. All or parts of this policy can be freely used for your organization. There is
Host Hardening. Presented by. Douglas Couch & Nathan Heck Security Analysts for ITaP 1
Host Hardening Presented by Douglas Couch & Nathan Heck Security Analysts for ITaP 1 Background National Institute of Standards and Technology Draft Guide to General Server Security SP800-123 Server A
NETWORK ACCESS CONTROL AND CLOUD SECURITY. Tran Song Dat Phuc SeoulTech 2015
NETWORK ACCESS CONTROL AND CLOUD SECURITY Tran Song Dat Phuc SeoulTech 2015 Table of Contents Network Access Control (NAC) Network Access Enforcement Methods Extensible Authentication Protocol IEEE 802.1X
Information Security Services
Information Security Services Information Security In 2013, Symantec reported a 62% increase in data breaches over 2012. These data breaches had tremendous impacts on many companies, resulting in intellectual
Industrial Network Security for SCADA, Automation, Process Control and PLC Systems. Contents. 1 An Introduction to Industrial Network Security 1
Industrial Network Security for SCADA, Automation, Process Control and PLC Systems Contents 1 An Introduction to Industrial Network Security 1 1.1 Course overview 1 1.2 The evolution of networking 1 1.3
Project Title slide Project: PCI. Are You At Risk?
Blank slide Project Title slide Project: PCI Are You At Risk? Agenda Are You At Risk? Video What is the PCI SSC? Agenda What are the requirements of the PCI DSS? What Steps Can You Take? Available Services
Information Security Risk Assessment Checklist. A High-Level Tool to Assist USG Institutions with Risk Analysis
Information Security Risk Assessment Checklist A High-Level Tool to Assist USG Institutions with Risk Analysis Updated Oct 2008 Introduction Information security is an important issue for the University
HIPAA Compliance Evaluation Report
Jun29,2016 HIPAA Compliance Evaluation Report Custom HIPAA Risk Evaluation provided for: OF Date of Report 10/13/2014 Findings Each section of the pie chart represents the HIPAA compliance risk determinations
REGULATIONS FOR THE SECURITY OF INTERNET BANKING
REGULATIONS FOR THE SECURITY OF INTERNET BANKING PAYMENT SYSTEMS DEPARTMENT STATE BANK OF PAKISTAN Table of Contents PREFACE... 3 DEFINITIONS... 4 1. SCOPE OF THE REGULATIONS... 6 2. INTERNET BANKING SECURITY
SFWR ENG 4C03 Class Project Firewall Design Principals Arash Kamyab 9940313 March 04, 2004
SFWR ENG 4C03 Class Project Firewall Design Principals Arash Kamyab 9940313 March 04, 2004 Introduction: A computer firewall protects computer networks from unwanted intrusions which could compromise confidentiality
Joint Universities Computer Centre Limited ( JUCC ) Information Security Awareness Training- Session Two Information Security in Universities
Joint Universities Computer Centre Limited ( JUCC ) Information Security Awareness Training- Session Two Information Security in Universities Agenda Information Security Management in Universities Recent
Managing internet security
Managing internet security GOOD PRACTICE GUIDE Contents About internet security 2 What are the key components of an internet system? 3 Assessing internet security 4 Internet security check list 5 Further
Firewalls. Test your Firewall knowledge. Test your Firewall knowledge (cont) (March 4, 2015)
s (March 4, 2015) Abdou Illia Spring 2015 Test your knowledge Which of the following is true about firewalls? a) A firewall is a hardware device b) A firewall is a software program c) s could be hardware
How To Manage Security On A Networked Computer System
Unified Security Reduce the Cost of Compliance Introduction In an effort to achieve a consistent and reliable security program, many organizations have adopted the standard as a key compliance strategy
Today s Topics. Protect - Detect - Respond A Security-First Strategy. HCCA Compliance Institute April 27, 2009. Concepts.
Protect - Detect - Respond A Security-First Strategy HCCA Compliance Institute April 27, 2009 1 Today s Topics Concepts Case Study Sound Security Strategy 2 1 Security = Culture!! Security is a BUSINESS
Verve Security Center
Verve Security Center Product Features Supports multiple control systems. Most competing products only support a single vendor, forcing the end user to purchase multiple security systems Single solution
IT Best Practices Audit TCS offers a wide range of IT Best Practices Audit content covering 15 subjects and over 2200 topics, including:
IT Best Practices Audit TCS offers a wide range of IT Best Practices Audit content covering 15 subjects and over 2200 topics, including: 1. IT Cost Containment 84 topics 2. Cloud Computing Readiness 225
A Decision Maker s Guide to Securing an IT Infrastructure
A Decision Maker s Guide to Securing an IT Infrastructure A Rackspace White Paper Spring 2010 Summary With so many malicious attacks taking place now, securing an IT infrastructure is vital. The purpose
Lot 1 Service Specification MANAGED SECURITY SERVICES
Lot 1 Service Specification MANAGED SECURITY SERVICES Fujitsu Services Limited, 2013 OVERVIEW OF FUJITSU MANAGED SECURITY SERVICES Fujitsu delivers a comprehensive range of information security services
Emerging Network Security Threats and what they mean for internal auditors. December 11, 2013 John Gagne, CISSP, CISA
Emerging Network Security Threats and what they mean for internal auditors December 11, 2013 John Gagne, CISSP, CISA 0 Objectives Emerging Risks Distributed Denial of Service (DDoS) Attacks Social Engineering
Stable and Secure Network Infrastructure Benchmarks
Last updated: March 4, 2014 Stable and Secure Network Infrastructure Benchmarks 501 Commons has developed a list of key benchmarks for maintaining a stable and secure IT Infrastructure for conducting day-to-day
CS 356 Lecture 17 and 18 Intrusion Detection. Spring 2013
CS 356 Lecture 17 and 18 Intrusion Detection Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control Lists
Information Technology Career Cluster Introduction to Cybersecurity Course Number: 11.48100
Information Technology Career Cluster Introduction to Cybersecurity Course Number: 11.48100 Course Description: Introduction to Cybersecurity is designed to provide students the basic concepts and terminology
Why Leaks Matter. Leak Detection and Mitigation as a Critical Element of Network Assurance. A publication of Lumeta Corporation www.lumeta.
Why Leaks Matter Leak Detection and Mitigation as a Critical Element of Network Assurance A publication of Lumeta Corporation www.lumeta.com Table of Contents Executive Summary Defining a Leak How Leaks
Cyber Security for Start-ups: An Affordable 10-Step Plan
SESSION ID: ECO-W03 Cyber Security for Start-ups: An Affordable 10-Step Plan David Cowan Partner Bessemer Venture Partners @davidcowan Acknowledgements Startups don't like friction to get their job done.
Agenda. Understanding of Firewall s definition and Categorization. Understanding of Firewall s Deployment Architectures
Firewall Agenda Unit 1 Understanding of Firewall s definition and Categorization Unit 2 Understanding of Firewall s Deployment Architectures Unit 3 Three Representative Firewall Deployment Examples in
Hands on, field experiences with BYOD. BYOD Seminar
Hands on, field experiences with BYOD. BYOD Seminar Brussel, 25 september 2012 Agenda Challenges RIsks Strategy Before We Begin Thom Schiltmans Deloitte Risk Services Security & Privacy Amstelveen [email protected]
Payment Card Industry Self-Assessment Questionnaire
How to Complete the Questionnaire The questionnaire is divided into six sections. Each section focuses on a specific area of security, based on the requirements included in the PCI Data Security Standard.
Joint Universities Computer Centre Limited ( JUCC ) Information Security Awareness Training- Session Two
Joint Universities Computer Centre Limited ( JUCC ) Information Security Awareness Training- Session Two Data Handling in University Case Study- Information Security in University Agenda Case Study Background
Don t skip these expert tips for making your firewall airtight, bulletproof and fail-safe. 10 Tips to Make Sure Your Firewall is Really Secure
Don t skip these expert tips for making your firewall airtight, bulletproof and fail-safe. 10 Tips to Make Sure Your Firewall is Really Secure Security studies back up this fact: It takes less than 20
Guidelines for Website Security and Security Counter Measures for e-e Governance Project
and Security Counter Measures for e-e Governance Project Mr. Lalthlamuana PIO, DoICT Background (1/8) Nature of Cyber Space Proliferation of Information Technology Rapid Growth in Internet Increasing Online
Specific observations and recommendations that were discussed with campus management are presented in detail below.
CSU The California State University Office of Audit and Advisory Services INFORMATION SECURITY California State University, San Bernardino Audit Report 14-55 March 18, 2015 EXECUTIVE SUMMARY OBJECTIVE
Achieving PCI-Compliance through Cyberoam
White paper Achieving PCI-Compliance through Cyberoam The Payment Card Industry (PCI) Data Security Standard (DSS) aims to assure cardholders that their card details are safe and secure when their debit
CompTIA Security+ (Exam SY0-410)
CompTIA Security+ (Exam SY0-410) Length: Location: Language(s): Audience(s): Level: Vendor: Type: Delivery Method: 5 Days 182, Broadway, Newmarket, Auckland English, Entry Level IT Professionals Intermediate
THE BLUENOSE SECURITY FRAMEWORK
THE BLUENOSE SECURITY FRAMEWORK Bluenose Analytics, Inc. All rights reserved TABLE OF CONTENTS Bluenose Analytics, Inc. Security Whitepaper ISO 27001/27002 / 1 The Four Pillars of Our Security Program
PCI COMPLIANCE REQUIREMENTS COMPLIANCE CALENDAR
PCI COMPLIANCE REQUIREMENTS COMPLIANCE CALENDAR AUTHOR: UDIT PATHAK SENIOR SECURITY ANALYST [email protected] Public Network Intelligence India 1 Contents 1. Background... 3 2. PCI Compliance
Critical Controls for Cyber Security. www.infogistic.com
Critical Controls for Cyber Security www.infogistic.com Understanding Risk Asset Threat Vulnerability Managing Risks Systematic Approach for Managing Risks Identify, characterize threats Assess the vulnerability
Supplier Security Assessment Questionnaire
HALKYN CONSULTING LTD Supplier Security Assessment Questionnaire Security Self-Assessment and Reporting This questionnaire is provided to assist organisations in conducting supplier security assessments.
1B1 SECURITY RESPONSIBILITY
(ITSP-1) SECURITY MANAGEMENT 1A. Policy Statement District management and IT staff will plan, deploy and monitor IT security mechanisms, policies, procedures, and technologies necessary to prevent disclosure,
SECURITY CONSIDERATIONS FOR LAW FIRMS
SECURITY CONSIDERATIONS FOR LAW FIRMS Enterprise Risk Management Professional consulting firm that specializes in cyber security Founded in 1998 in Miami, Florida Serves more than 150 clients, locally,
Chapter 12. Security Policy Life Cycle. Network Security 8/19/2010. Network Security
Chapter 12 Network Security Security Policy Life Cycle A method for the development of a comprehensive network security policy is known as the security policy development life cycle (SPDLC). Network Security
Threat Management: Incident Handling. Incident Response Plan
In order to meet the requirements of VCCS Security Standards 13.1 Reporting Information Security Events, and 13.2 Management of Information Security Incidents, SVCC drafted an (IRP). Incident handling
Splunk Enterprise Log Management Role Supporting the ISO 27002 Framework EXECUTIVE BRIEF
Splunk Enterprise Log Management Role Supporting the ISO 27002 Framework EXECUTIVE BRIEF Businesses around the world have adopted the information security standard ISO 27002 as part of their overall risk
Course: Information Security Management in e-governance. Day 1. Session 5: Securing Data and Operating systems
Course: Information Security Management in e-governance Day 1 Session 5: Securing Data and Operating systems Agenda Introduction to information, data and database systems Information security risks surrounding
State of New Mexico Statewide Architectural Configuration Requirements. Title: Network Security Standard S-STD005.001. Effective Date: April 7, 2005
State of New Mexico Statewide Architectural Configuration Requirements Title: Network Security Standard S-STD005.001 Effective Date: April 7, 2005 1. Authority The Department of Information Technology
Residual risk. 3 Compliance challenges (i.e. right to examine, exit clause, privacy acy etc.)
Organizational risks 1 Lock-in Risk of not being able to migrate easily from one provider to another 2 Loss of Governance Control and influence on the cloud providers, and conflicts between customer hardening
External Supplier Control Requirements
External Supplier Control Requirements Cyber Security For Suppliers Categorised as High Cyber Risk Cyber Security Requirement Description Why this is important 1. Asset Protection and System Configuration
PCI Assessments 3.0 What Will the Future Bring? Matt Halbleib, SecurityMetrics
PCI Assessments 3.0 What Will the Future Bring? Matt Halbleib, SecurityMetrics About Us Matt Halbleib CISSP, QSA, PA-QSA Manager PCI-DSS assessments With SecurityMetrics for 6+ years SecurityMetrics Security
Fear Not What Security Can Do to Your Firm; Instead, Imagine What Your Firm Can Do When Secured!
Fear Not What Security Can Do to Your Firm; Instead, Imagine What Your Firm Can Do When Secured! Presented by: Kristen Zarcadoolas, Jim Soenksen, and Ed Sale PART 2: plan, act, repeat (from the look, plan,
REDSEAL NETWORKS SOLUTION BRIEF. Proactive Network Intelligence Solutions For PCI DSS Compliance
REDSEAL NETWORKS SOLUTION BRIEF Proactive Network Intelligence Solutions For PCI DSS Compliance Overview PCI DSS has become a global requirement for all entities handling cardholder data. A company processing,
OLD DOMINION UNIVERSITY 4.3.4.2 - Router-Switch Best Practices. (last updated : 20080305 )
OLD DOMINION UNIVERSITY 4.3.4.2 - Router-Switch Best Practices (last updated: 20080303) Introduction One of the information techlogy priorities for Old Dominion University (ODU) is to provide and maintain
MONITORING AND VULNERABILITY MANAGEMENT PCI COMPLIANCE JUNE 2014
MONITORING AND VULNERABILITY MANAGEMENT PCI COMPLIANCE JUNE 2014 COMPLIANCE SCHEDULE REQUIREMENT PERIOD DESCRIPTION REQUIREMENT PERIOD DESCRIPTION 8.5.6 As Needed 11.1 Monthly 1.3 Quarterly 1.1.6 Semi-Annually
Network Segmentation
Network Segmentation The clues to switch a PCI DSS compliance s nightmare into an easy path Although best security practices should be implemented in all systems of an organization, whether critical or
Internet threats: steps to security for your small business
Internet threats: 7 steps to security for your small business Proactive solutions for small businesses A restaurant offers free WiFi to its patrons. The controller of an accounting firm receives a confidential
Rajan R. Pant Controller Office of Controller of Certification Ministry of Science & Technology [email protected]
Rajan R. Pant Controller Office of Controller of Certification Ministry of Science & Technology [email protected] Meaning Why is Security Audit Important Framework Audit Process Auditing Application Security
Security Awareness For Server Administrators. State of Illinois Central Management Services Security and Compliance Solutions
Security Awareness For Server Administrators State of Illinois Central Management Services Security and Compliance Solutions Purpose and Scope To present a best practice approach to securing your servers
LAMAR STATE COLLEGE - ORANGE INFORMATION RESOURCES SECURITY MANUAL. for INFORMATION RESOURCES
LAMAR STATE COLLEGE - ORANGE INFORMATION RESOURCES SECURITY MANUAL for INFORMATION RESOURCES Updated: June 2007 Information Resources Security Manual 1. Purpose of Security Manual 2. Audience 3. Acceptable
Music Recording Studio Security Program Security Assessment Version 1.1
Music Recording Studio Security Program Security Assessment Version 1.1 DOCUMENTATION, RISK MANAGEMENT AND COMPLIANCE PERSONNEL AND RESOURCES ASSET MANAGEMENT PHYSICAL SECURITY IT SECURITY TRAINING AND
INFORMATION SECURITY California Maritime Academy
CSU The California State University Office of Audit and Advisory Services INFORMATION SECURITY California Maritime Academy Audit Report 14-54 April 8, 2015 Senior Director: Mike Caldera IT Audit Manager:
Practice Good Enterprise Security Management. Presented by Laurence CHAN, MTR Corporation Limited
Practice Good Enterprise Security Management Presented by Laurence CHAN, MTR Corporation Limited About Me Manager Information Security o o o o Policy formulation and governance Incident response Incident
Network/Cyber Security
Network/Cyber Security SCAMPS Annual Meeting 2015 Joe Howland,VC3 Source: http://www.information-age.com/technology/security/123458891/how-7-year-old-girl-hacked-public-wi-fi-network-10-minutes Security
HIGH-RISK SECURITY VULNERABILITIES IDENTIFIED DURING REVIEWS OF INFORMATION TECHNOLOGY GENERAL CONTROLS
Department of Health and Human Services OFFICE OF INSPECTOR GENERAL HIGH-RISK SECURITY VULNERABILITIES IDENTIFIED DURING REVIEWS OF INFORMATION TECHNOLOGY GENERAL CONTROLS AT STATE MEDICAID AGENCIES Inquiries
Unified Security Anywhere HIPAA COMPLIANCE ACHIEVING HIPAA COMPLIANCE WITH MASERGY PROFESSIONAL SERVICES
Unified Security Anywhere HIPAA COMPLIANCE ACHIEVING HIPAA COMPLIANCE WITH MASERGY PROFESSIONAL SERVICES HIPAA COMPLIANCE Achieving HIPAA Compliance with Security Professional Services The Health Insurance
Security Management. Keeping the IT Security Administrator Busy
Security Management Keeping the IT Security Administrator Busy Dr. Jane LeClair Chief Operating Officer National Cybersecurity Institute, Excelsior College James L. Antonakos SUNY Distinguished Teaching
Data Center security trends
Data Center security trends Tomislav Tucibat Major accounts Manager, Adriatic Copyright Fortinet Inc. All rights reserved. IT Security evolution How did threat market change over the recent years? Problem:
Risk Assessment Guide
KirkpatrickPrice Assessment Guide Designed Exclusively for PRISM International Members KirkpatrickPrice. innovation. integrity. delivered. KirkpatrickPrice Assessment Guide 2 Document Purpose The Assessment
Office 365 Cloud App Security MARKO DJORDJEVIC CLOUD BUSINESS LEAD EE TREND MICRO EMEA LTD.
Office 365 Cloud App Security MARKO DJORDJEVIC CLOUD BUSINESS LEAD EE TREND MICRO EMEA LTD. Your Valuable Data In The Cloud? How To Get The Best Protection! A world safe for exchanging digital information
Incident Response. Proactive Incident Management. Sean Curran Director
Incident Response Proactive Incident Management Sean Curran Director Agenda Incident Response Overview 3 Drivers for Incident Response 5 Incident Response Approach 11 Proactive Incident Response 17 2 2013
IT Security Standard: Network Device Configuration and Management
IT Security Standard: Network Device Configuration and Management Introduction This standard defines the steps needed to implement Bellevue College policy # 5250: Information Technology (IT) Security regarding
JK0 015 CompTIA E2C Security+ (2008 Edition) Exam
JK0 015 CompTIA E2C Security+ (2008 Edition) Exam Version 4.1 QUESTION NO: 1 Which of the following devices would be used to gain access to a secure network without affecting network connectivity? A. Router
FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. Chapter 5 Firewall Planning and Design
FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. Chapter 5 Firewall Planning and Design Learning Objectives Identify common misconceptions about firewalls Explain why a firewall
Networking for Caribbean Development
Networking for Caribbean Development BELIZE NOV 2 NOV 6, 2015 w w w. c a r i b n o g. o r g N E T W O R K I N G F O R C A R I B B E A N D E V E L O P M E N T BELIZE NOV 2 NOV 6, 2015 w w w. c a r i b n
The President s Critical Infrastructure Protection Board. Office of Energy Assurance U.S. Department of Energy 202/ 287-1808
cover_comp_01 9/9/02 5:01 PM Page 1 For further information, please contact: The President s Critical Infrastructure Protection Board Office of Energy Assurance U.S. Department of Energy 202/ 287-1808
Presented by: Mike Morris and Jim Rumph
Presented by: Mike Morris and Jim Rumph Introduction MICHAEL MORRIS, CISA Systems Partner JIM RUMPH, CISA Systems Manager Objectives To understand how layered security assists in securing your network
N-Dimension Solutions Cyber Security for Utilities
AGENDA ITEM NO.: 3.A. MEETING DATE; 08/18/2014 N-Dimension Solutions Cyber Security for Utilities Cyber Security Protection for Critical Infrastructure Assets The cyber threat is escalating - Confidential
Network Detective. HIPAA Compliance Module. 2015 RapidFire Tools, Inc. All rights reserved V20150201
Network Detective 2015 RapidFire Tools, Inc. All rights reserved V20150201 Contents Purpose of this Guide... 3 About Network Detective... 3 Overview... 4 Creating a Site... 5 Starting a HIPAA Assessment...
Central Agency for Information Technology
Central Agency for Information Technology Kuwait National IT Governance Framework Information Security Agenda 1 Manage security policy 2 Information security management system procedure Agenda 3 Manage
i-pcgrid Workshop 2015 Cyber Security for Substation Automation The Jagged Line between Utility and Vendors
March 25-27, 2014 Steven A. Kunsman i-pcgrid Workshop 2015 Cyber Security for Substation Automation The Jagged Line between Utility and Vendors ABB Inc. March 26, 2015 Slide 1 Cyber Security for Substation