Simplified IT Compliance Frameworks to Reduce Costs and Strengthen Security
|
|
|
- Erik McDaniel
- 8 years ago
- Views:
Transcription
1 Copyright 2008 EMC Corporation. All rights reserved. Simplified IT Compliance Frameworks to Reduce Costs and Strengthen Security Dave Simmons EMC Corporation
2 Why is Information Security So Difficult? because sensitive information is always moving, transforming DR WAN Data warehouse WW Campuses Business Analytics Back up tape WWW WW Customers Customer Portal Production Data Disk storage WW Partners WAN Outsourced Development Staging Back up disk Remote Employees VPN Enterprise File Server Endpoint Network Applications Copyright 2008 EMC Corporation. All rights reserved. 2 Files Storage
3 Why is Information Security So Difficult? and every movement and transformation has unique risks Device Theft Media Theft WAN Unauthorized Data Activity warehouse DR Media Loss WW Campuses Business Analytics Takeover Intercept WWW Unauthorized Access Unauthorized Access Unavailability Back up tape WW Customers Eavesdropping Fraud Customer portal Production Data Corruption Disk storage Unintentional Distribution WW Partners Data Loss Device Remote Employees Loss WAN VPN Outsourced Development Unauthorized Activity Enterprise Staging Data Theft File Server Back up disk DOS Endpoint Network Applications Copyright 2008 EMC Corporation. All rights reserved. 3 Files Storage
4 Understanding Risk Risk is the combination of the probability of an event and its consequences. (ISO definition) Risk Components Assets (Information, infrastructure, etc.) Threats (Sources, Objectives & Methods) Vulnerabilities (People, Process & Technology) RSA & EMC Can Help Managing Risk Avoid Eliminate the source of the risk Control Implement controls to reduce risk Accept Be aware but take no action Ignore Refuse to acknowledge risk Transfer Assign risk to other agency Copyright 2008 EMC Corporation. All rights reserved. 4
5 Risk Aligns Security Investments to Compliance Requirements PCI SOX HIPAA Internal Reqs Partner Reqs What information is important to the business? Sensitive Information Risk What risks are we willing to accept, what risks do we need to protect against to enable the business? Where does it go? Security Incidents What bad things can happen? Endpoint Network App / DB Copyright 2008 EMC Corporation. All rights reserved. 5 FS/CMS Storage
6 Today s Agenda Compliance Landscape Frameworks for Security and Compliance Examples: Frameworks in Action RSA Solutions for Simplified IT Compliance Copyright 2008 EMC Corporation. All rights reserved. 6
7 Why We re Here Today Organizations worldwide: Spend heavily on compliance Don t see expected security improvements Have shrinking budgets Need to get better value out of investments they do make RSA has an approach to help: Reduce costs Simplify compliance Improve security Be proactive, instead of reactive Compliance landscape Industry groups Business partners Customers Internal policy Governmental Ernst & Young In 2007, compliance remained the number one driver of information security. Copyright 2008 EMC Corporation. All rights reserved. 7
8 Framework-Based Security Preparing for Ever-Changing Compliance PCI DSS HIPAA Internal Policy GLBA HSPD 12 CSB 1386 FISMA Country Privacy Laws COCOM SOX EU CDR UK RIPA Data Security Act FACTA EU Data Privacy FFIEC BASEL II J-SOX IRS NERC NISPOM Partner Rules Copyright 2008 EMC Corporation. All rights reserved. 8 ACSI 33 NIST 800 And what s next? State Privacy Laws
9 Reactive & Expensive IT Compliance PCI DSS Compliance Internal Policy Compliance Partner Policy Compliance Data Privacy Regulation Compliance Basel II Compliance Endpoint Network App / DB FS/CMS Storage Encryption Encryption Access Control Access Control Monitoring Monitoring Authentication Monitoring NAC Authentication Authentication Encryption Policy Log Management Data Leakage Monitoring Copyright 2008 EMC Corporation. All rights reserved. 9
10 Reactive & Expensive IT Compliance PCI DSS Compliance Internal Policy Compliance Partner Policy Compliance Data Privacy Regulation Compliance Basel II Compliance Endpoint Network App / DB FS/CMS Storage Encryption Monitoring Authentication Policy Access Control Encryption Access Gartner estimates that Control allocating Monitoringresources on a regulation-byregulation basis means that enterprises Authentication Authentication NAC spend an average of 150% more on compliance, Log Management largely Data Leakage due to duplication of effort! Gartner for IT Leaders Overview: The IT Compliance Professional. French Caldwell. Monitoring October 22, 2007 Monitoring Encryption Copyright 2008 EMC Corporation. All rights reserved. 10
11 Framework-Based Compliance & Security Enabling Cost-Effective Compliance PCI DSS Compliance Internal Policy Compliance Partner Policy Compliance Data Privacy Regulation Compliance Basel II Compliance Endpoint Network App / DB FS/CMS Storage Monitor, Report, Audit Authentication Access Control Encryption Key Management Encryption Encryption Encryption Encryption Encryption Data Loss Prevention Copyright 2008 EMC Corporation. All rights reserved. 11
12 The Solution: Framework-based Security & Compliance Security controls framework is: A comprehensive set of security controls (policies, procedures and technologies) Based upon industry-wide best practices Ideal for defining controls that should be applied in proactive manner Integrated into an organization s IT security policy Applied based upon how data are classified within your organization Security controls framework helps: Drive you to think about all security requirements needed Eliminate gaps in your security programs Enable more cost-effective compliance Execute your Information Risk Management strategy Most [CISOs] have realized that a principles-based framework can help them not only address multiple regulations simultaneously, but also get a more comprehensive grasp on the security universe they are responsible for. Khalid Kark Forrester Research Copyright 2008 EMC Corporation. All rights reserved. 12
13 Framework-Based Compliance & Security Laying A Foundation for Policy & Controls Many references ISO Information Technology Infrastructure Library (ITIL) Control Objectives for Information Technology (CoBIT) Committee of Sponsoring Organizations of the Treadway Commission (COSO) ISO [27002] is generally acknowledged to be the golden standard for coverage of security domain information. (Burton Group) 4. Risk Assessment and Treatment 5. Security Policy 6. Organization of Information Security 7. Asset Management 8. Human Resources Security 9. Physical Security 10. Communications and Ops Management 11. Access Control 12. Information Systems Acquisition, Development, Maintenance 13. Information Security Incident management 14. Business Continuity 15. Compliance ISO Clauses Copyright 2008 EMC Corporation. All rights reserved. 13
14 ISO & Compliance Alignment ISO Clauses Risk Assessment & Treatment Security Policy Organization of Information Security Asset Management Human Resources Management Physical & Environmental Security Communications and Operations Management Access Control NIST PCI SOX HIPAA Data Protection 12 Information Systems Acquisition, Development and Maintenance 13 Information Security Incident Management 14 Business Continuity Management 15 Compliance Copyright 2008 EMC Corporation. All rights reserved. 14
15 ISO & Compliance Alignment Key Best Practices Security policy (ISO ) Inventory of assets (ISO ) Information classification (ISO ) Physical entry control (ISO ) Segregation of duties (ISO ) Audit logging (ISO ) Monitoring system use (ISO ) User access management (ISO ) User identification and authentication (ISO ) Teleworking protection (ISO ) Cryptographic controls (ISO ) Data leakage prevention (ISO ) Compliance monitoring (ISO ) Sarbanes Oxley Copyright 2008 EMC Corporation. All rights reserved. 15
16 Framework-Based Security Communicating Security to Partners & Customers ISO and ISO 27002: Delivering a common language communicating security on a global basis Customers Outsourcers Business Partners Regulators Auditors Non-security staff Copyright 2008 EMC Corporation. All rights reserved. 16
17 Framework-Based Security Eliminating Gaps in Your Security Program Intellectual Property Health Records Financial Records Personal Information Credit Card Data Employee Records ISO Framework Patchwork Solutions Framework Based Solutions Comprehensive checklist Controls Holistic View of Security Copyright 2008 EMC Corporation. All rights reserved. 17
18 Aligning Compliance Case Study: Large Telco Result: Save Money, Time By Deploying Repeatable Controls for Multiple Requirements PCI Data Security Standard Sarbanes-Oxley Internal Policy Data Privacy Regulations Other Controls: Policies, Procedures and Technologies Access Control Logging Encryption Authentication Discover Data and Assets, and Assess Risk Based on Policy 4) Apply Controls in a Consistent and Repeatable Manner to Mitigate Risk & Manage Compliance 3) Discover Data, Assess Risk Internal Framework of Policies, Procedures & Technologies Other Security Controls Frameworks ISO ) Build a Framework of Best Practices Based Upon ISO Cardholder Data Financial Data Intellectual Property Copyright 2008 EMC Corporation. All rights reserved. 18 Personally Identifiable Info 1) Identify Sensitive Data Types
19 Components of Framework Based Compliance & Security Programs Inventory & Risk Assessment Policy & Classification Identify regulated data Analyze regulatory impact Identify high business impact data Qualify acceptable risk level for information Define information classifications Define information security policy Incorporate classification into policy Discovery Discover and document assets (people, systems & information) Discover and document current controls Implement Controls Monitor, Manage and Improve Define cross-organizational control requirements Implement controls (e.g., technologies, procedures) Monitor information environment Monitor & enforce compliance Incorporate risk analysis into mgt. processes Copyright 2008 EMC Corporation. All rights reserved. 19
20 Framework-Based Compliance & Security Why RSA? Inventory & Risk Assessment Policy & Classification Discovery Implement Controls Monitor, Manage and Improve Copyright 2008 EMC Corporation. All rights reserved. 20
21 A Process for Framework-Based Compliance RSA & EMC Solutions Inventory & Risk Assessment RSA Data Loss Prevention RSA Professional Services RSA Partners Policy & Classification RSA Professional Services RSA Partners Discovery RSA Data Loss Prevention RSA Professional Services Implement Controls Framework RSA Authentication & Authorization RSA Data Security RSA Information and Event Management EMC Information Management Solutions Monitor, Manage & Improve Copyright 2008 EMC Corporation. All rights reserved. 21 RSA Information and Event Management RSA Professional Services RSA Partners
22 ISO based Frameworks RSA Solutions Implement Controls Framework ISO Clauses 8 Human Resources Security 9 Physical & Environmental Security 11 Access Control RSA Authentication & Authorization RSA Data Security RSA Information and Event Management EMC Information Management Solutions Key ISO Best Practices Authenticate users Revoke access Control physical access Protect remote access Manage access based on policy RSA Solutions RSA SecurID RSA Access Manager RSA Card Manager RSA Digital Certificate Solutions Copyright 2008 EMC Corporation. All rights reserved. 22
23 What Do You Want for Your RSA SecurID Authenticator? Flexibility, choice, and broadest range supported applications Copyright 2008 EMC Corporation. All rights reserved. 23
24 ISO based Frameworks RSA Solutions Implement Controls Framework ISO Clauses 7 Asset Management 10 Communications & Operations Management 12 Information Systems Acquisition, Development & Maintenance 15 Compliance RSA Authentication & Authorization RSA Data Security RSA Information and Event Management EMC Information Management Solutions Key ISO Best Practices Inventory assets Classify data Prevent data leakage Manage encryption keys Enforce encryption policies Monitor for compliance RSA Solutions RSA Data Loss Prevention (DLP) Suite RSA File Security Manager RSA Key Manager for the Datacenter RSA Key Manager with Application Encryption Copyright 2008 EMC Corporation. All rights reserved. 24
25 Control Data Movement for Compliance: RSA Data Loss Prevention Suite Unified Policy Mgmt & Enforcement Incident Workflow DLP Enterprise Manager Dashboard & Reporting User & System Administration DLP Endpoint DLP Network DLP Datacenter Discover Laptops and desktops with Windows 2000 SP4 or higher OS Monitor (SMTP, IMAP), HTTP/S, FTP, P2P, IM/Chat, etc. Common Discovery Platform Discover File shares, eroom/sharepoint sites, Database files, SAN/NAS DLP Endpoint Copyright 2008 EMC Corporation. All rights reserved. 25
26 RSA DLP Comprehensive Compliance Library Acceptable Use 23 Policies including Post to Corporate Rumor Site Post to Financial Site Human Resources General Resumes Company Confidential 14 Policies including Mergers & Acquisitions Data Contracts Corporate Financials Employee Financials General Intellectual Property Protection 6 Policies including Company Intellectual Property Transmission of Intellectual Property to Competitor Patent Applications Regulatory Compliance 44 Policies including PCI-DSS (Payment Card Industry data Security Standard) PIPEDA (Personal Information Protection and Electronic Documents Act) GLBA (Gramm-Leach Bliley Act) HIPAA (Health Insurance Portability and Accountability Act) Fair Credit Reporting Act (FCRA) Privacy Protection 20 Policies including US Social Security Numbers Credit Card Numbers Credit Card Numbers - by Issuer US Drivers Licenses Canadian Social Insurance Numbers UK National Insurance Numbers Over 100+ out of the box policy templates (Blades) Copyright 2008 EMC Corporation. All rights reserved. 26
27 RSA Data Loss Prevention Suite: Enforce Compliance & Security Policy Unified Policy Mgmt & Enforcement Incident Workflow DLP Enterprise Manager Dashboard & Reporting User & System Administration DLP Endpoint DLP Network DLP Datacenter Discover Laptops and desktops with Windows 2000 SP4 or higher OS Enforce Copy, print, save, USB, burn, etc. Monitor (SMTP, IMAP), HTTP/S, FTP, P2P, IM/Chat, etc. Enforce Block, Notify, Alert, Encrypt Discover File shares, SharePoint sites, Database files, SAN/NAS Remediate Delete, quarantine, move Other DSS Enforcement Mechanisms 27 Copyright 2008 EMC Corporation. All rights reserved. 27
28 Managing Encryption for Compliance RSA Key Manager for the Datacenter Provides security over the long term Vaults and protects encryption keys Scales across the enterprise Centralized key management of encryption solutions across the IT stack Application Encryption PowerPath Encryption Connectrix Encryption Reduces cost and complexity over point key management solutions RSA Key Manager Server Tape Backup Encryption RSA File Security Manager File Encryption Database Encryption Copyright 2008 EMC Corporation. All rights reserved. 28
29 RSA Key Manager Provides Options While Reducing Complexity DR WAN Data warehouse WW Campuses Business Analytics Back up tape WWW WW Customers Customer Portal Production Data Disk storage WW Partners WAN Outsourced Development Staging Back up disk Remote Employees VPN Enterprise File Server Endpoint Network Applications Copyright 2008 EMC Corporation. All rights reserved. 29 Files Storage
30 RSA Key Manager Provides Options While Reducing Complexity WW Campuses WW Customers WW Partners Remote Employees WAN WWW WAN VPN Business Analytics RSA Key Manager Encryption Toolkit Customer Portal RSA Key Manager Encryption Toolkit Outsourced Development Enterprise DR FC SAN Encryption EMC Powerpath Data warehouse Cisco switches Brocade switches Oracle Production Data Oracle Staging FC SAN Encryption EMC Powerpath Disk storage Cisco switches Brocade switches RSA File Security File Manager Server Encrypting Tape Drives Back up tape Back up disk Endpoint Network Applications Copyright 2008 EMC Corporation. All rights reserved. 30 Files Storage
31 ISO based Frameworks RSA Solutions Implement Controls Framework ISO Clauses 10 Communications & Operations Management 13 Information Security Incident Management 15 Compliance RSA Authentication & Authorization RSA Data Security RSA Information and Event Management EMC Information Management Solutions Key ISO Best Practices Monitor IT systems Monitor systems usage Protect audit logs Protect audit tools Report & learn from security events Retain evidence of security events Monitor for compliance RSA Solution RSA envision Copyright 2008 EMC Corporation. All rights reserved. 31
32 Monitoring and Reporting for Compliance RSA envision Malicious Code Detection Spyware detection Access Control Enforcement Privileged User Management Real-Time Monitoring Troubleshooting Configuration Control Lockdown enforcement Compliance Monitoring IP Leakage False Positive Reduction User Monitoring Web server activity logs Web cache & proxy logs Content management logs SLA Monitoring Switch logs IDS/IDP logs VA Scan logs Router logs Windows domain logins Wireless access logs Oracle Financial Logs Windows logs VPN logs Firewall logs Linux, Unix, Windows OS logs Mainframe logs DHCP logs Client & file server logs San File Access Logs VLAN Access & Control logs Database Logs Copyright 2008 EMC Corporation. All rights reserved. 32
33 Security Information and Event Management Solution: RSA envision 3-in-1 Log Mgmt Platform for Compliance, Security and IT & Network Operations Copyright 2008 EMC Corporation. All rights reserved. 33
34 Security Information and Event Management Solution: RSA envision 3-in-1 Log Mgmt Platform Server Engineering Business Ops. Compliance Audit Risk Mgmt. Security Ops. Desktop Ops. Network Ops. Application & Database Baseline Report Alert/Correlation Asset Mgt. Simplify Log Mgmt. Compliance Access Control Configuration Control Malicious Software Policy Enforcements User Monitoring & Management Environmental & Transmission Security Enhance Security & Mitigate Risk Access Control Enforcement SLA Compliance Monitoring False Positive Reduction Real-time Alerts Unauthorized Network Service Detection Privileged User Monitoring All the Data Log Management Any enterprise IP device Universal Device Support (UDS) No filtering, normalizing, or data reduction Security events & operational information No agents required Forensics Optimize IT & Network Operations Incident Mgmt. Monitor network assets Troubleshoot network issues Assist with Helpdesk operations Optimize network performance Gain visibility into user behavior Build baseline of normal network activity for Compliance, Security and IT & Network Operations Copyright 2008 EMC Corporation. All rights reserved. 34
35 RSA envision Transformation of Data into Actionable Intelligence Dashboards >1100 reports for regulatory compliance & security operations >Includes ISO compliance reporting Copyright 2008 EMC Corporation. All rights reserved. 35
36 ISO based Compliance Frameworks RSA Solutions RSA envision reporting Over 20 out-of-the-box reports related to ISO 27002, including: Control of Human Resources Data (section 8.3) External Contractors Report (sections 8.1.3, ) Malicious Software Activity (section ) Password Changes and Expirations (section ) User Activity from External Domains (section ) Computer Account Logon Activity (section 11.5.B) Computer Account Status by Account (section ) Operation Change Control Report (section 11.6) Control of Operational Software (section ) Control of System Test Data (section ) Source Code Access (section ) Control of Collected Evidence (section 13.2) Control of System Audit Data (section ) Inventory & Risk Assessment Policy & Classification Discovery Implement Controls Monitor, Manage and Improve Copyright 2008 EMC Corporation. All rights reserved. 36
37 Compliance Framework Solutions Example PCI Requirements Mapped to RSA/EMC Solutions Card Data Discovery PCI Pre-Assessment & Gap Analysis Req. 1: Install and maintain a firewall Req. 2: Do not use default passwords Req. 3: Protect stored card data Req. 4: Encrypt card data in transit Req. 5: Use and update anti-virus Req. 6: Develop secure systems & apps Req. 7: Restrict access to card data Req. 8: Assign a unique ID Req. 9: Restrict physical access Req. 10: Track and monitor access Req. 11: Test security systems, processes Req. 12: Maintain an info sec policy Understanding Your PCI Compliance and Preparing for an Audit PCI Cardholder Data Discovery Service PCI Pre-Assessment & Gap Analysis Service Addressing PCI DSS Requirements EMC Smarts, EMC VoyenceControl reporting: RSA envision EMC Smarts, EMC VoyenceControl reporting: RSA envision Application Security Design and Assessment Service Reporting: EMC VoyenceControl RSA SecurID, RSA Digital Certificates reporting: RSA envision EMC Physical Security Solution, RSA Card Manager PCI Information Security Policy Service Copyright 2008 EMC Corporation. All rights reserved. 37 RSA Key Manager, RSA File Security Manager, RSA DLP Suite, Partners (e.g., Cisco) reporting: RSA envision RSA Key Manager, CipherOptics (partner), EMC VoyenceControl reporting: RSA envision reporting: RSA envision, EMC Smarts, EMC VoyenceControl RSA Access Manager, RSA File Security Manager, RSA Database Security Manager reporting: RSA envision RSA envision, EMC Symmetrix, EMC CLARiiON, EMC Centera, EMC Celera, EMC Smarts, EMC Voyence Control EMC Smarts, EMC VoyenceControl Partners: Accuvant (U.S.), Ezenta (EMEA), Integralis (EMEA, U.S.), Mnemonic (EMEA), Remington (U.S.)
38 Framework-Based Compliance & Security The Benefits Reduce costs Simplify compliance Improve security Manage information risk Questions? Direct: Thank you very much Copyright 2008 EMC Corporation. All rights reserved. 38
39
An Introduction to SIEM & RSA envision (Security Information and Event Management) January, 2011
An Introduction to SIEM & RSA envision (Security Information and Event Management) January, 2011 Brian McLean, CISSP Sr Technology Consultant, RSA Changing Threats and More Demanding Regulations External
RSA SIEM and DLP Infrastructure and Information Monitoring in One Solution
RSA SIEM and DLP Infrastructure and Information Monitoring in One Solution David Mateju RSA Sales Consultant, RSA CSE david.mateju@rsa.com Adding an information-centric view Infrastructure Information
An Introduction to RSA envision The Information Log Management Platform for Security and Compliance Success. September, 2009
An Introduction to RSA envision The Information Log Management Platform for Security and Compliance Success September, 2009 Changing Threats and More Demanding Regulations External attacks Malicious insiders
Kelvin Wee CISA, CISM, CISSP Principal Consultant (DLP Specialist) Asia Pacific and Japan
The Truth about Data Loss Kelvin Wee CISA, CISM, CISSP Principal Consultant (DLP Specialist) Asia Pacific and Japan RSA Data Loss Prevention Data Breaches Overview RSA DLP Solution Five Critical Factors
RSA Solution Brief RSA. Data Loss. Uncover your risk, establish control. RSA. Key Manager. RSA Solution Brief
RSA Solution Brief RSA Managing Data Loss the Lifecycle of Prevention Encryption Suite Keys with Uncover your risk, establish control. RSA Key Manager RSA Solution Brief 1 Executive Summary RSA Data Loss
RSA Data Loss Prevention (DLP) Understand business risk and mitigate it effectively
RSA Data Loss Prevention (DLP) Understand business risk and mitigate it effectively Arrow ECS DLP workshop, Beograd September 2011 Marko Pust marko.pust@rsa.com 1 Agenda DLP in general What to expect from
EMC CONSULTING SECURITY STANDARDS AND COMPLIANCE SERVICES
EMC CONSULTING SECURITY STANDARDS AND COMPLIANCE SERVICES Aligning information with business and operational objectives ESSENTIALS Leverage EMC Consulting as your trusted advisor to move your and compliance
with Managing RSA the Lifecycle of Key Manager RSA Streamlining Security Operations Data Loss Prevention Solutions RSA Solution Brief
RSA Solution Brief Streamlining Security Operations with Managing RSA the Lifecycle of Data Loss Prevention and Encryption RSA envision Keys with Solutions RSA Key Manager RSA Solution Brief 1 Who is asking
I n f o r m a t i o n S e c u r i t y
We help organizations protect INFORMATION The BorderHawk Team has significant experience assessing, analyzing, and designing information protection programs especially in Critical Infrastructure environments.
Information Risk Management. Alvin Ow Director, Technology Consulting Asia Pacific & Japan RSA, The Security Division of EMC
Information Risk Management Alvin Ow Director, Technology Consulting Asia Pacific & Japan RSA, The Security Division of EMC Agenda Data Breaches Required Capabilities of preventing Data Loss Information
Enterprise Database Security & Monitoring: Guardium Overview
Enterprise Database Security & Monitoring: Guardium Overview Phone: 781.487.9400 Email: info@guardium.com Guardium: Market-Proven Leadership Vision Enterprise platform for securing critical data across
How To Manage Security On A Networked Computer System
Unified Security Reduce the Cost of Compliance Introduction In an effort to achieve a consistent and reliable security program, many organizations have adopted the standard as a key compliance strategy
Security Information and Event Management Introduction to envision: The Information Management Platform for Security and Compliance Operations Success
Security Information and Event Management Introduction to envision: The Information Management Platform for Security and Compliance Operations Success Copyright 2008 EMC Corporation. All rights reserved.
Fortinet Solutions for Compliance Requirements
s for Compliance Requirements Sarbanes Oxley (SOX / SARBOX) Section / Reference Technical Control Requirement SOX references ISO 17799 for Firewall FortiGate implementation specifics IDS / IPS Centralized
A Websense Research Brief Prevent Data Loss and Comply with Payment Card Industry Data Security Standards
A Websense Research Brief Prevent Loss and Comply with Payment Card Industry Security Standards Prevent Loss and Comply with Payment Card Industry Security Standards Standards for Credit Card Security
What IT Auditors Need to Know About Secure Shell. SSH Communications Security
What IT Auditors Need to Know About Secure Shell SSH Communications Security Agenda Secure Shell Basics Security Risks Compliance Requirements Methods, Tools, Resources What is Secure Shell? A cryptographic
More Expenses. Only this time the Telegraph will have to pay them after their recent data breech
More Expenses Only this time the Telegraph will have to pay them after their recent data breech What is an Identity? Wiki Definition Digital identity refers to the aspect of digital technology that is
Auditing Mission-Critical Databases for Regulatory Compliance
Auditing Mission-Critical Databases for Regulatory Compliance Agenda: It is not theoretical Regulations and database auditing Requirements and best practices Summary Q & A It is not theoretical Database
IT Best Practices Audit TCS offers a wide range of IT Best Practices Audit content covering 15 subjects and over 2200 topics, including:
IT Best Practices Audit TCS offers a wide range of IT Best Practices Audit content covering 15 subjects and over 2200 topics, including: 1. IT Cost Containment 84 topics 2. Cloud Computing Readiness 225
Eoin Thornton Senior Security Architect Zinopy Security Ltd.
RSA envision: Transform your Security Operations A Technical overview & demo of RSA envision The Information Log Management Platform for Security and Compliance Success Eoin Thornton Senior Security Architect
Information Security Policy and Handbook Overview. ITSS Information Security June 2015
Information Security Policy and Handbook Overview ITSS Information Security June 2015 Information Security Policy Control Hierarchy System and Campus Information Security Policies UNT System Information
Security Controls What Works. Southside Virginia Community College: Security Awareness
Security Controls What Works Southside Virginia Community College: Security Awareness Session Overview Identification of Information Security Drivers Identification of Regulations and Acts Introduction
How To Achieve Pca Compliance With Redhat Enterprise Linux
Achieving PCI Compliance with Red Hat Enterprise Linux June 2009 CONTENTS EXECUTIVE SUMMARY...2 OVERVIEW OF PCI...3 1.1. What is PCI DSS?... 3 1.2. Who is impacted by PCI?... 3 1.3. Requirements for achieving
RSA Solution Brief RSA. Encryption and Key Management Suite. RSA Solution Brief
RSA Encryption and Key Management Suite The threat of experiencing a data breach has never been greater. According to the Identity Theft Resource Center, since the beginning of 2008, the personal information
Maintaining PCI-DSS compliance. Daniele Bertolotti daniele_bertolotti@symantec.com Antonio Ricci antonio_ricci@symantec.com
Maintaining PCI-DSS compliance Daniele Bertolotti daniele_bertolotti@symantec.com Antonio Ricci antonio_ricci@symantec.com Sessione di Studio Milano, 21 Febbraio 2013 Agenda 1 Maintaining PCI-DSS compliance
SANS Top 20 Critical Controls for Effective Cyber Defense
WHITEPAPER SANS Top 20 Critical Controls for Cyber Defense SANS Top 20 Critical Controls for Effective Cyber Defense JANUARY 2014 SANS Top 20 Critical Controls for Effective Cyber Defense Summary In a
Adopt a unified, holistic approach to a broad range of data security challenges with IBM Data Security Services.
Security solutions To support your IT objectives Adopt a unified, holistic approach to a broad range of data security challenges with IBM Data Security Services. Highlights Balance effective security with
PCI Compliance for Cloud Applications
What Is It? The Payment Card Industry Data Security Standard (PCIDSS), in particular v3.0, aims to reduce credit card fraud by minimizing the risks associated with the transmission, processing, and storage
Information Security Risk Assessment Checklist. A High-Level Tool to Assist USG Institutions with Risk Analysis
Information Security Risk Assessment Checklist A High-Level Tool to Assist USG Institutions with Risk Analysis Updated Oct 2008 Introduction Information security is an important issue for the University
Splunk Enterprise Log Management Role Supporting the ISO 27002 Framework EXECUTIVE BRIEF
Splunk Enterprise Log Management Role Supporting the ISO 27002 Framework EXECUTIVE BRIEF Businesses around the world have adopted the information security standard ISO 27002 as part of their overall risk
Did you know your security solution can help with PCI compliance too?
Did you know your security solution can help with PCI compliance too? High-profile data losses have led to increasingly complex and evolving regulations. Any organization or retailer that accepts payment
Real-Time Database Protection and. Overview. 2010 IBM Corporation
Real-Time Database Protection and Monitoring: IBM InfoSphere Guardium Overview Agenda Business drivers for database security InfoSphere Guardium architecture Common applications The InfoSphere portfolio
How To Get Your Computer To Comply With Pca
Assessing PCI Compliance with EMC Software Solutions Glenn O Donnell Principal Product Marketing Manager Resource Management Software Group Email: odonnell_glenn@emc.com Service Management Soapbox Blog:
3rd Party Assurance & Information Governance 2014-2016 outlook IIA Ireland Annual Conference 2014. Straightforward Security and Compliance
3rd Party Assurance & Information Governance 2014-2016 outlook IIA Ireland Annual Conference 2014 Continuous Education Services (elearning/workshops) Compliance Management Portals Information Security
<Insert Picture Here> Oracle Database Security Overview
Oracle Database Security Overview Tammy Bednar Sr. Principal Product Manager tammy.bednar@oracle.com Data Security Challenges What to secure? Sensitive Data: Confidential, PII, regulatory
Altius IT Policy Collection Compliance and Standards Matrix
Governance IT Governance Policy Mergers and Acquisitions Policy Terms and Definitions Policy 164.308 12.4 12.5 EDM01 EDM02 EDM03 Information Security Privacy Policy Securing Information Systems Policy
Chapter 1 The Principles of Auditing 1
Chapter 1 The Principles of Auditing 1 Security Fundamentals: The Five Pillars Assessment Prevention Detection Reaction Recovery Building a Security Program Policy Procedures Standards Security Controls
Security Controls in Service Management
Interested in learning more about security? SANS Institute InfoSec Reading Room This paper is from the SANS Institute Reading Room site. Reposting is not permitted without express written permission. Security
Information Technology Solutions
Managed Services Information Technology Solutions A TBG Security Professional Services Offering LET TBG MANAGE YOUR INFRASTRUCTURE WITH CONFIDENCE: TBG S INTEGRATED IT AUTOMATION FRAMEWORK PROVIDES: Computer
Using Data Loss Prevention for Financial Institutions Banks, Credit Unions, Payments
Using Data Loss Prevention for Financial Institutions Banks, Credit Unions, Payments How Data Loss Prevention (DLP) Technology can Protect Sensitive Company & Customer Information and Meet Compliance Requirements,
Enabling Security Operations with RSA envision. August, 2009
Enabling Security Operations with RSA envision August, 2009 Agenda What is security operations? How does RSA envision help with security operations? How does RSA envision fit with other EMC products? If
March 2012 www.tufin.com
SecureTrack Supporting Compliance with PCI DSS 2.0 March 2012 www.tufin.com Table of Contents Introduction... 3 The Importance of Network Security Operations... 3 Supporting PCI DSS with Automated Solutions...
Intrusion Detection and Threat Vectors Michael Arent EDS-Global Information Security
Insert photo here Intrusion Detection and Threat Vectors Michael Arent EDS-Global Information Security 1 / 07 May 2008 / EDS The direction is changing.... 2 / 07 May 2008 / EDS Intrusion costs are rising
PCI DSS. Get Compliant, Stay Compliant Seminar
PCI DSS Get Compliant, Stay Compliant Seminar ValueSYS Solutions & Services Wael Hosny CEO ValueSYS Wael.hosny@valuesys.net Solutions you Need, with Quality you Deserve Seminar Agenda Time 09:00 10:00
INFORMATION SYSTEMS. Revised: August 2013
Revised: August 2013 INFORMATION SYSTEMS In November 2011, The University of North Carolina Information Technology Security Council [ITSC] recommended the adoption of ISO/IEC 27002 Information technology
08/10/2013. Data protection and compliance. Agenda. Data protection life cycle and goals. Introduction. Data protection overview
Data protection and compliance In the cloud and in your data center 1 November 2013 Agenda 1 Introduction 2 Data protection overview 3 Understanding the cloud 4 Where do I start? 5 Wrap-up Page 2 Data
Websense Data Security Solutions
Data Security Suite Data Discover Data Monitor Data Protect Data Endpoint Data Security Solutions What is your confidential data and where is it stored? Who is using your confidential data and how? Protecting
Microsoft s Compliance Framework for Online Services
Microsoft s Compliance Framework for Online Services Online Services Security and Compliance Executive summary Contents Executive summary 1 The changing landscape for online services compliance 4 How Microsoft
What s Wrong with Information Security Today? You are looking in the wrong places for the wrong things.
What s Wrong with Information Security Today? You are looking in the wrong places for the wrong things. AGENDA Current State of Information Security Data Breach Statics Data Breach Case Studies Why current
BIO Safety - Tips For Maintaining Good Compliance
Using SIEM for Compliance Adrian Lane Security Strategist Securosis.com Overview SIM/SEM Introduction Compliance Initiatives Implementation Examples Tips Other Considerations Evolution of Terminology SIM
Enforcive / Enterprise Security
TM Enforcive / Enterprise Security End to End Security and Compliance Management for the IBM i Enterprise Enforcive / Enterprise Security is the single most comprehensive and easy to use security and compliance
Information & Asset Protection with SIEM and DLP
Information & Asset Protection with SIEM and DLP Keeping the Good Stuff in and the Bad Stuff Out Professional Services: Doug Crich Practice Leader Infrastructure Protection Solutions What s driving the
White paper. Information Risk Management for Healthcare Organizations. Six Best Practices for Protecting Your Health Information
White paper Information Risk Management for Healthcare Organizations Six Best Practices for Protecting Your Health Information Nearly 220 million electronic records have been breached since January 2005.
IBM Data Security Services for endpoint data protection endpoint data loss prevention solution
Automating policy enforcement to prevent endpoint data loss IBM Data Security Services for endpoint data protection endpoint data loss prevention solution Highlights Facilitate policy-based expertise and
Automating Cloud Security Control and Compliance Enforcement for PCI DSS 3.0
WHITE PAPER Automating Cloud Security Control and Compliance Enforcement for 3.0 How Enables Security and Compliance with the PCI Data Security Standard in a Private Cloud EXECUTIVE SUMMARY All merchants,
whitepaper The Benefits of Integrating File Integrity Monitoring with SIEM
The Benefits of Integrating File Integrity Monitoring with SIEM Security Information and Event Management (SIEM) is designed to provide continuous IT monitoring, actionable intelligence, incident response,
End-user Security Analytics Strengthens Protection with ArcSight
Case Study for XY Bank End-user Security Analytics Strengthens Protection with ArcSight INTRODUCTION Detect and respond to advanced persistent threats (APT) in real-time with Nexthink End-user Security
White Paper. Managing Risk to Sensitive Data with SecureSphere
Managing Risk to Sensitive Data with SecureSphere White Paper Sensitive information is typically scattered across heterogeneous systems throughout various physical locations around the globe. The rate
MySQL Security: Best Practices
MySQL Security: Best Practices Sastry Vedantam sastry.vedantam@oracle.com Safe Harbor Statement The following is intended to outline our general product direction. It is intended for information purposes
Observations from the Trenches
Observations from the Trenches CSO Breakfast Club Retail and PCI Security Forum May 2010 Olivia Rose Jenkins, CISSP, QSA Sr. Security Consultant Agenda Conversations with CXO s PCI and Your Security Program
Information Technology Branch Access Control Technical Standard
Information Technology Branch Access Control Technical Standard Information Management, Administrative Directive A1461 Cyber Security Technical Standard # 5 November 20, 2014 Approved: Date: November 20,
Mitigating the Risks of Privilege-based Attacks in Federal Agencies
WHITE PAPER Mitigating the Risks of Privilege-based Attacks in Federal Agencies Powerful compliance and risk management solutions for government agencies 1 Table of Contents Your networks are under attack
HIPAA Compliance Evaluation Report
Jun29,2016 HIPAA Compliance Evaluation Report Custom HIPAA Risk Evaluation provided for: OF Date of Report 10/13/2014 Findings Each section of the pie chart represents the HIPAA compliance risk determinations
Cyberoam Perspective BFSI Security Guidelines. Overview
Overview The term BFSI stands for Banking, Financial Services and Insurance (BFSI). This term is widely used to address those companies which provide an array of financial products or services. Financial
Compliance and Security Information Management for PCI DSS Requirement 10 and Beyond
RSA Solution Brief Compliance and Security Information Management for PCI DSS Requirement 10 and Beyond Through Requirement 10, PCI DSS specifically requires that merchants, banks and payment processors
whitepaper Ten Essential Steps for Achieving Continuous Compliance: A Complete Strategy for Compliance
Ten Essential Steps for Achieving Continuous Compliance: A Complete Strategy for Compliance Table of Contents 3 10 Essential Steps 3 Understand the Requirements 4 Implement IT Controls that Affect your
What s New in PCI DSS 2.0. 2010 Cisco and/or its affiliates. All rights reserved. Cisco Systems, Inc 1
What s New in PCI DSS 2.0 2010 Cisco and/or its affiliates. All rights reserved. Cisco Systems, Inc 1 Agenda PCI Overview PCI 2.0 Changes PCI Advanced Technology Update PCI Solutions 2010 Cisco and/or
We are Passionate about Total Security Management Architecture & Infrastructure Optimisation Review
We are Passionate about Total Security Management Architecture & Infrastructure Optimisation Review The security threat landscape is constantly changing and it is important to periodically review a business
By: Gerald Gagne. Community Bank Auditors Group Cybersecurity What you need to do now. June 9, 2015
Community Bank Auditors Group Cybersecurity What you need to do now June 9, 2015 By: Gerald Gagne MEMBER OF PKF NORTH AMERICA, AN ASSOCIATION OF LEGALLY INDEPENDENT FIRMS 2015 Wolf & Company, P.C. Cybersecurity
Unified Security Anywhere HIPAA COMPLIANCE ACHIEVING HIPAA COMPLIANCE WITH MASERGY PROFESSIONAL SERVICES
Unified Security Anywhere HIPAA COMPLIANCE ACHIEVING HIPAA COMPLIANCE WITH MASERGY PROFESSIONAL SERVICES HIPAA COMPLIANCE Achieving HIPAA Compliance with Security Professional Services The Health Insurance
Log Management How to Develop the Right Strategy for Business and Compliance. Log Management
Log Management How to Develop the Right Strategy for Business and Compliance An Allstream / Dell SecureWorks White Paper 1 Table of contents Executive Summary 1 Current State of Log Monitoring 2 Five Steps
ForeScout CounterACT and Compliance June 2012 Overview Major Mandates PCI-DSS ISO 27002
ForeScout CounterACT and Compliance An independent assessment on how network access control maps to leading compliance mandates and helps automate GRC operations June 2012 Overview Information security
The Firewall Audit Checklist Six Best Practices for Simplifying Firewall Compliance and Risk Mitigation
The Firewall Audit Checklist Six Best Practices for Simplifying Firewall Compliance and Risk Mitigation Copyright, AlgoSec Inc. All rights reserved The Need to Ensure Continuous Compliance Regulations
SecureGRC TM - Cloud based SaaS
- Cloud based SaaS Single repository for regulations and standards Centralized repository for compliance related organizational data Electronic workflow to speed up communications between various entries
INCIDENT RESPONSE CHECKLIST
INCIDENT RESPONSE CHECKLIST The purpose of this checklist is to provide clients of Kivu Consulting, Inc. with guidance in the initial stages of an actual or possible data breach. Clients are encouraged
SecureVue Product Brochure
SecureVue unifies next-generation SIEM, security configuration auditing, compliance automation and contextual forensic analysis into a single platform, delivering situational awareness, operational efficiency
EMC Security for Microsoft Exchange Solution: Data Loss Prevention and Secure Access Management
EMC Security for Microsoft Exchange Solution: Data Loss Prevention and Applied Technology Abstract Securing a Microsoft Exchange e-mail environment presents a myriad of challenges and compliance issues
QRadar SIEM 6.3 Datasheet
QRadar SIEM 6.3 Datasheet Overview Q1 Labs flagship solution QRadar SIEM is unrivaled in its ability to provide an organization centralized IT security command and control. The unique capabilities of QRadar
IT Security & Compliance. On Time. On Budget. On Demand.
IT Security & Compliance On Time. On Budget. On Demand. IT Security & Compliance Delivered as a Service For businesses today, managing IT security risk and meeting compliance requirements is paramount
White paper. 6 Best Practices for Preventing Enterprise Data Loss
White paper 6 Best Practices for Preventing Enterprise Data Loss 'Enterprise data loss' cost businesses nearly $105 billion last year Nearly 220 million records have been breached since January 2005, according
How To Manage A Privileged Account Management
Four Best Practices for Passing Privileged Account Audits October 2014 1 Table of Contents... 4 1. Discover All Privileged Accounts in Your Environment... 4 2. Remove Privileged Access / Implement Least
McAfee Data Protection Solutions
McAfee Data Protection Solutions Tamas Barna System Engineer CISSP, Security+ Eastern Europe The Solution: McAfee Data Protection McAfee Data Loss Prevention Full control and absolute visibility over user
Security solutions White paper. Acquire a global view of your organization s security state: the importance of security assessments.
Security solutions White paper Acquire a global view of your organization s security state: the importance of security assessments. April 2007 2 Contents 2 Overview 3 Why conduct security assessments?
Automate PCI Compliance Monitoring, Investigation & Reporting
Automate PCI Compliance Monitoring, Investigation & Reporting Reducing Business Risk Standards and compliance are all about implementing procedures and technologies that reduce business risk and efficiently
State of South Carolina Policy Guidance and Training
State of South Carolina Policy Guidance and Training Policy Workshop All Agency Mobile Security July 2014 Agenda Questions & Follow-Up Policy Workshop Overview & Timeline Policy Overview: Mobile Security
Larry Wilson Version 1.0 November, 2013. University Cyber-security Program Critical Asset Mapping
Larry Wilson Version 1.0 November, 2013 University Cyber-security Program Critical Asset Mapping Part 3 - Cyber-Security Controls Mapping Cyber-security Controls mapped to Critical Asset Groups CSC Control
Vulnerability. Management
Solutions.01 Vulnerability Management.02 Enterprise Security Monitoring.03 Log Analysis & Management.04 Network Access Control.05 Compliance Monitoring Rewterz provides a diverse range of industry centric
74% 96 Action Items. Compliance
Compliance Report PCI DSS 2.0 Generated by Check Point Compliance Blade, on July 02, 2013 11:12 AM 1 74% Compliance 96 Action Items Upcoming 0 items About PCI DSS 2.0 PCI-DSS is a legal obligation mandated
IT ASSET MANAGEMENT Securing Assets for the Financial Services Sector
IT ASSET MANAGEMENT Securing Assets for the Financial Services Sector V.2 Final Draft May 1, 2014 financial_nccoe@nist.gov This revision incorporates comments from the public. Page Use case 1 Comments
Compliance Doesn t Mean Security Achieving Security and Compliance with the latest Regulations and Standards
Compliance Doesn t Mean Security Achieving Security and Compliance with the latest Regulations and Standards Paul de Graaff Chief Strategy Officer Vanguard Integrity Professionals March 11, 2014 Session
How To Secure A Database From A Leaky, Unsecured, And Unpatched Server
InfoSphere Guardium Ingmārs Briedis (ingmars.briedis@also.com) IBM SW solutions Agenda Any questions unresolved? The Guardium Architecture Integration with Existing Infrastructure Summary Any questions
Security Information Lifecycle
Security Information Lifecycle By Eric Ogren Security Analyst, April 2006 Copyright 2006. The, Inc. All Rights Reserved. Table of Contents Executive Summary...2 Figure 1... 2 The Compliance Climate...4
MIT s Information Security Program for Protecting Personal Information Requiring Notification. (Revision date: 2/26/10)
MIT s Information Security Program for Protecting Personal Information Requiring Notification (Revision date: 2/26/10) Table of Contents 1. Program Summary... 3 2. Definitions... 4 2.1 Identity Theft...
Empowering Your Business in the Cloud Without Compromising Security
Empowering Your Business in the Cloud Without Compromising Security Cloud Security Fabric CloudLock offers the cloud security fabric for the enterprise that helps organizations protect their sensitive
Obtaining Value from Your Database Activity Monitoring (DAM) Solution
Obtaining Value from Your Database Activity Monitoring (DAM) Solution September 23, 2015 Mike Miller Chief Security Officer Integrigy Corporation Stephen Kost Chief Technology Officer Integrigy Corporation
PCI COMPLIANCE REQUIREMENTS COMPLIANCE CALENDAR
PCI COMPLIANCE REQUIREMENTS COMPLIANCE CALENDAR AUTHOR: UDIT PATHAK SENIOR SECURITY ANALYST udit.pathak@niiconsulting.com Public Network Intelligence India 1 Contents 1. Background... 3 2. PCI Compliance
<Insert Picture Here> How to protect sensitive data, challenges & risks
How to protect sensitive data, challenges & risks Lars Klumpes CISSP Security Strategy Consultant EMEA Disclaimer The following is intended to outline our general product direction.
PCI Data Security Standards (DSS)
ENTERPRISE APPLICATION WHITELISTING SOLUTION Achieving PCI Compliance at the Point of Sale Using Bit9 Parity TM to Protect Cardholder Data PCI: Protecting Cardholder Data As the technology used by merchants
CHIS, Inc. Privacy General Guidelines
CHIS, Inc. and HIPAA CHIS, Inc. provides services to healthcare facilities and uses certain protected health information (PHI) in connection with performing these services. Therefore, CHIS, Inc. is classified
Enterprise Security Solutions
Enterprise Security Solutions World-class technical solutions, professional services and training from experts you can trust ISOCORP is a Value-Added Reseller (VAR) and services provider for best in class