Joint Universities Computer Centre Limited ( JUCC ) Information Security Awareness Training- Session Two
|
|
|
- Avice Neal
- 8 years ago
- Views:
Transcription
1 Joint Universities Computer Centre Limited ( JUCC ) Information Security Awareness Training- Session Two Data Handling in University Case Study- Information Security in University
2 Agenda Case Study Background Information Frameworks Confidentiality-Integrity-Availability (CIA) Information Security Risk Management (ISRM) People-Process-Technology (PPT) Plan-Do-Check-Act (PDCA) Conclusion 1
3 Case Study A hypothetical scenario To understand how to apply the information security frameworks To illustrate how the frameworks help the evaluation and design of relevant controls Examples of controls to be implemented 2
4 Background Information The Hypothetical Scenario Current Situation: No centralised system Research information handled by staff members individually Information sharing is difficulty Research Management System ( RMS ) Proposed System Owner: Research Services Department System Users: Research Services administrators Research Services/ departmental accountants Researchers and faculty managers/ administrators User Interface: Web-based user interface 3
5 Background Information Proposed System Functions: Research Accounting Fund Management Researcher/ Staff Information Proposal Management Research Project Management Publication Management Resource Management (e.g. data, information, subscription, space ) Compliance Review Management Reporting 4
6 Background Information Proposed Interfaces: Accounting information with existing university ERP accounting system Research space information with existing facility management system Tailored interfaces for research data/ information with specific external sponsors RMS ERP Accounting Facility Management External Sponsors 5
7 Frameworks The Information Security Frameworks Confidentiality, Integrity and Availability ("CIA") Information Security Risk Management ( ISRM ) People, Process and Technology ("PPT") Plan-Do-Check-Act ( PDCA ) Frameworks are used as a starting point to facilitate security consideration when implementing new system/ process. 6
8 Frameworks- CIA The CIA Concept Confidentiality Keeping sensitive information protected Availability Integrity Keeping information available and accessible Keeping information intact and valid 7
9 Frameworks- ISRM Identify Information Assets Risk Assessment Security Control Security Awareness 11
10 Frameworks- PPT People Process Technology Information security is not only related to computer systems. People are always the weakest link. A complete framework is required to manage information security. 12
11 Frameworks- PDCA Plan-Do-Check-Act (PDCA) A model adopted by ISO27001 Act Plan Check Do 14
12 Frameworks Applying the Frameworks 15
13 CIA Confidentiality What objects (data/ information/ process) should not be disclosed to unauthorised subjects? Accounting information Funding information Research information/ Proposal/ Project Management Publications Should research assistant have access to accounting information? NO Should researchers and departmental managers have access to all funding information? NO Will it be on an as-needed basis? YES Should Research Services department have access to research results and data in-progress? NO- but they should have access to the status of research Who should have access to the publications? Defined by the research team according to requirements Confidentiality Availability Integrity 16
14 CIA Confidentiality What objects (data/ information/ process) should not be disclosed to unauthorised subjects? Resource Management Compliance Review Other public information? System Administration System Database Who should have access? The Research Service Coordinators Research team, as-needed (by roles or project) Who should have access? Research team and appointed investigators Publicly published research (publication) only Who should have the administrator privileged? Dedicated Research Services Manager only Who should have direct database access? Vendor/ Dedicated Database Administrator with proper segregation of duties and approval 17
15 CIA Integrity Objects retain their veracity and are only intentionally modified by authorised subjects. Accounting Funding Researcher Particulars Proposal Project Management Resources Management Compliance Management Reports Integrity Requirement High High Medium Medium Low Low Medium High Confidentiality Availability Integrity 18
16 CIA Integrity Data consistency with external or internal systems Researchers Particulars Resource Management Information Research Data/ Result (External sponsor liked) Accounting Records Publications Campus Records External Facility Management System External Sponsors Data/ Result Campus ERP Accounting System External Publication Portals Consider: System Interface Real-time synchronisation & heart-beat Automated reconciliation (e.g. day-end) Manual reconciliation reports Streamlined administration process (e.g. staff particulars) 19
17 CIA Availability Authorised subjects are granted timely and uninterrupted access to objects. Data Accounting Medium Printed period report for historical data Funding Medium N/A Researcher Particulars Low Campus records/ peer information Project Management High N/A Publication Low Other publishing portals Resource Management Medium N/A Compliance Medium N/A Management Reports Project Management Information - Pending Tasks Criticality of - Research SystemResults Alternatives - Project Availability Timeline - Status Tracking - Team collaboration Critical for research progress Medium Printed management reports Confidentiality Availability Integrity 20
18 ISRM Identifying Information Asset Objects retain their veracity and are only intentionally modified by authorised subjects. Modules Accounting Funding Information Asset Historical financial data (project and campus-wide research function) Costing data and calculation Budget Salary- [Sensitive] Current sources of fund (Gift/ Trust/ Government) Potential sources of fund- [Sensitive] Fund related contractual requirements (compliance) Fund status and utilisation Identify Information Assets 21
19 ISRM Identifying Information Asset Modules Researcher Information Research Project Management Information Asset Personal data of research teams- [Private] Contacting information Academic background Assessment and appraisal Project Management Project timeline Project tracking Financial data Research Data- [Confidential] Research work-in-progress (WIP) Data and statistics (e.g. medical information of research subject) Research results Business confidential information (e.g. unpatented WIP) Identify Information Assets 22
20 ISRM Identifying Information Asset Modules Publication Management Resource Management Compliance Review Management Reporting Information Asset Public and restricted publications Centralised subscription database Shared research information and statistic Space utilisation Contractual/ regulatory requirements- [Sensitive] Project compliance status Consolidated financial performance and position Project and staff performance assessment Overall research project status tracking Available in both electronic and printed-copies Identify Information Assets 23
21 ISRM Identifying Information Asset - The process (examples) Step 1: The data Step 2: System and media Step 3: Organisation Objective Step 4: Criticality Research Data/ Results Storage: Database, file server In-transit: Interface with external sponsors View: Access by research team Backup: Backup tapes Fulfil contractual requirements (e.g. confidentiality of data) Observe regulation (e.g. privacy of research subjects) In case of breach: -Withdrawal of fund -Loss of competitiveness -Litigation -Damage to reputation Researchers Particular Storage: Database View: Access by administrator and research team Backup: Backup tapes Observe regulatory requirements (Personal Data (Privacy) Ordinance) - Litigation in case of breach Identify Information Assets 24
22 ISRM Risk Assessment Risk Assessment- Assignment of value for potential harm/ loss Quantitative Qualitative $ $ $ $ $ Annualised Loss Expectancy (ALE) Annualised Rate of Occurrence (ARO) Single Loss Expectancy (SLE) Asset Valuation (AV) Exposure Factor (EF) $ $ $ $ $ SLE = AV x EF ALE = SLE x ARO Risk Assessment 25
23 ISRM Risk Assessment- Example Asset Asset Valuation Vulnerabilities & Threats Impact Occurrence ALE Research Data -Withdrawal of fund - Loss of competitive advantage - Litigation - Damage to reputation =$1,000,000 Vulnerabilities: Unencrypted data transfer with external sponsors Threats: Interception of data in-transit Leakage of confidential research data ARO = 0.2 / Year EF = 30% = AV x EF x ARO = $1,000,000 x 30% x 0.2 = $60,000 Quantitative - How much to pay for countermeasure? Avg. = 3.5 Qualitative - How to prioritise for resource allocation? Risk Assessment 26
24 ISRM Security Control Research Data: Quantitative- ALE = $60,000 If control can be implemented with an averaged annual cost below $60,000 to prevent/ detect/ correct the occurrence of leakage of research data, such control can be considered Qualitative- ALE= 3.5 With limited fund in implementing controls to protect the RMS, funds should be allocated to identified assets of higher averaged priority. Administrative Logical Physical Detective Corrective Preventive Security Control 27
25 ISRM Security Control Research Data Protection- Considering Control Implementation Implementing a network-based data leakage prevention system with an annual total cost of $300,000 may not be justified solely in preventing the loss of research data leakage (due to low expected occurrence of such event). Implementing data encryption for all external interfaces with research data transfer is expected to mitigate over 80% of the exposure to research data leakage. The implementation involves an annual cost of $10,000. This control may be considered in mitigating the risk of research data leakage. Implementing a more granular access control mechanism is estimated to cost $8,000 per annum averaged. This control may also be considered together with the data encryption control. Security Control 28
26 ISRM Security Awareness Assuming the a granular access control to research data is to be implemented- Security awareness to both the research team and Research Services administrators should be conducted to cover: Importance of research data Importance of the access control implemented How to design an effective access control according to the project nature Importance of regular access right maintenance and review Security Awareness 29
27 PPT People Required expertise to manage the RMS- Technical and management competence. Additional personnel required for the implementation and operation of RMS - Factored in during the budget preparation Consider users acceptance of the system. Consider rolling out the RMS in phases to build acceptance and to smooth migration Management awareness of the potential difficulties, risk and the importance of management support Regular communication to all relevant parties If PEOPLE are not ready for the new system, should we consider postponing the implementation? People 30
28 PPT Process Vendor selection criteria Security policies Security audit requirements System hardening baseline Third-party service support Change management cycle Patch management process User awareness program Incident management User administration Consider: Availability of such processes Applicability of such processes over the new RMS Requirement of additional process to cater for the implementation of RMS User awareness of the processes Process 31
29 PPT Technology Network access controls (e.g. firewall, IPS, logs ) User access controls (e.g. login mechanism- SSO) Anti-virus on end-user (Research Services & departmental) machines Physical access control to servers and network equipments Specific technical considerations- to help people follow process System configured password configuration requirements (password length, complexity & expiry) Restricted access to RMS by pre-configured IP address Input validation Tech. 32
30 PDCA Act Security improvement plan Review and update of ISMS components, such as policy and procedures. Plan Business objective & requirements System/ user requirements Asset identification Risk assessment Control design and implementation Process documentation/ policies Check Review of effectiveness of existing and new controls Self internal compliance audits Review of risk assessment Do Implementing new controls and processes in phases Conduct user awareness training 33
31 PDCA Act Security improvement plan Review and update of ISMS components, such as policy and procedures. Check Review of effectiveness of existing and new controls Self internal compliance audits Review of risk assessment Plan Business objective & requirements System/ user requirements Asset identification CHECK & ACT Risk assessment Control design and implementation On-going Process documentation/ policies Review and Do Update Implementing new controls and processes in phases Conduct user awareness training 34
32 Conclusion The information security frameworks facilitate the management process in considering the handling of data and implementation of system/ process. Identifying asset Determining security requirement Risk assessment Control evaluation Control implementation Process monitoring and update Availability Confidentiality Act Check Integrity Process Plan Do People Technology Identify Information Assets Risk Assessment Security Control Security Awareness 35
33 Conclusion Suggested Controls: Detective Corrective Preventive Administrative Rotation of administrator duties Management review of access controls Review of IPS, firewall and web application logs Data reconciliation (between RMS, ERP and facility management systems Business continuity plan Disaster recovery plan Separation of duties Technical training for responsible IT personnel Communicated security policy User account administration Logical Network Intrusion Detection System especially for externally exposed hosts (external interface) System logs System integrity check Network Intrusion Prevention System Anti-virus software Granular access control to personal data and research information Data encryption for external interfaces Web-based authentication Anti-virus software Physical Data Centre/ Research Office Camera & alarms Security guards Regular asset count Emergency power supply Physical access control (e.g. swipe cards, biometric locks) to computer facilities Environment controls Regular offsite backup of data 36
34 Q&A? 37
Joint Universities Computer Centre Limited ( JUCC ) Information Security Awareness Training- Session Two Information Security in Universities
Joint Universities Computer Centre Limited ( JUCC ) Information Security Awareness Training- Session Two Information Security in Universities Agenda Information Security Management in Universities Recent
Joint Universities Computer Centre Limited ( JUCC ) Information Security Awareness Training- Session One Information Security and Challenges
Joint Universities Computer Centre Limited ( JUCC ) Information Security Awareness Training- Session One Information Security and Challenges Agenda Overview of Information Security Management Information
Joint Universities Computer Centre Limited ( JUCC ) Information Security Awareness Training- Session One
Joint Universities Computer Centre Limited ( JUCC ) Information Security Awareness Training- Session One Information Security- Perspective for Management Information Security Management Program Concept
Joint Universities Computer Centre Limited ( JUCC ) Information Security Awareness Training- Session One
Joint Universities Computer Centre Limited ( JUCC ) Information Security Awareness Training- Session One Data Handling in University Human Factor in Information Security Agenda The Information Security
Policy Document. Communications and Operation Management Policy
Policy Document Communications and Operation Management Policy [23/08/2011] Page 1 of 11 Document Control Organisation Redditch Borough Council Title Communications and Operation Management Policy Author
Client Security Risk Assessment Questionnaire
Select the appropriate answer from the drop down in the column, and provide a brief description in the section. 1 Do you have a member of your organization with dedicated information security duties? 2
Securing the Service Desk in the Cloud
TECHNICAL WHITE PAPER Securing the Service Desk in the Cloud BMC s Security Strategy for ITSM in the SaaS Environment Introduction Faced with a growing number of regulatory, corporate, and industry requirements,
Supplier Security Assessment Questionnaire
HALKYN CONSULTING LTD Supplier Security Assessment Questionnaire Security Self-Assessment and Reporting This questionnaire is provided to assist organisations in conducting supplier security assessments.
Course: Information Security Management in e-governance. Day 1. Session 5: Securing Data and Operating systems
Course: Information Security Management in e-governance Day 1 Session 5: Securing Data and Operating systems Agenda Introduction to information, data and database systems Information security risks surrounding
Ellucian Cloud Services. Joe Street Cloud Services, Sr. Solution Consultant
Ellucian Cloud Services Joe Street Cloud Services, Sr. Solution Consultant Confidentiality Statement The information contained herein is considered proprietary and highly confidential by Ellucian Managed
A Decision Maker s Guide to Securing an IT Infrastructure
A Decision Maker s Guide to Securing an IT Infrastructure A Rackspace White Paper Spring 2010 Summary With so many malicious attacks taking place now, securing an IT infrastructure is vital. The purpose
RISK ASSESSMENT GUIDELINES
RISK ASSESSMENT GUIDELINES A Risk Assessment is a business tool used to gauge risks to the business and to assist in safeguarding against that risk by developing countermeasures and mitigation strategies.
External Supplier Control Requirements
External Supplier Control s Cyber Security For Suppliers Categorised as Low Cyber Risk 1. Asset Protection and System Configuration Barclays Data and the assets or systems storing or processing it must
Guide to Vulnerability Management for Small Companies
University of Illinois at Urbana-Champaign BADM 557 Enterprise IT Governance Guide to Vulnerability Management for Small Companies Andrew Tan Table of Contents Table of Contents... 1 Abstract... 2 1. Introduction...
¼ããÀ ããè¾ã ¹ãÆãä ã¼ãîãä ã ããõà ãäìããä ã½ã¾ã ºããñ à Securities and Exchange Board of India
CIRCULAR CIR/MRD/DP/13/2015 July 06, 2015 To, All Stock Exchanges, Clearing Corporation and Depositories. Dear Sir / Madam, Subject: Cyber Security and Cyber Resilience framework of Stock Exchanges, Clearing
Certified Information Systems Auditor (CISA)
Certified Information Systems Auditor (CISA) Course Introduction Course Introduction Module 01 - The Process of Auditing Information Systems Lesson 1: Management of the Audit Function Organization of the
Security Tool Kit System Checklist Departmental Servers and Enterprise Systems
Security Tool Kit System Checklist Departmental Servers and Enterprise Systems INSTRUCTIONS System documentation specifically related to security controls of departmental servers and enterprise systems
Retention & Destruction
Last Updated: March 28, 2014 This document sets forth the security policies and procedures for WealthEngine, Inc. ( WealthEngine or the Company ). A. Retention & Destruction Retention & Destruction of
Security Controls What Works. Southside Virginia Community College: Security Awareness
Security Controls What Works Southside Virginia Community College: Security Awareness Session Overview Identification of Information Security Drivers Identification of Regulations and Acts Introduction
IBX Business Network Platform Information Security Controls. 2015-02- 20 Document Classification [Public]
![IBX Business Network Platform Information Security Controls. 2015-02- 20 Document Classification [Public]](/thumbs/26/7758795.jpg "IBX Business Network Platform Information Security Controls. 2015-02- 20 Document Classification [Public]")
IBX Business Network Platform Information Security Controls 2015-02- 20 Document Classification [Public] Table of Contents 1. General 2 2. Physical Security 2 3. Network Access Control 2 4. Operating System
Managing internet security
Managing internet security GOOD PRACTICE GUIDE Contents About internet security 2 What are the key components of an internet system? 3 Assessing internet security 4 Internet security check list 5 Further
IT Best Practices Audit TCS offers a wide range of IT Best Practices Audit content covering 15 subjects and over 2200 topics, including:
IT Best Practices Audit TCS offers a wide range of IT Best Practices Audit content covering 15 subjects and over 2200 topics, including: 1. IT Cost Containment 84 topics 2. Cloud Computing Readiness 225
Information security controls. Briefing for clients on Experian information security controls
Information security controls Briefing for clients on Experian information security controls Introduction Security sits at the core of Experian s operations. The vast majority of modern organisations face
Newcastle University Information Security Procedures Version 3
Newcastle University Information Security Procedures Version 3 A Information Security Procedures 2 B Business Continuity 3 C Compliance 4 D Outsourcing and Third Party Access 5 E Personnel 6 F Operations
Security Threat Risk Assessment: the final key piece of the PIA puzzle
Security Threat Risk Assessment: the final key piece of the PIA puzzle Curtis Kore, Information Security Analyst Angela Swan, Director, Information Security Agenda Introduction Current issues The value
INFORMATION TECHNOLOGY SECURITY STANDARDS
INFORMATION TECHNOLOGY SECURITY STANDARDS Version 2.0 December 2013 Table of Contents 1 OVERVIEW 3 2 SCOPE 4 3 STRUCTURE 5 4 ASSET MANAGEMENT 6 5 HUMAN RESOURCES SECURITY 7 6 PHYSICAL AND ENVIRONMENTAL
Estate Agents Authority
INFORMATION SECURITY AND PRIVACY PROTECTION POLICY AND GUIDELINES FOR ESTATE AGENTS Estate Agents Authority The contents of this document remain the property of, and may not be reproduced in whole or in
Supplier Information Security Addendum for GE Restricted Data
Supplier Information Security Addendum for GE Restricted Data This Supplier Information Security Addendum lists the security controls that GE Suppliers are required to adopt when accessing, processing,
A Rackspace White Paper Spring 2010
Achieving PCI DSS Compliance with A White Paper Spring 2010 Summary The Payment Card Industry Data Security Standard (PCI DSS) is a global information security standard defined by the Payment Card Industry
FINAL May 2005. Guideline on Security Systems for Safeguarding Customer Information
FINAL May 2005 Guideline on Security Systems for Safeguarding Customer Information Table of Contents 1 Introduction 1 1.1 Purpose of Guideline 1 2 Definitions 2 3 Internal Controls and Procedures 2 3.1
SRA International Managed Information Systems Internal Audit Report
SRA International Managed Information Systems Internal Audit Report Report #2014-03 June 18, 2014 Table of Contents Executive Summary... 3 Background Information... 4 Background... 4 Audit Objectives...
APPENDIX G ASP/SaaS SECURITY ASSESSMENT CHECKLIST
APPENDIX G ASP/SaaS SECURITY ASSESSMENT CHECKLIST Application Name: Vendor Name: Briefly describe the purpose of the application. Include an overview of the application architecture, and identify the data
BMC s Security Strategy for ITSM in the SaaS Environment
BMC s Security Strategy for ITSM in the SaaS Environment TABLE OF CONTENTS Introduction... 3 Data Security... 4 Secure Backup... 6 Administrative Access... 6 Patching Processes... 6 Security Certifications...
LAMAR STATE COLLEGE - ORANGE INFORMATION RESOURCES SECURITY MANUAL. for INFORMATION RESOURCES
LAMAR STATE COLLEGE - ORANGE INFORMATION RESOURCES SECURITY MANUAL for INFORMATION RESOURCES Updated: June 2007 Information Resources Security Manual 1. Purpose of Security Manual 2. Audience 3. Acceptable
IT - General Controls Questionnaire
IT - General Controls Questionnaire Internal Control Questionnaire Question Yes No N/A Remarks G1. ACCESS CONTROLS Access controls are comprised of those policies and procedures that are designed to allow
Small Business IT Risk Assessment
Small Business IT Risk Assessment Company name: Completed by: Date: Where Do I Begin? A risk assessment is an important step in protecting your customers, employees, and your business, and well as complying
3rd Party Assurance & Information Governance 2014-2016 outlook IIA Ireland Annual Conference 2014. Straightforward Security and Compliance
3rd Party Assurance & Information Governance 2014-2016 outlook IIA Ireland Annual Conference 2014 Continuous Education Services (elearning/workshops) Compliance Management Portals Information Security
ensure prompt restart of critical applications and business activities in a timely manner following an emergency or disaster
Security Standards Symantec shall maintain administrative, technical, and physical safeguards for the Symantec Network designed to (i) protect the security and integrity of the Symantec Network, and (ii)
How small and medium-sized enterprises can formulate an information security management system
How small and medium-sized enterprises can formulate an information security management system Royal Holloway Information Security Thesis Series Information security for SMEs Vadim Gordas, MSc (RHUL) and
Application Development within University. Security Checklist
Application Development within University Security Checklist April 2011 The Application Development using data from the University Enterprise Systems or application Development for departmental use security
Tenzing Security Services and Best Practices
Tenzing Security Services and Best Practices OVERVIEW Security is about managing risks and threats to your environment. The most basic security protection is achieved by pro-actively monitoring and intercepting
Technology Risk Management
1 Monetary Authority of Singapore Technology Risk Guidelines & Notices New Requirements for Financial Services Industry Mark Ames Director, Seminar Program ISACA Singapore 2 MAS Supervisory Framework Impact
University of Kent Information Services Information Technology Security Policy
University of Kent Information Services Information Technology Security Policy IS/07-08/104 (A) 1. General The University IT Security Policy (the Policy) shall be approved by the Information Systems Committee
Name: Position held: Company Name: Is your organisation ISO27001 accredited:
Third Party Information Security Questionnaire This questionnaire is to be completed by the system administrator and by the third party hosting company if a separate company is used. Name: Position held:
FMCS SECURE HOSTING GUIDE
FMCS SECURE HOSTING GUIDE October 2015 SHG-MNL-v3.0 CONTENTS INTRODUCTION...4 HOSTING SERVICES...4 Corporate Secure Hosting... 4 Hosting Partner... 4 Hosting Location... 4 Physical Security... 4 Risk and
How To Protect Decd Information From Harm
Policy ICT Security Please note this policy is mandatory and staff are required to adhere to the content Summary DECD is committed to ensuring its information is appropriately managed according to the
Projectplace: A Secure Project Collaboration Solution
Solution brief Projectplace: A Secure Project Collaboration Solution The security of your information is as critical as your business is dynamic. That s why we built Projectplace on a foundation of the
WEST LOTHIAN COUNCIL INFORMATION SECURITY POLICY
WEST LOTHIAN COUNCIL INFORMATION SECURITY POLICY DATA LABEL: PUBLIC INFORMATION SECURITY POLICY CONTENTS 1. INTRODUCTION... 3 2. MAIN OBJECTIVES... 3 3. LEGISLATION... 4 4. SCOPE... 4 5. STANDARDS... 4
EAaaS Cloud Security Best Practices
EAaaS Cloud Security Best Practices A Technical White Paper by Sennovate Inc Jan 2013 EAaaS Cloud Security Best Practices Page 1 Introduction: Cloud security is an ever evolving subject that is difficult
HIPAA: MANAGING ACCESS TO SYSTEMS STORING ephi WITH SECRET SERVER
HIPAA: MANAGING ACCESS TO SYSTEMS STORING ephi WITH SECRET SERVER With technology everywhere we look, the technical safeguards required by HIPAA are extremely important in ensuring that our information
How To Audit Health And Care Professions Council Security Arrangements
Audit Committee 28 Internal audit report ICT Security Executive summary and recommendations Introduction Mazars has undertaken a review of ICT Security controls, in accordance with the internal audit plan
1. Perimeter Security Dealing with firewall, gateways and VPNs and technical entry points. Physical Access to your premises can also be reviewed.
Service Definition Technical Security Review Overview of Service Considering the increasing importance of security, the number of organisations that allow for contingency in their Information Security
Information Technology
Credit Card Handling Security Standards Overview Information Technology This document is intended to provide guidance to merchants (colleges, departments, organizations or individuals) regarding the processing
Cyber Security Pr o t e c t i n g y o u r b a n k a g a i n s t d a t a b r e a c h e s
Cyber Security Pr o t e c t i n g y o u r b a n k a g a i n s t d a t a b r e a c h e s 1 Agenda Data Security Trends Root causes of Cyber Attacks How can we fix this? Secure Infrastructure Security Practices
<cloud> Secure Hosting Services
Global Resources... Local Knowledge Figtree offers the functionality of Figtree Systems Software without the upfront infrastructure investment. It is the preferred deployment solution for organisations
Joint Universities Computer Centre Limited ( JUCC ) Information Security Awareness Training- Session Three
Joint Universities Computer Centre Limited ( JUCC ) Information Security Awareness Training- Session Three Data Handling in University Information Classification and Handling Agenda Background People-Process-Technology
REGULATIONS FOR THE SECURITY OF INTERNET BANKING
REGULATIONS FOR THE SECURITY OF INTERNET BANKING PAYMENT SYSTEMS DEPARTMENT STATE BANK OF PAKISTAN Table of Contents PREFACE... 3 DEFINITIONS... 4 1. SCOPE OF THE REGULATIONS... 6 2. INTERNET BANKING SECURITY
University of Pittsburgh Security Assessment Questionnaire (v1.5)
Technology Help Desk 412 624-HELP [4357] technology.pitt.edu University of Pittsburgh Security Assessment Questionnaire (v1.5) Directions and Instructions for completing this assessment The answers provided
Music Recording Studio Security Program Security Assessment Version 1.1
Music Recording Studio Security Program Security Assessment Version 1.1 DOCUMENTATION, RISK MANAGEMENT AND COMPLIANCE PERSONNEL AND RESOURCES ASSET MANAGEMENT PHYSICAL SECURITY IT SECURITY TRAINING AND
COMHAIRLE NÁISIÚNTA NA NATIONAL COUNCIL FOR VOCATIONAL AWARDS. Consultative Draft Module Descriptor. Network Security.
COMHAIRLE NÁISIÚNTA NA gcáilíochtaí GAIRMOIDEACHAIS NATIONAL COUNCIL FOR VOCATIONAL AWARDS Consultative Draft Module Descriptor Network Security Level 6 C30260 January 2006 1. Module Title Network Security
TEMPLE UNIVERSITY POLICIES AND PROCEDURES MANUAL
TEMPLE UNIVERSITY POLICIES AND PROCEDURES MANUAL Title: Computer and Network Security Policy Policy Number: 04.72.12 Effective Date: November 4, 2003 Issuing Authority: Office of the Vice President for
University of California, Riverside Computing and Communications. IS3 Local Campus Overview Departmental Planning Template
University of California, Riverside Computing and Communications IS3 Local Campus Overview Departmental Planning Template Last Updated April 21 st, 2011 Table of Contents: Introduction Security Plan Administrative
U06 IT Infrastructure Policy
Dartmoor National Park Authority U06 IT Infrastructure Policy June 2010 This document is copyright to Dartmoor National Park Authority and should not be used or adapted for any purpose without the agreement
GUIDELINES ON CONTROL OBJECTIVES & PROCEDURES FOR OUTSOURCED SERVICE PROVIDERS
GUIDELINES ON CONTROL OBJECTIVES & PROCEDURES FOR OUTSOURCED SERVICE PROVIDERS 26 June 2015 Version 1.0 THE ABS GUIDELINES ON CONTROL OBJECTIVES & PROCEDURES FOR OUTSOURCED SERVICE PROVIDERS INTRODUCTION
Secure, Scalable and Reliable Cloud Analytics from FusionOps
White Paper Secure, Scalable and Reliable Cloud Analytics from FusionOps A FusionOps White Paper FusionOps 265 Santa Ana Court Sunnyvale, CA 94085 www.fusionops.com World-class security... 4 Physical Security...
Regulations on Information Systems Security. I. General Provisions
Riga, 7 July 2015 Regulations No 112 (Meeting of the Board of the Financial and Capital Market Commission Min. No 25; paragraph 2) Regulations on Information Systems Security Issued in accordance with
Log Management Standard 1.0 INTRODUCTION 2.0 SYSTEM AND APPLICATION MONITORING STANDARD. 2.1 Required Logging
Log Management Standard Effective Date: 7/28/2015 1.0 INTRODUCTION The California State University, Chico system/application log management standard identifies event logging requirements, log review frequency,
Agenda. Cyber Security: Potential Threats Impacting Organizations 1/6/2015. January 10, 2015 Scott Petree
Cyber Security: Potential Threats Impacting Organizations January 10, 2015 Scott Petree Agenda 2 Data Security Trends Root Causes of Cyber Attacks How Can We Fix This? Secure Infrastructure User Awareness
Security Controls for the Autodesk 360 Managed Services
Autodesk Trust Center Security Controls for the Autodesk 360 Managed Services Autodesk strives to apply the operational best practices of leading cloud-computing providers around the world. Sound practices
Summary of Technical Information Security for Information Systems and Services Managed by NUIT (Newcastle University IT Service)
Introduction This document provides a summary of technical information security controls operated by Newcastle University s IT Service (NUIT). These information security controls apply to all NUIT managed
School of Anthropology and Museum Ethnography & School of Interdisciplinary Area Studies Information Security Policy
School of Anthropology and Museum Ethnography & School of Interdisciplinary Area Studies Information Security Policy Page 1 of 10 Contents 1 Preamble...3 2 Purpose...3 3 Scope...3 4 Roles and responsibilities...3
Logging In: Auditing Cybersecurity in an Unsecure World
About This Course Logging In: Auditing Cybersecurity in an Unsecure World Course Description $5.4 million that s the average cost of a data breach to a U.S.-based company. It s no surprise, then, that
Information Technology General Controls Review (ITGC) Audit Program Prepared by:
Information Technology General Controls Review (ITGC) Audit Program Date Prepared: 2012 Internal Audit Work Plan Objective: IT General Controls (ITGC) address the overall operation and activities of the
CONTENTS. Security Policy
CONTENTS PHYSICAL SECURITY (UK) PHYSICAL SECURITY (CHICAGO) PHYSICAL SECURITY (PHOENIX) PHYSICAL SECURITY (SINGAPORE) SYSTEM SECURITY INFRASTRUCTURE Vendor software updates Security first policy CUSTOMER
Information Security Policy September 2009 Newman University IT Services. Information Security Policy
Contents 1. Statement 1.1 Introduction 1.2 Objectives 1.3 Scope and Policy Structure 1.4 Risk Assessment and Management 1.5 Responsibilities for Information Security 2. Compliance 3. HR Security 3.1 Terms
Introduction. PCI DSS Overview
Introduction Manage Engine Desktop Central is part of ManageEngine family that represents entire IT infrastructure with products such as Network monitoring, Helpdesk management, Application management,
GoodData Corporation Security White Paper
GoodData Corporation Security White Paper May 2016 Executive Overview The GoodData Analytics Distribution Platform is designed to help Enterprises and Independent Software Vendors (ISVs) securely share
Cloud Security. Peter Jopling joplingp@uk.ibm.com IBM UK Ltd Software Group Hursley Labs. peterjopling. 2011 IBM Corporation
Cloud Security Peter Jopling joplingp@uk.ibm.com IBM UK Ltd Software Group Hursley Labs peterjopling 2011 IBM Corporation Cloud computing impacts the implementation of security in fundamentally new ways
HIPAA CRITICAL AREAS TECHNICAL SECURITY FOCUS FOR CLOUD DEPLOYMENT
HIPAA CRITICAL AREAS TECHNICAL SECURITY FOCUS FOR CLOUD DEPLOYMENT A Review List This paper was put together with Security in mind, ISO, and HIPAA, for guidance as you move into a cloud deployment Dr.
External Supplier Control Requirements
External Supplier Control Requirements Cyber Security For Suppliers Categorised as High Cyber Risk Cyber Security Requirement Description Why this is important 1. Asset Protection and System Configuration
Automation Suite for. 201 CMR 17.00 Compliance
WHITEPAPER Automation Suite for Assurance with LogRhythm The Massachusetts General Law Chapter 93H regulation 201 CMR 17.00 was enacted on March 1, 2010. The regulation was developed to safeguard personal
2 0 1 4 F G F O A A N N U A L C O N F E R E N C E
I T G OV E R NANCE 2 0 1 4 F G F O A A N N U A L C O N F E R E N C E RAJ PATEL Plante Moran 248.223.3428 raj.patel@plantemoran.com This presentation will discuss current threats faced by public institutions,
OCR LEVEL 3 CAMBRIDGE TECHNICAL
Cambridge TECHNICALS OCR LEVEL 3 CAMBRIDGE TECHNICAL CERTIFICATE/DIPLOMA IN IT NETWORKED SYSTEMS SECURITY J/601/7332 LEVEL 3 UNIT 28 GUIDED LEARNING HOURS: 60 UNIT CREDIT VALUE: 10 NETWORKED SYSTEMS SECURITY
How-To Guide: Cyber Security. Content Provided by
How-To Guide: Cyber Security Content Provided by Who needs cyber security? Businesses that have, use, or support computers, smartphones, email, websites, social media, or cloudbased services. Businesses
Records Management and Security Procedure. Approved by: Executive Management Team Version: 1.2 Date: 21.9.2015
Document: Records Management and Security Procedure Approved by: Executive Management Team Version: 1.2 Date: 21.9.2015 1. Overview Senior management of Wentworth Institute ( WINWIN ) have a legal responsibility
Lot 1 Service Specification MANAGED SECURITY SERVICES
Lot 1 Service Specification MANAGED SECURITY SERVICES Fujitsu Services Limited, 2013 OVERVIEW OF FUJITSU MANAGED SECURITY SERVICES Fujitsu delivers a comprehensive range of information security services
Summary of Information Technology General Control Environment Findings for the year ended 30 June 2015
Summary of Inmation Technology General Control Environment Findings the year ended 30 June 2015 1 Change management Complete Revisiting the Change Management control process documentation and updating
SECTION: SUBJECT: PCI-DSS General Guidelines and Procedures
1. Introduction 1.1. Purpose and Background 1.2. Central Coordinator Contact 1.3. Payment Card Industry Data Security Standards (PCI-DSS) High Level Overview 2. PCI-DSS Guidelines - Division of Responsibilities
ICANWK406A Install, configure and test network security
ICANWK406A Install, configure and test network security Release: 1 ICANWK406A Install, configure and test network security Modification History Release Release 1 Comments This Unit first released with
FIREWALL CHECKLIST. Pre Audit Checklist. 2. Obtain the Internet Policy, Standards, and Procedures relevant to the firewall review.
1. Obtain previous workpapers/audit reports. FIREWALL CHECKLIST Pre Audit Checklist 2. Obtain the Internet Policy, Standards, and Procedures relevant to the firewall review. 3. Obtain current network diagrams
Network and Security Controls
Network and Security Controls State Of Arizona Office Of The Auditor General Phil Hanus IT Controls Webinar Series Part I Overview of IT Controls and Best Practices Part II Identifying Users and Limiting
HIPAA Compliant Infrastructure Services. Real Security Outcomes. Delivered.
Real Security Outcomes. Delivered. Deploying healthcare and healthcare related services to the cloud can be frightening. The requirements of HIPAA can be difficult to navigate, and while many vendors claim
AUDIT REPORT 03-11 WEB PORTAL SECURITY REVIEW. 2004 FEBRUARY R. D. MacLEAN CITY AUDITOR
AUDIT REPORT 03-11 WEB PORTAL SECURITY REVIEW 2004 FEBRUARY R. D. MacLEAN CITY AUDITOR Web Portal Security Review Page 2 Audit Report 03-11 Web Portal Security Review INDEX SECTION I EXECUTIVE SUMMARY
How To Protect Yourself From A Hacker Attack
Cybersecurity Demystified: Information Technology Security Trends Joe Oleksak, Plante Moran Agenda Data Security Trends Example Attacks Industry Examples An Answer 1 Who Are The Victims? Targets - victims
Practice Good Enterprise Security Management. Presented by Laurence CHAN, MTR Corporation Limited
Practice Good Enterprise Security Management Presented by Laurence CHAN, MTR Corporation Limited About Me Manager Information Security o o o o Policy formulation and governance Incident response Incident
Outsourcing and Information Security
IBM Global Technology Services Outsourcing and Information Security Preparation is the Key However ultimately accountability cannot be outsourced February 2009 page 2 1. Introduction 3 1.1 Reason for outsourcing
SECURITY OVERVIEW FOR MY.ENDNOTE.COM. In line with commercial industry standards, Thomson Reuters employs a dedicated security team to protect our
ENDNOTE ONLINE SECURITY OVERVIEW FOR MY.ENDNOTE.COM In line with commercial industry standards, Thomson Reuters employs a dedicated security team to protect our servers from attacks and other attempts
RMS. Privacy Policy for RMS Hosting Plus and RMS(one) Guiding Principles
RMS Privacy Policy for RMS Hosting Plus and RMS(one) Guiding Principles RMS Privacy Policy for RMS Hosting Plus and RMS(one) Guiding Principles RMS aims to provide the most secure, the most private, and
<Insert Picture Here> How to protect sensitive data, challenges & risks
How to protect sensitive data, challenges & risks Lars Klumpes CISSP Security Strategy Consultant EMEA Disclaimer The following is intended to outline our general product direction.