Arhitektura oblaka Upravljanje v oblaku Delovanje v oblaku Arhitekturni okvir računalništva v oblaku
|
|
|
- Peter Daniel
- 6 years ago
- Views:
Transcription
1 1 Predstavitev 2 Področja delovanja 3 GRC knjižnica 4 Primeri CAI in CCM Aplikacijska varnost 5 CCSK 6 Zaključek
2 Globalna, neprofitna organizacija 23,000+ članov, 100 korporativnih članov, 50 odsekov Gradimo najboljše prakse in zaupanja vreden ekosistem Agilna filozofija, hiter razvoj uporabnih raziskav GRC: Uravnoteževanje skladnosti z upravljanjem tveganji Referenčni modeli: z uporabo obstoječih standardov Identiteta: osnova za delovanje oblačnega trga Zagovarjanje združljivosti Omogočanje inovacij Zagovarjanje preudarne javne politike Promocija uporabe najboljših praks za zagotovljanje varnosti znotraj računalništva v oblaku in izobraževanje o uporabi računalništva v oblaku z namenom zaščite vseh ostalih oblik računalništva. Arhitektura oblaka Upravljanje v oblaku Delovanje v oblaku Arhitekturni okvir računalništva v oblaku Korporativno upravljanje in upravljanje organizacijskih tveganj Pravna in elektronska razkritja Skladnost in revizija Upravljanje življenjskega cikla informacij Prenosljivost in združljivost Tradicionalna varnost, neprekinjeno poslovanje in okrevanje po katastrofi Odziv na incidente, obveščanje in odprava Aplikacijska varnost Enkripcija in upravljanje s ključi Upravljanje z identitetami in dostopi Virtualizacija Varnost kot storitev (predlog)
3 Družina 4 raziskovalnih projektov Cloud s Matrix Consensus Assessments Initiative Cloud Audit Cloud Trust Protocol Orodja za korp. upravljanje ter upravljanje tveganj in skladnosti Omogoča avtomatizacijo in neprekinjen nadzor GRC Government??? Deliver continuous monitoring required by A&A methodologies??? FedRAMP DIACAP Other C&A standards NIST , HITRUST CSF, ISO 27001/27002, ISACA COBIT, PCI, HIPAA, SO, GLBA, STIG, NIST , SAS 70, Specs Extensions Commercial Continuous monitoring with a purpose Common technique and nomenclature to request and receive evidence and affirmation of controls from cloud providers Claims, offers, and the basis for auditing service delivery Common interface and namespace to automate the Audit, Assertion, Assessment, and Assurance (A6) of cloud environments Pre-audit checklists and questionnaires to inventory controls Industry-accepted ways to document what security controls exist The recommended foundations for controls Fundamental security principles in assessing the overall security risk of a cloud provider
4 Area Security Architecture Application Security Area ID ID SA-04 Consensus Assessment Questions (Cloud-Specific Assessment) SA-04a - Do you utilize industry standards (Build Security in Maturity Model [BSIMM] Benchmarks, Open Group ACS Trusted Technology Provider Framework, NIST, etc) to "build-in" security for your Systems/Software Development Lifecycle (SDLC)? SA-04b - Do you utilize an automated source-code analysis tool to detect code security defects prior to production? SA-04c - Do you verify that all of your software suppliers adhere to industry standards for Systems/Software Development Lifecycle (SDLC) security? Specification Revisions v1.1 No Change Security Architecture - SA-04 Applications shall be designed in Application Security accordance with industry accepted security standards (i.e., OWASP for web applications) and complies with applicable regulatory and business requirements. Cloud Service Delivery Model Applicability Scope Applicability SaaS PaaS IaaS Service Tenant Provider Compliance Mapping COBIT 4.1 HIPAA / HITECH Act ISO/IEC COBIT 4.1 AI CFR (e)(2)(i) A A A A A A A A A A A NIST SP FedRAMP NIST SP R3 SC-2 NIST SP R3 SC-2 NIST SP R3 SC-3 NIST SP R3 SC-3 NIST SP R3 SC-4 NIST SP R3 SC-4 NIST SP R3 SC-5 NIST SP R3 SC-5 NIST SP R3 SC-6 NIST SP R3 SC-6 NIST SP R3 SC-7 NIST SP R3 SC-7 NIST SP R3 SC-8 NIST SP R3 SC-7 (1) NIST SP R3 SC-9 NIST SP R3 SC-7 (2) NIST SP R3 SC-10 NIST SP R3 SC-7 (3) NIST SP R3 SC-11 NIST SP R3 SC-7 (4) NIST SP R3 SC-12 NIST SP R3 SC-7 (5) NIST SP R3 SC-13 NIST SP R3 SC-7 (7) NIST SP R3 SC-14 NIST SP R3 SC-7 (8) NIST SP R3 SC-17 NIST SP R3 SC-7 (12) NIST SP R3 SC-18 NIST SP R3 SC-7 (13) NIST SP R3 SC-20 NIST SP R3 SC-7 (18) Prvi certifikat na področju varnosti v oblaku Temelji na osnovi dveh gradiv: CSA vodilo ENISA Cloud Computing Risk Assessment Dve vrsti delavnic: CCSK Osnovni (1 dan) CCSK Napredni (2 dni) PCI DSS v2.0 PCI DSS v
5 CSA Application Security Whitepaper: Članstvo v slovenskem odseku Brezplačno Včlanitev preko LinkedIn skupine Cloud Security Alliance, Slovenia Chapter ( Za vsa morebitna vprašanja in sodelovanje pišite: dsavanovic@cloudsecurityalliance.si
CloudTrust Protocol Orientation and Status
CloudTrust Protocol Orientation and Status June 2011 Ron Knode CloudTrust Protocol Orientation Ron Knode to CSA 6 June 2011 Page 1 CloudTrust Protocol Orientation Topics Why is it? What is it? transfer
Robert Brammer. Senior Advisor to the Internet2 CEO Internet2 NET+ Security Assessment Forum. 8 April 2014
Robert Brammer Senior Advisor to the Internet2 CEO rfbtech@internet2.edu Internet2 NET+ Security Assessment Forum 8 April 2014 INTERNET2 NET+ Security Initiative Primary objective -- develop guidance to
Compliance & Security in Azure. April 21, 2018
Compliance & Security in Azure April 21, 2018 Presenter Bio Jeff Gainer, CISSP Senior Information Security & Risk Management Consultant Senior Security Architect Have conducted multiple Third-Party risk
CSA GUIDANCE VERSION 4 S TAT E O F T H E A R T CLOUD SECURITY AND GDPR NOTES. Hing-Yan Lee (Dr.) EVP, APAC, Cloud Security Alliance
CSA GUIDANCE VERSION 4 S TAT E O F T H E A R T CLOUD SECURITY AND GDPR NOTES Hing-Yan Lee (Dr.) EVP, APAC, Cloud Security Alliance ABOUT THE BUILDING SECURITY BEST PRACTICES FOR NEXT GENERATION IT CLOUD
Protecting Sensitive Data in the Cloud. Presented by: Eric Wolff Thales e-security
Protecting Sensitive Data in the Cloud Presented by: Eric Wolff Thales e-security Topics IT Perspectives on Cloud Security Tools for Security in the Cloud XaaS Encryption/Key Management Strategies Tweet
INTO THE CLOUD WHAT YOU NEED TO KNOW ABOUT ADOPTION AND ENSURING COMPLIANCE
INTO THE CLOUD WHAT YOU NEED TO KNOW ABOUT ADOPTION AND ENSURING COMPLIANCE INTRODUCTION AGENDA 01. Overview of Cloud Services 02. Cloud Computing Compliance Framework 03. Cloud Adoption and Enhancing
HITRUST CSF Assurance Program HITRUST, Frisco, TX. All Rights Reserved.
HITRUST CSF Assurance Program HITRUST CSF Assurance Program The Need Organizations facing multiple and varied assurance requirements from a variety of parties Increasing pressure and penalties associated
HITRUST CSF: One Framework
HITRUST CSF: One Framework Leveraging the HITRUST CSF to Support ISO, HIPAA, & NIST Implementation and Compliance, and SSAE 16 SOC Reporting Dr. Bryan Cline, CISSP-ISSEP, CISM, CISA, CCSFP, HCISPP Senior
Exploring Emerging Cyber Attest Requirements
Exploring Emerging Cyber Attest Requirements With a focus on SOC for Cybersecurity ( Cyber Attest ) Introductions and Overview Audrey Katcher Partner, RubinBrown LLP AICPA volunteer: AICPA SOC2 Guide Working
The HITRUST CSF. A Revolutionary Way to Protect Electronic Health Information
The HITRUST CSF A Revolutionary Way to Protect Electronic Health Information June 2015 The HITRUST CSF 2 Organizations in the healthcare industry are under immense pressure to improve quality, reduce complexity,
Iso Controls Checklist File Type S
ISO 27002 CONTROLS CHECKLIST FILE TYPE S PDF - Are you looking for iso 27002 controls checklist file type s Books? Now, you will be happy that at this time iso 27002 controls checklist file type s PDF
Altius IT Policy Collection Compliance and Standards Matrix
Governance Context and Alignment Policy 4.1 4.4 800-26 164.308 12.4 EDM01 IT Governance Policy 5.1 800-30 12.5 EDM02 Leadership Mergers and Acquisitions Policy A.6.1.1 800-33 EDM03 Context Terms and Definitions
NIST Cloud Security Architecture Tool (CSAT) Leveraging Cyber Security Framework to Architect a FISMA-compliant Cloud Solution
NIST Cloud Security Architecture Tool (CSAT) Leveraging Cyber Security Framework to Architect a FISMA-compliant Cloud Solution Dr. Michaela Iorga NIST October 2018 A Triple Inflection Point Marked A New
Altius IT Policy Collection Compliance and Standards Matrix
Governance Context and Alignment Policy 4.1 4.4 800-26 164.308 12.4 EDM01 IT Governance Policy 5.1 800-30 12.5 EDM02 Leadership Mergers and Acquisitions Policy A.6.1.1 800-33 EDM03 Context Terms and Definitions
This presentation is intended to provide an overview of GDPR and is not a definitive statement of the law.
Privacy, Trust, and the General Data Protection Regulation (GDPR) Robertas Tamosaitis Microsoft Business Solution Sales Specialist E-mail: rtamosa@microsoft.com This presentation is intended to provide
Microsoft Azure Security, Privacy, & Compliance
Security, Privacy, & Compliance Andreas Grigull Geschäftsentwicklung Assekuranz Installation von 2000 Servern in 3 Stunden Technology trends: driving cloud adoption BENEFITS Speed Scale Economics Cloud
Introduction to AWS GoldBase
Introduction to AWS GoldBase A Solution to Automate Security, Compliance, and Governance in AWS October 2015 2015, Amazon Web Services, Inc. or its affiliates. All rights reserved. Notices This document
Copyright 2011 EMC Corporation. All rights reserved.
1 2 How risky is the Cloud? 3 Is Cloud worth it? YES! 4 Cloud adds the concept of Supply Chain 5 Cloud Computing Definition National Institute of Standards and Technology (NIST Special Publication 800-145
Performing a Vendor Security Review TCTC 2017 FALL EVENT PRESENTER: KATIE MCINTOSH
Performing a Vendor Security Review TCTC 2017 FALL EVENT PRESENTER: KATIE MCINTOSH 1 Speaker Bio Katie McIntosh, CISM, CRISC, CISA, CIA, CRMA, is the Cyber Security Specialist for Central Hudson Gas &
Model Approach to Efficient and Cost-Effective Third-Party Assurance
Model Approach to Efficient and Cost-Effective Third-Party Assurance 1 CHALLENGES WITH THIRD-PARTY ASSURANCE 2 What s Driving Demand for Increased Assurance? Increasing risk posed by third parties Increasing
Telos and Amazon Web Services (AWS): Accelerating Secure and Compliant Cloud Deployments
` Telos and Amazon Web Services (AWS): Accelerating Secure and Compliant Cloud Deployments Telos Corporation 19886 Ashburn Road Ashburn, VA 24445 www.telos.com ` Introduction Telos Corporation and Amazon
Data Security Standards
Data Security Standards Overall guide The bigger picture of where the standards fit in 2018 Copyright 2017 Health and Social Care Information Centre. The Health and Social Care Information Centre is a
Healthcare and the Cloud:
Healthcare and the Cloud: Pros & Cons of Security and Privacy Information Systems Security Association (ISSA) Healthcare SIG and Cloud Security Alliance (CSA) March 16, 2017 1 Vince Campitelli Enterprise
CSA Consensus Assessments Initiative Questionnaire. May 2017
CSA s Initiative Questionnaire May 2017 2017, Amazon Web Services, Inc. or its affiliates. All rights reserved. Notices This document is provided for informational purposes only. It represents AWS s current
Business Assurance for the 21st Century
14/07/2011 Navigating the Information Assurance landscape AUTHORS Niall Browne NAME AFFILIATION Shared Assessments Program Michael de Crespigny (CEO) Jim Reavis Kurt Roemer Raj Samani Information Security
READ ME for the Agency ATO Review Template
READ ME for the Agency ATO Review Template Below is the template that the FedRAMP Program Management Office (PMO) uses when reviewing an Agency ATO package. Agencies and CSPs should be cautious to not
HITRUST CSF Roadmap for 2018 and Beyond HITRUST Alliance.
HITRUST CSF Roadmap for 2018 and Beyond HITRUST CSF Roadmap 2017 HITRUST CSF v9 Update 21 CFR Part 11 (FDA electronic signatures) Add FFIEC IT Examination (InfoSec), FedRAMP, DHS Critical Resilience Review
Best Practices & Lesson Learned from 100+ ITGRC Implementations
Best Practices & Lesson Learned from 100+ ITGRC Implementations Presenter: Vivek Shivananda CEO of Rsam Dec 3, 2010 ISACA -NY Chapter Copyright 2002 2010 Relational Security Corp. (dba Rsam) Agenda Overview
Table of Contents. Preface xvii PART ONE: FOUNDATIONS OF MODERN INTERNAL AUDITING
Table of Contents Preface xvii PART ONE: FOUNDATIONS OF MODERN INTERNAL AUDITING Chapter 1: Significance of Internal Auditing in Enterprises Today: An Update 3 1.1 Internal Auditing History and Background
Introduction to the HITRUST CSF. Version 8.1
Version 8.1 February 2017 Contents Executive Summary.... 3 Organization of the HITRUST CSF.... 3 Practical Action Plan for Implementing the HITRUST CSF... 4 Introduction.... 5 Organization of the HITRUST
Certified Information Security Manager (CISM) Course Overview
Certified Information Security Manager (CISM) Course Overview This course teaches students about information security governance, information risk management, information security program development,
HITRUST Common Security Framework - Are you prepared?
ALLINIAL HITRUST Common Security Framework - Are you prepared? Michael Kanarellis, HITRUST CCSFP May 17, 2017 MEMBER OF PKF ALLINIAL NORTH GLOBAL, AMERICA, AN ASSOCIATION AN OF LEGALLY OF LEGALLY INDEPENDENT
ISACA Arizona May 2016 Chapter Meeting
ISACA Arizona May 2016 Chapter Meeting Suzanne Farr / Carlos A. Villalba Agenda Introduction Preliminary questions CCM Preliminaries Definition Benefits Challenges Beyond Templates Questions 1 Background
COMPLIANCE IN THE CLOUD
COMPLIANCE IN THE CLOUD 3:45-4:30PM Scott Edwards, President, Summit 7 Dave Harris Society for International Affairs COMPLIANCE IN THE CLOUD Scott Edwards scott.edwards@summit7systems.com 256-541-9638
Cloud Security. Copyright Ramesh Nagappan. All rights reserved.
Cloud Security 1 Cloud Security Week 1 Lecture 1 Ramesh Nagappan Harvard University Extension School Brandeis University GPS 2 Week 1 Lecture - 1 Course Introduction Evolution of Cloud Computing Introduction
HITRUST ON THE CLOUD. Navigating Healthcare Compliance
HITRUST ON THE CLOUD Navigating Healthcare Compliance As the demand for digital health solutions increases, the IT regulatory landscape continues to evolve. Staying ahead of new cybersecurity rules and
How to ensure control and security when moving to SaaS/cloud applications
How to ensure control and security when moving to SaaS/cloud applications Stéphane Hurtaud Partner Information & Technology Risk Deloitte Laurent de la Vaissière Directeur Information & Technology Risk
Introduction to the HITRUST CSF. Version 9.1
Introduction to the HITRUST CSF Version 9.1 February 2018 Contents Executive Summary.... 3 Organization of the HITRUST CSF... 3 Practical Action Plan for Implementing the HITRUST CSF... 4 Introduction....
Defining the S&P Impacts of Cloud Computing? Presented by the SPWG September 20, 2012
Defining the S&P Impacts of Cloud Computing? Presented by the SPWG September 20, 2012 Today s Presenters Lesley Berkeyheiser, SPWG co-chair, moderator Lola Jordan, President, Companion Data Services Susan
Building Trust in the Era of Cloud Computing
Building Trust in the Era of Cloud Computing ICMC 2017 Conference May 17, 2017 v1.0 David Gerendas Group Product Manager TRUST A FIRM belief in the! Reliability! Truth! Ability of someone or something.
Table of Contents. AIS Application & Interface Security Application Security...20
Table of Contents AIS Application & Interface Security...20 01.1 Application Security...20 1 Do you use industry standards (Build Security in Maturity Model [BSIMM] benchmarks, Open Group ACS Trusted Technology
SDLC Maturity Models
www.pwc.com SDLC Maturity Models SecAppDev 2017 Bart De Win Bart De Win? 20 years of Information Security Experience Ph.D. in Computer Science - Application Security Author of >60 scientific publications
Effective Strategies for Managing Cybersecurity Risks
October 6, 2015 Effective Strategies for Managing Cybersecurity Risks Larry Hessney, CISA, PCI QSA, CIA 1 Everybody s Doing It! 2 Top 10 Cybersecurity Risks Storing, Processing or Transmitting Sensitive
SERVICE ORGANIZATION CONTROL (SOC) REPORTS: WHAT ARE THEY?
WHITE PAPER SERVICE ORGANIZATION CONTROL (SOC) REPORTS: WHAT ARE THEY? JEFF COOK DIRECTOR CPA, CITP, CIPT, CISA North America Europe 877.224.8077 info@coalfire.com coalfire.com TABLE OF CONTENTS Summary...
Auditing the Cloud. Paul Engle CISA, CIA
Auditing the Cloud Paul Engle CISA, CIA About the Speaker Paul Engle CISA, CIA o Fifteen years performing internal audit, IT internal audit, and consulting projects o Internal audit clients include ADP,
Protecting vital data with NIST Framework
Protecting vital data with NIST Framework About me Patrick Kerpan CEO at Cohesive Networks @pjktech BANKS About Cohesive Networks 2,000+ customers protect cloudbased applications User-controlled security
Mapping of FedRAMP Tailored LI SaaS Baseline to ISO Security Controls
Mapping of FedRAMP Tailored LI SaaS Baseline to ISO 27001 Security Controls This document provides a list of all controls that require the Cloud Service Provider, Esri, to provide detailed descriptions
Decoding security frameworks for effective cyber defense. David Allott McAfee
Decoding security frameworks for effective cyber defense David Allott McAfee $171B Cost of cybercrime Frameworks useful or just another distracting trend? What are the analysts saying? What is the industry
Leveraging HITRUST CSF Assessment Reports
Leveraging HITRUST CSF Assessment Reports A Guide for New Users 1 Covered Entity Challenges with Third Party Assurance Business Associate Challenges with Third Party Assurance Complex contracting process
HCL GRC IT AUDIT & ASSURANCE SERVICES
HCL GRC IT AUDIT & ASSURANCE SERVICES Overview The immense progress made in information and communications technology offers enterprises outstanding benefits. However this also results in making the risk
MIS Week 9 Host Hardening
MIS 5214 Week 9 Host Hardening Agenda NIST Risk Management Framework A quick review Implementing controls Host hardening Security configuration checklist (w/disa STIG Viewer) NIST 800-53Ar4 How Controls
COPYRIGHTED MATERIAL. Index
Index 2014 revised COSO framework. See COSO internal control framework Association of Certified Fraud Examiners (ACFE), 666 Administrative files workpaper document organization, 402 AICPA fraud standards
Securing the cloud ISACA Korea. Han Ther, Lee CISA, CISM, CISSP, CRISC, ITILF, MCSA
Securing the cloud ISACA Korea Han Ther, Lee CISA, CISM, CISSP, CRISC, ITILF, MCSA What is cloud computing? Source: Wikipedia 2 What is cloud computing A model for enabling:- convenient on-demand network
SoftLayer Security and Compliance:
SoftLayer Security and Compliance: How security and compliance are implemented and managed Introduction Cloud computing generally gets a bad rap when security is discussed. However, most major cloud providers
Cloud Security Frameworks. GITI May 8, 2014
Cloud Security Frameworks GITI May 8, 2014 about: me CEO: Antoine Coetsier! Infrastructure and datacenters expert! Team and datacenter Manager for more than 10 years Experience! Managing Director of exoscale
SOC Lessons Learned and Reporting Changes
SOC Lessons Learned and Reporting Changes Dec. 16, 2014 Your Presenters Today Arshad Ahmed, CISA, CISSP, CPA Leader of SOC and Technology Risk Services for Crowe Rod Smith, CISA, CPA Thought Leader for
Virtualization Security & Audit. John Tannahill, CA, CISM, CGEIT, CRISC
Virtualization Security & Audit John Tannahill, CA, CISM, CGEIT, CRISC jtannahi@rogers.com Session Overview Virtualization Concepts Virtualization Technologies Key Risk & Control Areas Audit Programs /
AZURE CLOUD SECURITY GUIDE: 6 BEST PRACTICES. To Secure Azure and Hybrid Cloud Environments
AZURE CLOUD SECURITY GUIDE: 6 BEST PRACTICES To Secure Azure and Hybrid Cloud Environments Introduction Cloud is at the core of every successful digital transformation initiative. With cloud comes new
PCI DSS Compliance and the Cloud
PCI DSS Compliance and the Cloud Daniel Farr, Managing Consultant CyberSecurity Consulting PCI & Compliance Services DF&IR Risk Reduction Solutions www.foregenix.com A Brief History of Foregenix Foregenix
Aligning IT, Security and Risk Management Programs. Ahmed Qurram Baig, CISSP, CBCP, CRISC, CISM Information Security & GRC Expert
Aligning IT, Security and Risk Management Programs Ahmed Qurram Baig, CISSP, CBCP, CRISC, CISM Information Security & GRC Expert Challenges to Risk Management & Governance Balancing extensive requirements
Recommendations for Implementing an Information Security Framework for Life Science Organizations
Recommendations for Implementing an Information Security Framework for Life Science Organizations Introduction Doug Shaw CISA, CRISC Director of CSV & IT Compliance Azzur Consulting Agenda Why is information
Using Metrics to Gain Management Support for Cyber Security Initiatives
Using Metrics to Gain Management Support for Cyber Security Initiatives Craig Schumacher Chief Information Security Officer Idaho Transportation Dept. January 2016 Why Metrics Based on NIST Framework?
2018 HIPAA One All Rights Reserved. Beyond HIPAA Compliance to Certification
2018 HIPAA One All Rights Reserved. Beyond HIPAA Compliance to Certification Presenters Jared Hamilton CISSP CCSK, CCSFP, MCSE:S Healthcare Cybersecurity Leader, Crowe Horwath Erika Del Giudice CISA, CRISC,
OWASP - SAMM. OWASP 12 March The OWASP Foundation Matt Bartoldus Gotham Digital Science
OWASP - SAMM Matt Bartoldus Gotham Digital Science OWASP 12 March 2009 Copyright The OWASP Foundation Permission is granted to copy, distribute and/or modify this document under the terms of the OWASP
Accelerate GDPR compliance with the Microsoft Cloud Ole Tom Seierstad National Security Officer Microsoft Norway
Accelerate GDPR compliance with the Microsoft Cloud Ole Tom Seierstad National Security Officer Microsoft Norway This presentation is intended to provide an overview of GDPR and is not a definitive statement
SOC 3 for Security and Availability
SOC 3 for Security and Availability Independent Practioner s Trust Services Report For the Period October 1, 2015 through September 30, 2016 Independent SOC 3 Report for the Security and Availability Trust
CLOUD COMPUTING. The Old Ways Are New Again. Jeff Rowland, Vice President, USAA IT/Security Audit Services. Public Information
CLOUD COMPUTING The Old Ways Are New Again Jeff Rowland, Vice President, USAA IT/Security Audit Services Public Information Who We Are Our Mission The mission of the association is to facilitate the financial
The Business of Security in the Cloud
The Business of Security in the Cloud Dr. Pamela Fusco Vice President Industry Solutions Solutionary Inc. CISSP, CISM, CHSIII, IAM, NSA/CSS Adjunct Faculty Promises Promises The promise of cloud computing
Cybersecurity Best Practices
Cybersecurity Best Practices Securing Your Organization, Systems and Platforms Health IT Summit The Cybersecurity Forum August 2017 Tony Sager Sr. Vice President and Chief Evangelist, CIS 1 Classic Risk
Managing SaaS risks for cloud customers
Managing SaaS risks for cloud customers Information Security Summit 2016 September 13, 2016 Ronald Tse Founder & CEO, Ribose For every IaaS/PaaS, there are 100s of SaaS PROBLEM SaaS spending is almost
SECURETexas Health Information Privacy & Security Certification Program
Partners in Texas Health Informa3on Protec3on SECURETexas Health Information Privacy & Security Certification Program 2015 HITRUST, Frisco, TX. All Rights Reserved. Outline Introduction Background Benefits
Security and Privacy Mechanisms: An Analysis of Cloud Service Providers for the US Government
Security and Privacy Mechanisms: An Analysis of Cloud Service Providers for the US Government April 13, 2016 Presenter: Carlo Di Giulio Advisor: Dr. Masooda Bashir Focus of the Research Security and privacy
SaaS Security in Healthcare: Can the Fox Guard the Hen House? Pros and Cons of an In-House Security Validation and a Third- Party SOC 2 Audit
SaaS Security in Healthcare: Can the Fox Guard the Hen House? Pros and Cons of an In-House Security Validation and a Third- Party SOC 2 Audit Nick Lewis, Internet2 Dion Taylor, Univ. of Michigan Peter
A New Methodology for Security Evaluation in Cloud Computing
A New Methodology for Security Evaluation in Cloud Computing Sasko Ristov Ss. Cyril and Methodius University Faculty of Information Sciences and Computer Engineering Skopje, Macedonia Email: sashko.ristov@finki.ukim.mk
CLOUD COMPUTING APPLYING THIS NEW TECHNOLOGY TO YOUR PRACTICE
CLOUD COMPUTING APPLYING THIS NEW TECHNOLOGY TO YOUR PRACTICE Douglas W. Barbin, CPA, CISSP, PCI QSA, CCSK BrightLine CPAs & Associates, Inc. November 4, 2011 Divorced after 72 Days AGENDA ANDOVERVIEW
PROFESSIONAL SERVICES (Solution Brief)
(Solution Brief) The most effective way for organizations to reduce the cost of maintaining enterprise security and improve security postures is to automate and optimize information security. Vanguard
Four Deadly Traps of Using Frameworks NIST Examples
Four Deadly Traps of Using Frameworks NIST 800-53 Examples ISACA Feb. 2015 Meeting Doug Landoll dlandoll@lantego.com (512) 633-8405 Session Agenda Framework Definition & Uses NIST 800-53 Framework Intro
Analysis of ISO 27001:2013 Controls Effectiveness for Cloud Computing
Analysis of ISO 27001:2013 Controls Effectiveness for Cloud Computing Muhammad Imran Tariq 1 and Vito Santarcangelo 2,3 1 Superior University, 36-L, Gulberg-III, Lahore, Pakistan 2 Centro Studi S.r.l,
ISO & ISO & ISO Cloud Documentation Toolkit
ISO & ISO 27017 & ISO 27018 Cloud ation Toolkit Note: The documentation should preferably be implemented order in which it is listed here. The order of implementation of documentation related to Annex
Top Reasons To Audit An IAM Program. Bryan Cook Focal Point Data Risk
Top Reasons To Audit An IAM Program Bryan Cook Focal Point Data Risk Focal Point Data Risk A New Type of Risk Management Firm THE FACTS Born from the merger of three leading security & risk management
Cloud Governance. ISACA Information Security & Risk Conference Halifax NS
Cloud Governance ISACA Information Security & Risk Conference Halifax NS November 2017 a Swiss entity. All rights reserved. The KPMG name and logo are registered trademarks or trademarks of KPMG International.
Standard Response to Request for Information. Microsoft Azure Security, Privacy, and Compliance. March 2017 Version 4
Standard Response to Request for Information Microsoft Azure Security, Privacy, and Compliance March 2017 Version 4 Abstract This response document helps address standard Requests for Information (RFI)
Welcome ControlCase Conference. Kishor Vaswani, CEO
Welcome ControlCase Conference Kishor Vaswani, CEO Agenda About ControlCase Key updates since last conference Certification methodology and support for new regulations Constant Compliance offering introduced
REDUCING RISK THROUGH CODE REVIEW. Gary Robinson (CISSP) OWASP
REDUCING RISK THROUGH CODE REVIEW Gary Robinson (CISSP) OWASP WHAT ARE WE GOING TO DISCUSS Suggestions and practices for moving secure SDLC governance to the Code Review gate Methodologies brought together
Right-sizing Risk and Compliance for Small to Mid-size Companies. Susanne Elizer Practice Director Accretive Solutions Professional Strategies S32
Right-sizing Risk and Compliance for Small to Mid-size Companies Susanne Elizer Practice Director Accretive Solutions Professional Strategies S32 Compliance Jeopardy Sectors Famous Cases Intl Enforcers
UCOP ITS Systemwide CISO Office Systemwide IT Policy. UC Event Logging Standard. Revision History. Date: By: Contact Information: Description:
UCOP ITS Systemwide CISO Office Systemwide IT Policy UC Event Logging Standard Revision History Date: By: Contact Information: Description: 05/02/18 Robert Smith robert.smith@ucop.edu Approved by the CISOs
Microsoft 365 Das modern Büro der Zukunft
Microsoft 365 Das modern Büro der Zukunft DI. Harald Leitenmüller Chief Technology Officer 3. Digital Business Forum, 14. Sept. 2017 Microsoft Österreich GmbH. Cloud Principles Standardisierung Automatisierung
Hong%Kong%Information%and%System%Security%Professional%Association
Framework&Of&Information&Technology&Integrated&Compliances& LAYER&1 International&De5inition&Of&Digital&Evidence LAYER&2 LAYER&3 Common&Criteria&And&Scope&Of&Information& Technology&Management Industry&Standard&And&Requirement&Of&Information&
EU Cloud Computing Policy. Luis C. Busquets Pérez 26 September 2017
EU Cloud Computing Policy Luis C. Busquets Pérez 26 September 2017 The digital revolution is built on data Most economic activity will depend on data within a decade Potential of the data-driven economy
Introduction. Angela Holzworth, RHIA, CISA, GSEC. Kimberly Gray, Esq., CIPP/US. Sr. IT Infrastructure Analyst
Introduction Angela Holzworth, RHIA, CISA, GSEC Sr. IT Infrastructure Analyst Kimberly Gray, Esq., CIPP/US Chief Privacy Officer, Global, IMS Health 1 Incorporating Privacy into the CSF: Approach and Benefits
Assurance through the ISO27002 Standard and the US NIST Cybersecurity Framework. Keith Price Principal Consultant
Assurance through the ISO27002 Standard and the US NIST Cybersecurity Framework Keith Price Principal Consultant 1 About About me - Specialise in cybersecurity strategy, architecture, and assessment -
PCI Policy Compliance Using Information Security Policies Made Easy. PCI Policy Compliance Information Shield Page 1
PCI Policy Compliance Using Information Security Policies Made Easy PCI Policy Compliance Information Shield Page 1 PCI Policy Compliance Using Information Security Policies Made Easy By David J Lineman
The Experience of Generali Group in Implementing COBIT 5. Marco Salvato, CISA, CISM, CGEIT, CRISC Andrea Pontoni, CISA
The Experience of Generali Group in Implementing COBIT 5 Marco Salvato, CISA, CISM, CGEIT, CRISC Andrea Pontoni, CISA Generali Group at a glance Let me introduce myself Marco Salvato CISA, CISM, CGEIT,
ISACA Cincinnati Chapter March Meeting
ISACA Cincinnati Chapter March Meeting Recent and Proposed Changes to SOC Reports Impacting Service and User Organizations. March 3, 2015 Presenters: Sayontan Basu-Mallick Lori Johnson Agenda SOCR Overview
Enhanced Privacy ID (EPID), 156
Index A Accountability, 148 ActiveDirectory, 153 Amazon AWS EC2, 168 Anonymity, 148 Asset tagging, 96 Attestation definition, 65 dynamic remote attestation techniques, 66 IMA, 67 Intel Trust Attestation
Using the NIST Cybersecurity Framework to Guide your Security Program August 31, 2017
Using the NIST Cybersecurity Framework to Guide your Security Program August 31, 2017 Presenters: Allie Russell, Conexxus Kara Gunderson, DSSC Chair, CITGO Petroleum Chris Lietz & Bob Post, Coalfire Housekeeping
SECURITY AUTOMATION SIMPLIFIED VIA NIST OSCAL: WE RE NOT IN KANSAS ANYMORE
SESSION ID: GRC-F01 SECURITY AUTOMATION SIMPLIFIED VIA NIST OSCAL: WE RE NOT IN KANSAS ANYMORE David Waltermire Security Automation Architect National Institute of Standards and Technology (NIST) Anil
Peer Collaboration The Next Best Practice for Third Party Risk Management
SESSION ID: GRM-F02 Peer Collaboration The Next Best Practice for Third Party Risk Management Robin M. Slade EVP & COO The Santa Fe Group & Shared Assessments Program Introduction Q: How do we achieve
USING QUALYSGUARD TO MEET SOX COMPLIANCE & IT CONTROL OBJECTIVES
WHITE PAPER USING QUALYSGUARD TO MEET SOX COMPLIANCE & IT CONTROL OBJECTIVES Table of Contents I. Overview II. COSO to CobIT III. CobIT / COSO Objectives met by using QualysGuard 2 3 4 Using QualysGuard
Trust is not a Control... But you s1ll have to have it. (Or How I learned to Stop Worrying and (HI)TRUST Control Compliance Suite)
Trust is not a Control... But you s1ll have to have it. (Or How I learned to Stop Worrying and (HI)TRUST Control Compliance Suite) David Finn, CISA, CISM, CRISC Health IT Officer, Symantec 1 Objec1ves