Enterprise Security Architecture for Cyber Security. M.M.Veeraragaloo 5 th September 2013
|
|
|
- Raymond James
- 10 years ago
- Views:
Transcription
1 Enterprise Security Architecture for Cyber Security M.M.Veeraragaloo 5 th September 2013
2 Outline Cyber Security Overview TOGAF and Sherwood Applied Business Security Architecture (SABSA) o o Overview of SABSA Integration of TOGAF and SABSA Enterprise Security Architecture Framework The Open Group EA Practitioners Conference - Johannesburg
3 Cyber Security 1. What is Cyber Security? 2. How is Cyber Security related to information security? 3. How do I protect my company from malicious attacks? "Cyber Security is to be free from danger or damage caused by disruption or fall-out of ICT or abuse of ICT. The danger or the damage due to abuse, disruption or fall-out can be comprised of a limitation of the availability and reliability of the ICT, breach of the confidentiality of information stored in ICT or damage to the integrity of that information. (The National Cyber Security Strategy 2011, Dutch Ministry of Security and Justice) Information security - the "preservation of confidentiality, integrity and availability of information" (ISO/IEC 27001:2005); The Four Types of Security Incidents 1. Natural Disaster 2. Malicious Attack (External Source) 3. Internal Attack 4. Malfunction and Unintentional Human Error 3
4 Cyber Security in Perspective No official position about the differences between Cyber Security and Information Security Risk Management (ISO/IEC 27001:2005); Information Security ISO/IEC 2700:2009 Business Continuity (BS :2007). Cyber Security Information Technology Source: 9 Steps to Cyber Security The Manager s Information Security Strategy Manual (Dejan Kosutic) The Open Group EA Practitioners Conference - Johannesburg
5 Cyber Security in South Africa Source: SA-2012-cyber-threat (Wolf Pack) [ 2012/2013 The South African Cyber Threat Barometer] 5
6 TOGAF & SABSA Footer Text 9/9/2013 6
7 SABSA Overview Footer Text 9/9/2013 7
8 SABSA Meta Model The Open Group EA Practitioners Conference - Johannesburg
9 SABSA Matrix The Open Group EA Practitioners Conference - Johannesburg
10 SABSA Life Cycle In the SABSA Lifecycle, the development of the contextual and conceptual layers is grouped into an activity called Strategy & Planning. This is followed by an activity called Design, which embraces the design of the logical, physical, component, and service management architectures. The third activity is Implement, followed by Manage & Measure. The significance of the Manage & Measure activity is that once the system is operational, it is essential to measure actual performance against targets, to manage any deviations observed, and to feed back operational experience into the iterative architectural development process. The Open Group EA Practitioners Conference - Johannesburg
11 SABSA Taxonomy of ICT Business Attributes The Open Group EA Practitioners Conference - Johannesburg
12 SABSA Taxonomy of General Business Attributes The Open Group EA Practitioners Conference - Johannesburg
13 SABSA Operational Risk Model The Open Group EA Practitioners Conference - Johannesburg
14 SABSA integrated with TOGAF Footer Text 9/9/
15 A Central Role for Requirements Management Linking the Business Requirements (Needs) to the Security Services which TOGAF does in the Requirements Management Phase and SABSA does via the Business Attributes Profile. These Artefacts needs to be linked to ensure traceability from Business Needs to Security Services. The Open Group EA Practitioners Conference - Johannesburg
16 Requirements Management in TOGAF using SABSA Business Attribute Profiling Business Attribute Profiling: This describes the level of protection required for each business capability. Requirements Catalog: This stores the architecture requirements of which security requirements form an integral part. The Business Attribute Profile can form the basis for all quality requirements (including security requirements) and therefore has significant potential to fully transform the current TOGAF requirements management approach. Business and Information System Service Catalogs: TOGAF defines a business service catalog (in Phase B: Business Architecture) and an information system service catalog (Phase C: Information Systems Architecture). The creation of the information system services in addition to the core concept of business services is intended to allow more sophisticated modelling of the service portfolio. The Security Service Catalog: As defined by the SABSA Logical Layer, this will form an integral part of the TOGAF Information System Service Catalogs. The Open Group EA Practitioners Conference - Johannesburg
17 The Business Attribute Profile Mapped onto the TOGAF Content Meta Model The Open Group EA Practitioners Conference - Johannesburg
18 SABSA Life Cycle and TOGAF ADM The Open Group EA Practitioners Conference - Johannesburg
19 Mapping TOGAF and SABSA Abstraction Layers The Open Group EA Practitioners Conference - Johannesburg
20 Mapping of TOGAF to SABSA Strategy and Planning Phase As the SABSA phases extend beyond the core phases of the TOGAF ADM, the scoping provided by the SABSA Domain Model extends beyond these core phases of TOGAF, both in terms of solution design and system and process management during the operational lifecycle. The Open Group EA Practitioners Conference - Johannesburg
21 Overview of Security Related Artifacts in the TOGAF ADM The Open Group EA Practitioners Conference - Johannesburg
22 Preliminary Phase Security Artifacts The Open Group EA Practitioners Conference - Johannesburg
23 Phase A - Architecture Vision Security Artifacts The Open Group EA Practitioners Conference - Johannesburg
24 Phase B Business Architecture Security Artifacts The Open Group EA Practitioners Conference - Johannesburg
25 Phase C Information Systems Architecture Security Artifacts The Open Group EA Practitioners Conference - Johannesburg
26 Phase D Technology Architecture Security Artifacts The Open Group EA Practitioners Conference - Johannesburg
27 Phase G Implementation Governance Security Artifacts The Open Group EA Practitioners Conference - Johannesburg
28 Phase H Architecture Change Management Security Artifacts The Open Group EA Practitioners Conference - Johannesburg
29 Enterprise Security Architecture - Framework Footer Text 9/9/
30 ICT service providers must consider the whole market. Four dimensions to put in one line Requirements national/intern. law industries SOX, PCI DSS customers Frameworks ISO NIST ISF Service Provider Service Models Cloud (XaaS) Hosting Managed Service Monitoring Service Types Desktop Communication Collaboration Computing Logon The Open Group EA Practitioners Conference - Johannesburg
31 ICT service providers must consider the whole market. Four dimensions to put in one line 4) Mapping Model to demonstrate fulfillment of all types of security requirements 3) Hierarchy of Security Standards delivering information on each level of detail Enterprise Security Architecture» shaping the security of ICT service provisioning «deliver assurance to customers and provide directions for production 1) Produce Standardized Security measures for industrialized ICT production 2) Modular and Structured approach that serves all possible models and offerings The Open Group EA Practitioners Conference - Johannesburg
32 From Requirements to ICT Services. Standardisation is Key requirements identification Corporate Governance, Risk, & Compliance partially overlap customer requirements (Automotive, Finance, Public, ) requirements consolidation standard options full custom conception, integration no-go operations, maintenance industrialized services (established platforms and processes) customer-specific services The Open Group EA Practitioners Conference - Johannesburg
33 Framework for Enterprise Security Architecture Requirements (corporate and customer) Framework for ESA Enablement (ISMS) security management process and reference model (mainly ISO 27001) Enforcement (Practices) controls / techniques (mainly ISO 27002) specific standards impact analysis for non-framework requirements processes including roles for new business, changes and operational services Enterprise Security Architecture Industrialized ESA Services technology platform evidence (monitoring, analytics and reporting) custom services (specific service and realization for a customer) The Open Group EA Practitioners Conference - Johannesburg
34 Framework for ESA. The Enablement Framework with ISMS activities. Activities of the Enablement Framework P1 Define scope and ISMS policy D1 Implement risk handling plan & controls C1 Monitoring & review security incidents A1 Implement identified improvements in ISMS P2 Define risk assessment approach D2 Define process for monitoring the effectiveness of controls C2 Evaluate effectiveness of the controls implemented A2 Implement appropriate corrective and preventative controls P3 Identify risks, derive control obj. & controls D3 Develop security awareness C3 Review risk assessment approach A3 Communicate activities & improvements P4 Approve residual risks D4 Lead ISMS and steer funds C4 Perform and document ISMS audits A4 Ensure improvements achieve targets P5 Draw up statement of applicability (SoA) D5 Implement methods to identify / handle security incidents C5 Carry out management evaluations The Open Group EA Practitioners Conference - Johannesburg
35 Enterprise Security Architecture for ICT Services Considering: Plan Build Run. Sales, Service, Production, (Integration). ESA reflects three types of business: Customer Projects Operations Platform Preparation New Business & Major Changes (Project Business) Bid, Transition, Transformation Set-up for operations Major Changes Operations (Daily Business) Service Delivery Management Provide industrialized and customer specific ICT Services Evidence ESA Platform Define Offering and SDEs Initial set-up of ESA (creation and extension) Maintenance of ESA (improvements) The Open Group EA Practitioners Conference - Johannesburg
36 Considering: Plan Build Run. Sales, Service, Production, (Integration). What? Work areas Who? Roles etc. How? Standards New Business & Change (Project Business) Bid, Transition, Transformation Set-up for operations Major Changes Operations (Daily Business) Service Delivery Management Provide ICT Services Evidence ESA Technology Platform Define Offering and Service Delivery Elements Initial set-up of ESA Maintenance The Open Group EA Practitioners Conference - Johannesburg
37 Cooperation: Implementation of Roles. Customer Projects, Portfolio, and Operations. Customer Project (bid, transition, transformation) requirements requirements Operations (CMO+FMO) Security Manager ICT SRC Manager Customer Security Manager Security Architects and Experts (engineering) step-by-step transfer of business governance Operations Manager Offering Manager Operations Personnel The Open Group EA Practitioners Conference - Johannesburg
38 Considering: Plan Build Run. Sales, Service, Production, (Integration). What? Work areas Who? Roles etc. How? Standards New Business & Change (Project Business) Bid, Transition, Transformation Set-up for operations Major Changes Operations (Daily Business) Service Delivery Management Provide ICT Services Evidence ESA Technology Platform Define Offering and Service Delivery Elements Initial set-up of ESA Maintenance The Open Group EA Practitioners Conference - Johannesburg
39 Corporate and Product Security incorporated in one Hierarchy Refinement Pyramid of Standards Corporate Security Policy Requirements for ICT Service Provisioning ( product security ) Examples Corporate Security Rule Base ICT Security Principles ICT Security Standards ICT Security Baselines Certification and Audit Security Measures Security Implementation ISO Certificate Detailed customer inquiry Software settings, configuration The Open Group EA Practitioners Conference - Johannesburg
40 Demonstrating that Customer Requirements are met Customer Requirements Set of Controls (contractual ) R1 R2 R3 R4 R5 C1 C2 C3 C4 C5 C6 C7 Requirements are met (Suitability) Controls of ESA and its ICT Security Standards Service type: Desktop Communication Collaboration Computing The Open Group EA Practitioners Conference - Johannesburg
41 Evidence and Customer Relation Service Management Security Taxonomy. Certification and 3rd Party Assurance Risk Management Customer Communi cation and Security Release Mngt. and Acceptance Testing Asset and Configuration Management Vulnerability Assessment, Mitigation Plan Logging, Monitoring & Security Reporting System Development Life-Cycle Systems Acquisition and Contracting Hardening, Provisioning & Maintenance Security Patch Management Incident Handling and Forensics Change and Problem Management Business Continuity Management Customer and users Data Center User Identity Management Networks Provider Identity Management Mobile Workplace Security Application and AM Security VM and S/W Image Mngt. Office Workplace Security Remote User Access Gateway and Central Services Computer Systems Security Database and Storage Security User LAN Periphery Corporate Provider Access Data Center Networks Operations Support Security Wide Area Network Data Center Administration Network Security Security Security Footer Text 9/9/
42 EAS Meta Model Application Models Application Glossaries Industry Glossaries Industry Reference Models Model World Architecture Repository Standardized Content, e.g. business processes, applications etc. Meta-Model Common Language Real World Enterprise applications teams & information Queries, Analysis, Portfolios, etc. Stakeholder Views Integrated and consistent Views Stakeholder specific views & reports The Open Group EA Practitioners Conference - Johannesburg
43 ICT Security Services and Solutions Business Integration Embedding security in processes, defining goals and responsibilities, ensuring good governance and compliance. Enterprise Security Management Architecture and Processes Applications, Risk and Compliance Security and Vulnerability Management Business Enablement Enabling the managed use of ICT resources and IT applications with digital identities, roles and rights. Identity and Access Management Users and Identities Smart Cards Trust Centers Business Protection Defending from hostile action: protecting networks, IT applications, data and building security ICT Infrastructure Security Workplace, Host and Storage Security Network Security Physical Security The Open Group EA Practitioners Conference - Johannesburg
44 If you have one last breath use it to say... The Open Group EA Practitioners Conference - Johannesburg
Security Controls What Works. Southside Virginia Community College: Security Awareness
Security Controls What Works Southside Virginia Community College: Security Awareness Session Overview Identification of Information Security Drivers Identification of Regulations and Acts Introduction
Information Security Management Systems
Information Security Management Systems Øivind Høiem CISA, CRISC, ISO27001 Lead Implementer Senior Advisor Information Security UNINETT, the Norwegian NREN About Øivind Senior Adviser at the HE sector
Outsourcing and Information Security
IBM Global Technology Services Outsourcing and Information Security Preparation is the Key However ultimately accountability cannot be outsourced February 2009 page 2 1. Introduction 3 1.1 Reason for outsourcing
Developing the Corporate Security Architecture. www.avient.ca Alex Woda July 22, 2009
Developing the Corporate Security Architecture www.avient.ca Alex Woda July 22, 2009 Avient Solutions Group Avient Solutions Group is based in Markham and is a professional services firm specializing in
Governance and Management of Information Security
Governance and Management of Information Security Øivind Høiem, CISA CRISC Senior Advisor Information Security UNINETT, the Norwegian NREN About Øivind Senior Adviser at the HE sector secretary for information
Stepping Through the Info Security Program. Jennifer Bayuk, CISA, CISM
Stepping Through the Info Security Program Jennifer Bayuk, CISA, CISM Infosec Program How to: compose an InfoSec Program cement a relationship between InfoSec program and IT Governance design roles and
Microsoft s Compliance Framework for Online Services
Microsoft s Compliance Framework for Online Services Online Services Security and Compliance Executive summary Contents Executive summary 1 The changing landscape for online services compliance 4 How Microsoft
Big Data, Big Risk, Big Rewards. Hussein Syed
Big Data, Big Risk, Big Rewards Hussein Syed Discussion Topics Information Security in healthcare Cyber Security Big Data Security Security and Privacy concerns Security and Privacy Governance Big Data
Sytorus Information Security Assessment Overview
Sytorus Information Assessment Overview Contents Contents 2 Section 1: Our Understanding of the challenge 3 1 The Challenge 4 Section 2: IT-CMF 5 2 The IT-CMF 6 Section 3: Information Management (ISM)
AUSTRALIAN GOVERNMENT INFORMATION MANAGEMENT OFFICE CYBER SECURITY CAPABILITY FRAMEWORK & MAPPING OF ISM ROLES
AUSTRALIAN GOVERNMENT INFORMATION MANAGEMENT OFFICE CYBER SECURITY CAPABILITY FRAMEWORK & MAPPING OF ISM ROLES Final Report Prepared by Dr Janet Tweedie & Dr Julie West June 2010 Produced for AGIMO by
We are Passionate about Total Security Management Architecture & Infrastructure Optimisation Review
We are Passionate about Total Security Management Architecture & Infrastructure Optimisation Review The security threat landscape is constantly changing and it is important to periodically review a business
IT Audit in the Cloud
IT Audit in the Cloud Pavlina Ivanova, CISM ISACA-Sofia Chapter Content: o 1. Introduction o 2. Cloud Computing o 3. IT Audit in the Cloud o 4. Residual Risks o Used Resources o Questions 1. ISACA Trust
(Instructor-led; 3 Days)
Information Security Manager: Architecture, Planning, and Governance (Instructor-led; 3 Days) Module I. Information Security Governance A. Introduction to Information Security Governance B. Overview of
Module F13 The TOGAF Certification for People Program
Module F13 The TOGAF Certification for People Program V9.1 Edition Copyright 010-011 Slide 1 of All rights reserved Published by The Open Group, 011 The TOGAF Certification for People Program Slide of
Practitioner Certificate in Information Assurance Architecture (PCiIAA)
Practitioner Certificate in Information Assurance Architecture (PCiIAA) 15 th August, 2015 v2.1 Course Introduction 1.1. Overview A Security Architect (SA) is a senior-level enterprise architect role,
Ecom Infotech. Page 1 of 6
Ecom Infotech Page 1 of 6 Page 2 of 6 IBM Q Radar SIEM Intelligence 1. Security Intelligence and Compliance Analytics Organizations are exposed to a greater volume and variety of threats and compliance
Information Security Management System for Microsoft s Cloud Infrastructure
Information Security Management System for Microsoft s Cloud Infrastructure Online Services Security and Compliance Executive summary Contents Executive summary 1 Information Security Management System
Background: Business Value of Enterprise Architecture TOGAF Architectures and the Business Services Architecture
Business Business Services Services and Enterprise and Enterprise This Workshop Two parts Background: Business Value of Enterprise TOGAF s and the Business Services We will use the key steps, methods and
SAP Cybersecurity Solution Brief. Objectives Solution Benefits Quick Facts
SAP Cybersecurity Solution Brief Objectives Solution Benefits Quick Facts Secure your SAP landscapes from cyber attack Identify and remove cyber risks in SAP landscapes Perform gap analysis against compliance
Symantec Cyber Threat Analysis Program Program Overview. Symantec Cyber Threat Analysis Program Team
Symantec Cyber Threat Analysis Program Symantec Cyber Threat Analysis Program Team White Paper: Symantec Security Intelligence Services Symantec Cyber Threat Analysis Program Contents Overview...............................................................................................
Logging In: Auditing Cybersecurity in an Unsecure World
About This Course Logging In: Auditing Cybersecurity in an Unsecure World Course Description $5.4 million that s the average cost of a data breach to a U.S.-based company. It s no surprise, then, that
Approach to Information Security Architecture. Kaapro Kanto Chief Architect, Security and Privacy TeliaSonera
Approach to Information Security Architecture Kaapro Kanto Chief Architect, Security and Privacy TeliaSonera About TeliaSonera TeliaSonera provides network access and telecommunication services that help
The Next Generation of Security Leaders
The Next Generation of Security Leaders In an increasingly complex cyber world, there is a growing need for information security leaders who possess the breadth and depth of expertise necessary to establish
Cloud Computing Governance & Security. Security Risks in the Cloud
Cloud Computing Governance & Security The top ten questions you have to ask Mike Small CEng, FBCS, CITP Fellow Analyst, KuppingerCole This Webinar is supported by Agenda What is the Problem? Ten Cloud
How small and medium-sized enterprises can formulate an information security management system
How small and medium-sized enterprises can formulate an information security management system Royal Holloway Information Security Thesis Series Information security for SMEs Vadim Gordas, MSc (RHUL) and
Advanced Topics for TOGAF Integrated Management Framework
Instructor: Robert Weisman MSc, PEng, PMP CD [email protected] Advanced Topics for TOGAF Integrated Management Framework ROBERT WEISMAN CEO BUILD THE VISION, INC. WWW.BUILDTHEVISION.CA EMAIL:
Table of Contents. Auditor's Guide to Information Systems Auditing Richard E. Cascarino Copyright 2007, John Wiley & Sons, Inc.
Table of Contents PART I. IS Audit Process. CHAPTER 1. Technology and Audit. Technology and Audit. Batch and On-Line Systems. CHAPTER 2. IS Audit Function Knowledge. Information Systems Auditing. What
Italy. EY s Global Information Security Survey 2013
Italy EY s Global Information Security Survey 2013 EY s Global Information Security Survey 2013 This year s survey our 16th edition captures the responses of 1,909 C-suite and senior level IT and information
Lessons from Defending Cyberspace
Lessons from Defending Cyberspace The Challenge of Addressing National Cyber Risk Andy Purdy Workshop on Cyber Security Center for American Studies, Christopher Newport College 10 28-2009 Cyber Threat
Open Group SOA Governance. San Diego 2009
Open Group SOA Governance San Diego 2009 SOA Governance Aspects A comprehensive view of SOA Governance includes: People Organizational structures Roles & Responsibilities Processes Governing processes
Security Architecture and Design from a Business/Enterprise Driven Viewpoint
Security Architecture and Design from a Business/Enterprise Driven Viewpoint Introduction to Enterprise Security Architecture using the SABSA methodology, and design pattern examples Robert Trapp, Perry
Compliance Guide ISO 27002. Compliance Guide. September 2015. Contents. Introduction 1. Detailed Controls Mapping 2.
ISO 27002 Compliance Guide September 2015 Contents Compliance Guide 01 02 03 Introduction 1 Detailed Controls Mapping 2 About Rapid7 7 01 INTRODUCTION If you re looking for a comprehensive, global framework
I n f o r m a t i o n S e c u r i t y
We help organizations protect INFORMATION The BorderHawk Team has significant experience assessing, analyzing, and designing information protection programs especially in Critical Infrastructure environments.
Visualizing the Business Impact of Technical Cyber Risks
Visualizing the Business Impact of Technical Cyber Risks May 21, 2014 Henk Jonkers Senior Research Consultant, BiZZdesign Agenda Introduction and problem statement Enterprise Architecture with ArchiMate
Effective Use of Assessments for Cyber Security Risk Mitigation
White Paper Effective Use of Assessments for Cyber Security Risk Mitigation Executive Summary Managing risk related to cyber security vulnerabilities is a requirement for today s modern systems that use
TOGAF 9 Level 1 + 2 Exam Study Guide
TOGAF 9 Level 1 + 2 Exam Study Guide Created by Nik Ansell http://ae.linkedin.com/in/nikansell Introduction This document was created to help focus the study areas of TOGAF 9 students, studying for the
Protecting Official Records as Evidence in the Cloud Environment. Anne Thurston
Protecting Official Records as Evidence in the Cloud Environment Anne Thurston Introduction In a cloud computing environment, government records are held in virtual storage. A service provider looks after
An Analysis of The SABSA Framework. Note: Most of this information comes from the SABSA website. TJS. SABSA Overview
Note: Most of this information comes from the SABSA website. TJS SABSA Overview SABSA is a model and a methodology for developing risk-driven enterprise information security architectures and for delivering
How to bridge the gap between business, IT and networks
ericsson White paper Uen 284 23-3272 October 2015 How to bridge the gap between business, IT and networks APPLYING ENTERPRISE ARCHITECTURE PRINCIPLES TO ICT TRANSFORMATION A digital telco approach can
COPYRIGHTED MATERIAL. Contents. Acknowledgments Introduction
Contents Acknowledgments Introduction 1. Governance Overview How Do We Do It? What Do We 1 Get Out of It? 1.1 What Is It? 1 1.2 Back to Basics 2 1.3 Origins of Governance 3 1.4 Governance Definition 5
White Paper An Enterprise Security Program and Architecture to Support Business Drivers
White Paper An Enterprise Security Program and Architecture to Support Business Drivers seccuris.com (866) 644-8442 Contents Introduction... 3 Information Assurance... 4 Sherwood Applied Business Security
IT Governance: The benefits of an Information Security Management System
IT Governance: The benefits of an Information Security Management System Katerina Cai, CISSP Hewlett-Packard 2004 Hewlett-Packard Development Company, L.P. The information contained herein is subject to
Reference Process for Enterprise Architecture enabled ICT Planning
Reference Process for Enterprise Architecture enabled ICT Planning NSW GEA Toolkit R1 April 2015 Contact [email protected] Strategic Policy Department of Finance, Services & Innovation 1 Table of Contents
Developing an Architectural Framework towards achieving Cyber Resiliency. Presented by Deepak Singh
Developing an Architectural Framework towards achieving Cyber Resiliency Presented by Deepak Singh Presentation Content Cyber Threat Landscape Cyber Attack and Threat Profile Cyber Threat Map Cyber Security
ISO 27001 COMPLIANCE WITH OBSERVEIT
ISO 27001 COMPLIANCE WITH OBSERVEIT OVERVIEW ISO/IEC 27001 is a framework of policies and procedures that include all legal, physical and technical controls involved in an organization s information risk
Information Security Policies and Procedures Development Framework for Government Agencies. First Edition - 1432 AH
Information Security Policies and Procedures Development Framework for Government Agencies First Edition - 1432 AH 6 Contents Chapter 1 Information Security Policies and Procedures Development Framework
Cybersecurity: What CFO s Need to Know
Cybersecurity: What CFO s Need to Know William J. Nowik, CISA, CISSP, QSA PCIP MEMBER OF PKF NORTH AMERICA, AN ASSOCIATION OF LEGALLY INDEPENDENT FIRMS 2014 Wolf & Company, P.C. Today s Agenda Introduction
Protect the data that drives our customers business. Data Security. Imperva s mission is simple:
The Imperva Story Who We Are Imperva is the global leader in data security. Thousands of the world s leading businesses, government organizations, and service providers rely on Imperva solutions to prevent
University of Pittsburgh Security Assessment Questionnaire (v1.5)
Technology Help Desk 412 624-HELP [4357] technology.pitt.edu University of Pittsburgh Security Assessment Questionnaire (v1.5) Directions and Instructions for completing this assessment The answers provided
Vendor Risk Management Financial Organizations
Webinar Series Vendor Risk Management Financial Organizations Bob Justus Chief Security Officer Allgress Randy Potts Managing Consultant FishNet Security Bob Justus Chief Security Officer, Allgress Current
Enterprise Architectures (EA) & Security
Enterprise Architectures (EA) & Security A synopsis of current state EA s and enterprise security as an add on Marcel Schlebusch 2013-07-18 mwrinfosecurity.com MWR InfoSecurity mwrinfosecurity.com MWR
Cybersecurity. Cloud. and the. 4TH Annual NICE Workshop Navigating the National Cybersecurity Education InterState Highway September 2013
Cybersecurity and the Cloud 4TH Annual NICE Workshop Navigating the National Cybersecurity Education InterState Highway September 2013 Well, I'll hazard I can do more damage on my laptop sitting in my
Discussion Draft of the Preliminary Cybersecurity Framework Illustrative Examples
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 Discussion Draft of the Preliminary Cybersecurity Framework Illustrative Examples The
Network Security Administrator
Network Security Administrator Course ID ECC600 Course Description This course looks at the network security in defensive view. The ENSA program is designed to provide fundamental skills needed to analyze
SECURITY. Risk & Compliance Services
SECURITY Risk & Compliance s V1 8/2010 Risk & Compliances s Risk & compliance services Summary Summary Trace3 offers a full and complete line of security assessment services designed to help you minimize
Cyber Resilience Implementing the Right Strategy. Grant Brown Security specialist, CISSP @TheGrantBrown
Cyber Resilience Implementing the Right Strategy Grant Brown specialist, CISSP @TheGrantBrown 1 2 Network + Technology + Customers = $$ 3 Perfect Storm? 1) Increase in Bandwidth (extended reach) 2) Available
The President s Critical Infrastructure Protection Board. Office of Energy Assurance U.S. Department of Energy 202/ 287-1808
cover_comp_01 9/9/02 5:01 PM Page 1 For further information, please contact: The President s Critical Infrastructure Protection Board Office of Energy Assurance U.S. Department of Energy 202/ 287-1808
Executive's Guide to
Executive's Guide to IT Governance Improving Systems Processes with Service Management, COBIT, and ITIL ROBERT R. MOELLER WILEY John Wiley & Sons, Inc. Contents Preface xiii PART I: IT GOVERNANCE CONCEPTS
ASSUMING A STATE OF COMPROMISE: EFFECTIVE DETECTION OF SECURITY BREACHES
ASSUMING A STATE OF COMPROMISE: EFFECTIVE DETECTION OF SECURITY BREACHES Leonard Levy PricewaterhouseCoopers LLP Session ID: SEC-W03 Session Classification: Intermediate Agenda The opportunity Assuming
Cloud security architecture
ericsson White paper Uen 284 23-3244 January 2015 Cloud security architecture from process to deployment The Trust Engine concept and logical cloud security architecture presented in this paper provide
Cloud Security Standards. Aziza Al Rashdi Director, Cyber Security Professional Services Oman National CERT Information Technology Authority
Cloud Security Standards Aziza Al Rashdi Director, Cyber Security Professional Services Oman National CERT Information Technology Authority Introduction Sign Off December 2012 Information Technology Authority
micros MICROS Systems, Inc. Enterprise Information Security Policy (MEIP) August, 2013 Revision 8.0 MICROS Systems, Inc. Version 8.
micros MICROS Systems, Inc. Enterprise Information Security Policy (MEIP) Revision 8.0 August, 2013 1 Table of Contents Overview /Standards: I. Information Security Policy/Standards Preface...5 I.1 Purpose....5
Securing Virtual Applications and Servers
White Paper Securing Virtual Applications and Servers Overview Security concerns are the most often cited obstacle to application virtualization and adoption of cloud-computing models. Merely replicating
GEARS Cyber-Security Services
Florida Department of Management Services Division of State Purchasing Table of Contents Introduction... 1 About GEARS... 2 1. Pre-Incident Services... 3 1.1 Incident Response Agreements... 3 1.2 Assessments
Enterprise Cybersecurity: Building an Effective Defense
: Building an Effective Defense Chris Williams Scott Donaldson Abdul Aslam 1 About the Presenters Co Authors of Enterprise Cybersecurity: How to Implement a Successful Cyberdefense Program Against Advanced
HKITPC Competency Definition
HKITPC Competency Definition for the Certification copyright 2011 HKITPC HKITPC Competency Definition Document Number: HKCS-CD-L1L2 Version: 1.0 Date: June 2011 Prepared by Hong Kong IT Professional Certification
Security aspects of e-tailing. Chapter 7
Security aspects of e-tailing Chapter 7 1 Learning Objectives Understand the general concerns of customers concerning security Understand what e-tailers can do to address these concerns 2 Players in e-tailing
Build (develop) and document Acceptance Transition to production (installation) Operations and maintenance support (postinstallation)
It is a well-known fact in computer security that security problems are very often a direct result of software bugs. That leads security researches to pay lots of attention to software engineering. The
PASTA Abstract. Process for Attack S imulation & Threat Assessment Abstract. VerSprite, LLC Copyright 2013
2013 PASTA Abstract Process for Attack S imulation & Threat Assessment Abstract VerSprite, LLC Copyright 2013 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Domain 1 The Process of Auditing Information Systems
Certified Information Systems Auditor (CISA ) Certification Course Description Our 5-day ISACA Certified Information Systems Auditor (CISA) training course equips information professionals with the knowledge
INFORMATION SECURITY SPECIFIC VENDOR COMPLIANCE PROGRAM (VCP) ACME Consulting Services, Inc.
INFORMATION SECURITY SPECIFIC VENDOR COMPLIANCE PROGRAM (VCP) ACME Consulting Services, Inc. Copyright 2016 Table of Contents INSTRUCTIONS TO VENDORS 3 VENDOR COMPLIANCE PROGRAM OVERVIEW 4 VENDOR COMPLIANCE
Cyber Security solutions
Cyber Security solutions The scenario IT security has become a highly critical issue for all businesses as a result of the growing pervasiveness and diffusion of ICT technology. Risks can arise both inside
7 Homeland. ty Grant Program HOMELAND SECURITY GRANT PROGRAM. Fiscal Year 2008
U.S. D EPARTMENT OF H OMELAND S ECURITY 7 Homeland Fiscal Year 2008 HOMELAND SECURITY GRANT PROGRAM ty Grant Program SUPPLEMENTAL RESOURCE: CYBER SECURITY GUIDANCE uidelines and Application Kit (October
How To Improve Your Business
IT Risk Management Life Cycle and enabling it with GRC Technology 21 March 2013 Overview IT Risk management lifecycle What does technology enablement mean? Industry perspective Business drivers Trends
Developing Business Architecture with TOGAF
Developing Business Architecture with TOGAF Building Business Capability 2013 Las Vegas, NV Armstrong Process Group, Inc. www.aprocessgroup.com Objectives Introduce The Open Group Architecture Framework
Altius IT Policy Collection Compliance and Standards Matrix
Governance IT Governance Policy Mergers and Acquisitions Policy Terms and Definitions Policy 164.308 12.4 12.5 EDM01 EDM02 EDM03 Information Security Privacy Policy Securing Information Systems Policy
John Essner, CISO Office of Information Technology State of New Jersey
John Essner, CISO Office of Information Technology State of New Jersey http://csrc.nist.gov/publications/nistpubs/800-144/sp800-144.pdf Governance Compliance Trust Architecture Identity and Access Management
Internal audit of cybersecurity. Presentation to the Atlanta IIA Chapter January 2015
Internal audit of cybersecurity Presentation to the Atlanta IIA Chapter January 2015 Agenda Executive summary Why is this topic important? Cyber attacks: increasing complexity arket insights: What are
Cloud Computing Security Framework for Banking Industry
Cloud Computing Security Framework for Banking Industry Meskerem Alemu [email protected] Abrehet Mohammed Omer Addis Ababa Science and Technology University, Ethiopia [email protected] Abstract Cloud
Information Security and Risk Management
Information Security and Risk Management COSO and COBIT Standards and Requirements Page 1 Topics Information Security Industry Standards and COBIT Framework Relation to COSO Internal Control Risk Management
Caretower s SIEM Managed Security Services
Caretower s SIEM Managed Security Services Enterprise Security Manager MSS -TRUE 24/7 Service I.T. Security Specialists Caretower s SIEM Managed Security Services 1 Challenges & Solution Challenges During
Information Security Policy and Handbook Overview. ITSS Information Security June 2015
Information Security Policy and Handbook Overview ITSS Information Security June 2015 Information Security Policy Control Hierarchy System and Campus Information Security Policies UNT System Information
EA-ISP-012-Network Management Policy
Technology & Information Services EA-ISP-012-Network Management Policy Owner: Adrian Hollister Author: Paul Ferrier Date: 01/04/2015 Document Security Level: PUBLIC Document Version: 1.00 Document Ref:
Cloud Security and Managing Use Risks
Carl F. Allen, CISM, CRISC, MBA Director, Information Systems Security Intermountain Healthcare Regulatory Compliance External Audit Legal and ediscovery Information Security Architecture Models Access
08/10/2013. Data protection and compliance. Agenda. Data protection life cycle and goals. Introduction. Data protection overview
Data protection and compliance In the cloud and in your data center 1 November 2013 Agenda 1 Introduction 2 Data protection overview 3 Understanding the cloud 4 Where do I start? 5 Wrap-up Page 2 Data
Securing the Microsoft Cloud
Securing the Microsoft Cloud Securing the Microsoft Cloud Page 1 Securing the Microsoft Cloud Microsoft recognizes that trust is necessary for organizations and consumers to fully embrace and benefit from
3rd Party Assurance & Information Governance 2014-2016 outlook IIA Ireland Annual Conference 2014. Straightforward Security and Compliance
3rd Party Assurance & Information Governance 2014-2016 outlook IIA Ireland Annual Conference 2014 Continuous Education Services (elearning/workshops) Compliance Management Portals Information Security
Assessing Risks in the Cloud
Assessing Risks in the Cloud Jim Reavis Executive Director Cloud Security Alliance Agenda Definitions of Cloud & Cloud Usage Key Cloud Risks About CSA CSA Guidance approach to Addressing Risks Research
ArchiMate and TOGAF. What is the added value?
ArchiMate and TOGAF What is the added value? Why use TOGAF next to ArchiMate? ArchiMate provides a (visual) language ArchiMate provides a content framework TOGAF provides a process TOGAF provides a way
CESG Certification of Cyber Security Training Courses
CESG Certification of Cyber Security Training Courses Supporting Assessment Criteria for the CESG Certified Training (CCT) Scheme Portions of this work are copyright The Institute of Information Security
Compliance Guide: ASD ISM OVERVIEW
Compliance Guide: ASD ISM OVERVIEW Australian Information Security Manual Mapping to the Principles using Huntsman INTRODUCTION In June 2010, The Australian Government Protective Security Policy Framework
SECURITY RISK MANAGEMENT
SECURITY RISK MANAGEMENT ISACA Atlanta Chapter, Geek Week August 20, 2013 Scott Ritchie, Manager, HA&W Information Assurance Services Scott Ritchie CISSP, CISA, PCI QSA, ISO 27001 Auditor Manager, HA&W
Software & Supply Chain Assurance: Mitigating Risks Attributable to Exploitable ICT / Software Products and Processes
Software & Supply Chain Assurance: Mitigating Risks Attributable to Exploitable ICT / Software Products and Processes Joe Jarzombek, PMP, CSSLP Director for Software & Supply Chain Assurance Stakeholder
Information System Audit Guide
Australian Government Department of Defence Information System Audit Guide VERSION 11.1 January 2012 Commonwealth of Australia 2011 Page 1 TABLE OF CONTENTS 1. INTRODUCTION TO ACCREDITATION...4 2. THE
DEVELOPING A CYBERSECURITY POLICY ARCHITECTURE
TECHNICAL PROPOSAL DEVELOPING A CYBERSECURITY POLICY ARCHITECTURE A White Paper Sandy Bacik, CISSP, CISM, ISSMP, CGEIT July 2011 7/8/2011 II355868IRK ii Study of the Integration Cost of Wind and Solar
LAMAR STATE COLLEGE - ORANGE INFORMATION RESOURCES SECURITY MANUAL. for INFORMATION RESOURCES
LAMAR STATE COLLEGE - ORANGE INFORMATION RESOURCES SECURITY MANUAL for INFORMATION RESOURCES Updated: June 2007 Information Resources Security Manual 1. Purpose of Security Manual 2. Audience 3. Acceptable
Securing The Cloud. Foundational Best Practices For Securing Cloud Computing. Scott Clark. Insert presenter logo here on slide master
Securing The Cloud Foundational Best Practices For Securing Cloud Computing Scott Clark Agenda Introduction to Cloud Computing What is Different in the Cloud? CSA Guidance Additional Resources 2 What is