Designing & Building an Information Security Program To protect our critical assets Larry Wilson Version 1.0 March, 2014
Instructor Biography Larry Wilson is responsible for developing, implementing and managing the University of Massachusetts Information Security Policy and Written Information Security Program (WISP). The University program is based on industry best practices ISO 27001 / SANS 20 Critical Controls, and is implemented consistently across all University campuses (Amherst, Boston, Dartmouth, Lowell, Medical School and the President s Office). Prior to joining UMASS, Larry was the Vice President, Network Security Manager at State Street. His responsibilities included researching, selecting, implementing and overseeing an engineering and operations team who managed network security technologies / tools including vulnerability scanning, network firewalls, intrusion detection, content filtering, remote access, DNS, global and local load balancing, etc. Larry's industry experience includes IT audit manager for Deloitte Enterprise Risk Services (ERS) consulting practice. In this role he managed a staff responsible for developing and completing a Sarbanes Oxley (SOX) compliance audit for MasterCard International. Larry's team focused on the application level controls and general computer controls for information technology services implemented and managed from the MasterCard data center in St. Louis. Mr. Wilson holds a Master of Science degree in Civil / Structural Engineering from the University of New Hampshire. His industry certifications include CISSP, CISA and ISA (PCI Internal Security Assessor). He serves on the Advisory Board for Middlesex Community College and CISO Advisory Board for Oracle. He co-chairs the New England Security Council (NESC), and is the Certification Director for ISACA New England. 2
Presentation Overview This presentations will cover the essential elements for planning, designing, budgeting, implementing, maintaining and assessing a comprehensive information security program. A high-level outline includes: Part 1: Information Security Fundamentals Part 2: Protecting organizational assets through security controls Part 3: Information Security Program Design and Business Case The course is based on the University of Massachusetts Information Security Program, which was the 2013 Information Security Executive (ISE ) North America Project Award Winner- Academic/Public Sector Category. This presentation will include Part 1 Only 3
Designing and Building an Information Security Program Part 1: The Fundamentals Understand the Problem Understand the Challenges Understand the Risks Understand the Vulnerabilities Understand the Threats Understand the Assets Understand the Controls Understand the Technologies Understand the Services Understand the Resources Understand the Solution Putting it all Together Building the Controls Factory 4
Understand the Problem Data breaches hit an all time high in 2013. Target, Neiman Marcus, and Adobe This past year was pretty rough for them Could they have done anything to avoid the security breaches? Yes, according to Online Trust Alliance (OTA)'s latest report Companies should have better security controls and practices What Was Discovered Over 740 million records were exposed in 2013 alone. Making it the worst year for data breaches to date. 89 % could have been prevented - If companies had simply employed basic, effective security measures. 5
Understand the Problem. Organizations are held accountable South Carolina Department of Revenue Data Breach (October 2012) A hacker exfiltrated 5.7 million Social Security numbers and 387,000 credit and debit card numbers from an external cyber attack. What Went Wrong? Where do we go from here? We now have to go into cyber plan mode. This is a new era in time where you can t work with 1970s equipment, you can t go with compliance standards of the federal government, because both are outdated. - Nikki Haley, Governor of South Carolina Cost of Recovery Estimates Deloitte Security Assessment (2013) FY-13 $ 20 M (Loan to Department of Revenue for response to hacking) FY 14 - $ 15 M (Initial Deloitte Security Assessment May, 2013) FY 15 - $ 21 M (Interim Deloitte Security Assessment October, 2013) 6
Understand the Challenges The Internet of Things (Assets).. Businesses rely on IT to meet strategic objectives Pervasive spread of new technologies (cloud, mobility, virtualization) We need to provide the right information, at the right time, in the right format, to the right parties, at the right cost At risk of hackers, malware, unauthorized access, data breach There are new vulnerabilities, threats, unprotected assets Data breaches have consequences - management is held accountable We must design and implement security controls to mitigate risk And protect our critical IT assets and information resources Information is everywhere - data centers, the cloud, mobile devices The attack surface is exploding. We need to be flexible to adjust. There s a lot riding here - It s the business - we need to get this right 7
Understand the Challenges. are at Risk from Security Threats The Risk Equation Risk = Threats X Vulnerabilities X Asset Value Controls How do we calculate risk? Risk is based on the likelihood and impact of a security incident or data breach Threats involve the potential attack against IT assets or information resources Vulnerabilities are weaknesses that could be exploited by a threat Asset Value is based on criticality of IT resources and information assets (aka things) Controls are safeguards that protect IT resources and information assets 8
Understand the Risks These are some of the more recent data breaches. 9
Understand the Vulnerabilities These are some of the vulnerabilities. Lost Tape Drive Paper Records Database Vulnerabilities Software Vulnerabilities Weak Passwords Password Reset EOL Software Default Passwords Lost Data Mobile Devices Phishing E-mails Lost or Stolen Device Local Admin Permissions Cloud Computing Network Vulnerabilities Social Engineering Unpatched Systems (outdated software) Web Application Vulnerabilities 10 Drive-by Downloads Misconfigured Firewall Database Administrator 3 rd party risk 10
Understand the Threats These are some of the cyber-threats. 11
Understand the Assets These are the assets (human assets, technology assets, information assets) that we need to protect.. Corporate (Trusted) Networks Employee Mobile Devices Business Applications Network Applications Drivers License CAG-05 Mobile Applications Data Center Systems Cloud Computing Databases Research Data Intellectual Property CAG-06 CAG-07 File Systems Hosted Applications Structured Data Unstructured Data Internet (Untrusted) Networks Credit Card Number Financial Spreadsheet Privileged Users Laptop Document Images Social Security Numbers Bank Account Critical Infrastructure Vendor / Contractor 12
Understand the Controls These are the controls standards and regulations that protect the assets 13
Understand the Technologies These are the technologies that automate the controls and protect the assets 14
Understand the Services These are the service providers that also implement controls to help protect the assets 15
Understand the Resources These are the management, technical, operational, administrative resources run the program Executive & Senior Management Executive Management IT Management Business Management Budget Office Security Program Management Program Management Team Data Custodian Security Administrator InfoSec Officer Business Process Owner Security Program Design Program Design Team Security Architect Security Engineer Systems Engineer Network Engineer Applications Engineer Audit / Advisory Security Program Operations Program Operations Team Desktop Support Team Systems Operations Network Operations Security Operations MSSP Security Program Administration Program Administration Team Systems Analyst Network Analyst Security Analyst Application Specialist DBA 16
Understand the Solution Our Unmanaged Assets ARE NOT protected Our Managed Assets ARE protected Unmanaged Assets Our portfolio of unmanaged assets Our portfolio of managed assets Identifying and securing our unmanaged assets There are undetected problems not seen, not reported Our unmanaged assets become easy targets Which leads to a breach from missing or ineffective controls What is our unmanaged asset portfolio? We need to secure our unmanaged assets and add them to our managed asset portfolio Identify and secure our managed assets Security professionals understand why security breaches occur And the steps to take to prevent them What is our managed asset portfolio? We need to build a portfolio of managed assets 17
Putting it all Together These are the assets.. These are the controls. Human Assets These are the managed assets Asset Lifecycle Administration Application Assets Managed Asset General Computer Controls Technology Assets Cyber-security Controls Information Assets Asset Lifecycle Administration General Computer Controls Cyber-security Controls Management & Communication Controls Management & Communications Controls 18
Building The Controls Factory Controls Factory ASSET LIFECYCLE ADMINISTRATION [ALA] GENERAL COMPUTER CONTROLS [GCC] CYBER-SECURITY CONTROLS [CSC] MANAGEMENT CONTROLS [MGT] Program Administration Team Program Operations Team Program Engineering Team Program Management Team The Pipeline Unknown Asset Endpoint Known Asset Known Asset Known Asset Known Asset Managed Asset START END Resources, Technologies, Services & Partners Resources, Technologies, Services & Partners Resources, Technologies, Services & Partners Resources, Technologies, Services & Partners 19