Welcome to Manage Risk to Your Organization with Effective Data Security

Transcription

1 Welcme t Manage Risk t Yur Organizatin with Effective Data Security Presented by: Gelman, Rsenberg & Freedman CPAs The prgram will start prmptly at 11:00 AM ET Please nte: Use the Q&A functin t speak with the administratr if yu experience any technical issues while lgging int WebEx. Fr the best audi quality, please call-in by phne vs. cnnecting via yur cmputer. Call: Access cde/event number:

2 Husekeeping General Infrmatin/Technical Questins We strngly recmmend that yu cnnect by phne instead f yur cmputer fr the best audi quality. Call The event number is and the passwrd is DataRisk. Please use the Q&A functin fr any technical questins, r yu may cntact WebEx with the event infrmatin abve at This presentatin will be recrded and made available t dwnlad at & FREEDMAN Certified Public Accuntants 2

3 Husekeeping CPE Credit Imprtant: Three (3) CPE wrds will be prvided during the presentatin. Please write them dwn we will nt prvide them again via WebEx r (n exceptins). Please cmplete the electrnic survey that will appear autmatically at the end f the webinar. Turn ff yur pp-up blcker (leaving it n culd blck the survey). Attendees seeking CPE fr this presentatin must cmplete the survey and enter all three CPE wrds. Yu cannt claim CPE unless we receive a cmpleted evaluatin with the crrect wrds. Technical questins abut the survey can be addressed t Dminic Acsta at dacta@grfcpa.cm. & FREEDMAN Certified Public Accuntants 3

4 Husekeeping Webinar Objectives Learning Objective T better understand data security and risk management Recmmended CPE 1.0 CPE Credit Prerequisites Nne required Instructinal Delivery Methds Grup Internet-based Recmmended Fields f Study Audit Advance Preparatin Nne Prgram Level Basic Refund Plicy N fee is required t participate in this sessin. Curse Registratin Requirements Nne Cancellatin Plicy In the event that the presentatin is cancelled r rescheduled, participants will be cntacted immediately with details. Cmplaint Reslutin Plicy Gelman, Rsenberg & Freedman CPAs is cmmitted t ur seminar participants 100% satisfactin and will make every reasnable effrt t reslve cmplaints as quickly as pssible. Please cntact kdavis@grfcpa.cm with any cncerns. Disclaimer This webinar is nt intended as, and shuld nt be taken as, financial, tax, accunting, legal, cnsulting r any ther type f advice. Readers and users f this webinar infrmatin are advised nt t act upn this infrmatin withut seeking the service f a prfessinal accuntant. & FREEDMAN Certified Public Accuntants 4

5 Manage Risk t Yur Organizatin with Effective Data Security August 15, 2018 Presenters Mderatr Ricard Trujill, CPA, CITP, CISA Nnprfit Audit Partner Mac Lillard, CPA, CISA, CITP, CFE Senir Auditr Laura Malcm, CPA Nnprfit Audit Manager

6 Our Team Meet Yur Instructrs Ricard Trujill, CPA, CITP, CISA Nnprfit Audit Partner Mac Lillard, CPA, CISA, CITP, CFE Senir Auditr & FREEDMAN Certified Public Accuntants 6

7 Anatmy f an IT Attack & FREEDMAN Certified Public Accuntants 7

8 FBI Internet Crime Reprt & FREEDMAN Certified Public Accuntants 8

9 Agenda Implementing security cntrls Technlgy assets inventries Cyber insurance Risk frm 3 rd party prviders Security awareness training Payment Card Industry Data Security Standard PCI DSS General Data Prtectin Regulatin - GDPR & FREEDMAN Certified Public Accuntants 9

10 Implementing Security Cntrls Implement prper cntrls need t understand threats Patch applicatins Cnsistency in the applicatin f cntrls Autmate where pssible Physical security Sftware security Manage vendr risks CISecurity.rg a nn-prfit that prvides great tls fr cntrl implementatin & FREEDMAN Certified Public Accuntants 10

11 Implementing Security Cntrls & FREEDMAN Certified Public Accuntants 11

12 Technlgy Asset Inventries Managing and mnitring yur IT assets Hardware, sftware, platfrms, applicatins, databases, etc. Create risk schema Critical systems Effect f failure Mnitring and versight Patching Updates Perfrmance evaluatin & FREEDMAN Certified Public Accuntants 12

13 Technlgy Asset Inventries (cntinued) Plicies and prcedures Peridic review f listing Lgging crashes/failures Dispsitin plan Keep hardware up-t-date Prcess fr upgrading Budget fr IT prjects & FREEDMAN Certified Public Accuntants 13

14 Pll Questin #1 Des yur rganizatin have a technlgy asset inventry? A) Yes B) N C) I dn t knw

15 Cyber Insurance Risk Mitigatin What prtectin d yu have thrugh yur 3 rd party prviders? What kind f data des yur rganizatin stre? Cst vs. Benefit f cyber insurance & FREEDMAN Certified Public Accuntants 15

16 Risk frm 3 rd Party Prviders Are yur vendrs secure? Critical vendrs Risk-rated Risk-managed Vendr Management prgram Risk assessment Due diligence Cntract structuring Oversight & FREEDMAN Certified Public Accuntants 16

17 Risk frm 3 rd Party Prviders (cntinued) Prcurement prcedures Bid slicitatin Evaluatin f cmpetency Lwest cst prvider Business cntinuity and cntingency plans Identify critical vendrs and utsurced services Effect f breach/crash Minimum allwable dwntime & FREEDMAN Certified Public Accuntants 17

18 Security Awareness Training Surce: Mediapr & FREEDMAN Certified Public Accuntants 18

19 Pll Questin #2 Des yur rganizatin have a frmal security awareness training prgram in place? A) Yes B) N C) I dn t knw

20 Payment Card Industry Data Security Standard PCI DSS What is PCI? T whm des PCI DSS apply? Different levels based n number f credit card transactins Levels 1-4 What are the penalties fr nn-cmpliance? 6 gals 12 requirements & FREEDMAN Certified Public Accuntants 20

21 Payment Card Industry Data Security Standard PCI DSS & FREEDMAN Certified Public Accuntants 21

22 Pll Questin #3 Has yur rganizatin gne thrugh an IT risk assessment? A) Yes B) N C) I dn t knw

23 General Data Prtectin Regulatin What t knw Became effective May 25, 2018 Sets guidelines fr the cllectin and prcessing f persnally identifiable infrmatin fr individuals within the Eurpean Unin Emphasis n data strage/management Ntificatin requirement & FREEDMAN Certified Public Accuntants 23

24 General Data Prtectin Regulatin (cntinued) Des this apply t yur rganizatin? Overseas peratins Dnrs Revenue-based fines Up t 20M Eurs f 4 percent f annual revenue Cst vs benefit Hw relevant is GDPR t yu? & FREEDMAN Certified Public Accuntants 24

25 Questins? We d like t hear frm yu!

26 Jin us again September 13, 2018, 11:00am 12:00pm Tpic Revenue frm Cntracts with Custmers (webinar) Registratin will be pening shrtly at

27 Get In Tuch 4550 Mntgmery Avenue, Suite 650N Bethesda, MD (301) twitter.cm/grfcpas facebk.cm/grfcpas instagram.cm/grfcpas/ linkedin.cm/cmpany/gelmanrsenberg-&-freedman-cpas Ricard Trujill, CPA, CITP, CISA (301) Mackenzie Lillard, CPA, CISA, CITP, CFE (301)

28 Disclaimer This webinar is nt intended as, and shuld nt be taken as, financial, tax, accunting, legal, cnsulting r any ther type f advice. While we use reasnable effrts t furnish accurate and up-t-date infrmatin, we d nt warrant that any infrmatin cntained in r made available in this webinar is accurate, cmplete, reliable, current r errr-free. We assume n liability r respnsibility fr any errrs r missins in the cntent f this webinar. The use f the infrmatin prvided in this webinar des nt establish any cntractual r ther frm f client engagement between Gelman, Rsenberg & Freedman P.C. and the reader r user. Any U.S. federal tax advice cntained in this webinar is nt intended t be used fr the purpse f aviding penalties under U.S. federal tax law. Readers and users f this webinar infrmatin are advised nt t act upn this infrmatin withut seeking the service f a prfessinal accuntant.