THE PROCESS FOR ESTABLISHING DATA CLASSIFICATION. Session #155

Save this PDF as:
 WORD  PNG  TXT  JPG

Size: px
Start display at page:

Download "THE PROCESS FOR ESTABLISHING DATA CLASSIFICATION. Session #155"

Transcription

1 THE PROCESS FOR ESTABLISHING DATA CLASSIFICATION Session #155

2 David Forrestall, CISSP CISA SecurIT360 SPEAKERS Carl Scaffidi, CISSP, ISSAP, CEH, CISM Director of Information Security Baker Donelson

3 AGENDA Overview Legal Strategy Implementation Protection Strategies Benefits of DLP References

4 OVERVIEW AND STATEGY

5 DATA PROTECTION LIFECYCLE Understand Classify Data Improve and remediate Protect

6 BASICS Definition - in the context of information security, is the classification of data based on its level of sensitivity and the impact to the Organization should that data be disclosed, altered or destroyed without authorization. Purpose To apply proper security to different levels of sensitivity

7 DATA CLASSIFICATION STANDARDS Government ISO ISACA Others

8 CLASSIFICATION PROCEDURES 1. Define Classification Levels 2. Specify the Criteria by which data will be classified 3. Have the Data Owner indicate the classification level 4. Identify the data custodian who will be responsible for maintaining the data and its security level 5. Indicate the controls to be applied at each classification level

9 Definition categorization of information based on sensitivity Purpose To apply proper security to different levels of sensitivity

10

11 PRACTICAL APPLICATION

12 PRACTICAL APPLICATION (2)

13 AS YOU MATURE

14 SUGGESTED CLASSES FOR LAW FIRMS 1. Public or non- sensitive 2. Firm Internal 3. Confidential Internal 4. Client Confidential 5. Highly Confidential Client

15 SUGGESTED CLASSES FOR LAW FIRMS 1. Public or non- sensitive Public information may be shared with no risk of negative impact to the firm or its clients (i.e. the data is not confidential). Data integrity is not vital. Loss of service due to malicious attacks is an acceptable danger. 2. Firm Internal External access to this information is to be prevented, but should this data become public, the consequences are not critical and would have minimal impact to the firm. Data integrity is important but not vital.

16 SUGGESTED CLASSES FOR LAW FIRMS (2) 3. Confidential Internal Information in this class is confidential within the firm and protected from external access. If such data was accessed by unauthorized persons, it could influence the firm's operational effectiveness, cause an important financial loss, cause reputational risk to the firm. Data integrity is critical. 4. Client Confidential Under the governing rules of professional responsibility, nearly all data relating to client representations requires protection. Unauthorized external access to this data would be damaging to the firm. Data integrity is vital. Strict rules should be adhered to in the usage of this data.

17 SUGGESTED CLASSES FOR LAW FIRMS (3) 5. Highly Confidential Client Client and firm data regulated with additional security requirements. Unauthorized internal OR external access to this data could have a major impact to the firm. Breach notification is required. Fines and other penalties could occur. Data integrity is vital. Examples: Banking, Healthcare, Military, minors, and other types of data governed by legislating bodies.

18 FOR EACH CLASS Examples: Banking, Healthcare, Military, minors, and other types of data governed by legislating bodies. Access: employees with a business need to know. As required by client, access will be restricted only to Attorneys and staff that have been assigned to client engagements. Distribution within : Standard interoffice mail, approved electronic mail and encrypted electronic file transmission methods. Distribution outside of : U.S. mail and other public or private carriers, approved encrypted electronic mail and electronic file transmission methods. Electronic distribution: All highly confidential client information should be transferred using encryption. Storage and backup: Keep from view of unauthorized people; erase whiteboards, do not leave in view on tabletop. Highly Confidential Client information should not be stored on devices or media that is not owned or managed by. When stored on removable media, information should be encrypted, password protected, or both. Highly Confidential Client information should be backed up following normal procedures. Disposal/Destruction: Deposit outdated paper information in specially marked disposal bins on premises; electronic data should be expunged/cleared. Reliably erase or physically destroy media.

19 LEGAL MATRIX

20 DATA PROTECTION

21 DATA PROTECTION LIFECYCLE Understand Classify Data Improve and remediate Protect

22 DATA PROTECTION LIFE CYCLE STEPS 1. Understand 2. Classify 3. Protect 4. Monitor 5. Improve and remediate

23 PROTECTING DATA People Policy Process Education Technology DLP

24 WHERE DOES DATA LIVE Servers Laptops and Desktops Cloud Collaboration (SharePoint, etc) Removable Media Mobile

25 HOW CAN DATA BE LOST Loss or theft of laptops and mobile devices Sensitive data stored in unprotected locations DATA LOSS Unauthorized transfer of data to portable media File sharing/p2p Instant messaging, social media, and personal web mail Copying/printing of sensitive data Corporate

26 DATA LOSS EVENTS OCCUR DAILY AND COST ORGANIZATIONS MILLIONS OF DOLLARS Impact of data loss incidents: Significant incident response costs and legal fees Regulatory fines Reputational damage Brand loyalty switch Loss of investor confidence Erosion of trust Customer turnover Loss of competitive advantage According to the 2016 Ponemon Institute study, the consolidated total cost per data breach was $4 million. ($158 per compromised record)

27 THINK LIKE AN OUTSIDER WHAT TYPES OF INFORMATION ARE MOST LIKELY TO BE TARGETED? Examples of questions that should be discussed with data owners include: What data would hurt us the most if it fell into the wrong hands? What information gives us competitive advantage in the market? What data would someone want to steal? What knowledge makes us better than our competition? Where are we investing in research and development? What would we be very embarrassed to lose? What data would trigger compliance requirements?

28 DATA LOSS IS A SIGNIFICANT RISK Personally identifiable information (PII) Intellectual property Proprietary information Examples of sensitive data types Names, addresses, addresses, phone numbers and demographic information Social security numbers and other national identifiers Banking information and credit card numbers Personal health information (PHI) Product designs Source code Pending patents Formulations Manufacturing process instructions and procedures Research and development results and analysis Exploration data Customer lists Pricing, cost and sales information Pre-released financial results Merger and acquisition information Third-party contracts Strategy and product road maps Bid plans Scientific papers

29 DLP DATA LOSS PREVENTION

30 Data Governance Policies and standards Identification Risk assessment Classification Architecture Quality Data protection controls Data in motion Perimeter security Structured data Data in use Privileged user monitoring Data at rest Encryption Focus areas Network traffic monitoring/blocking Web content filtering Data collection and exchange Messaging ( , IM) Workstation restrictions Application controls Data labelling/tagging Removable/external media control Obfuscation/tokenization Mobile device protection Network/server repository control Physical media control Remote access Export/clipboard/print control Archive, disposal and destruction Unstructured data Supporting information security processes Identity/Access management Security information management Configuration management Vulnerability management Digital rights management Incident response Physical security Training and awareness Asset management Data privacy Employee screening and vetting Third party management BCP/DR Records management Risk management and reporting Change management/sdlc

31 DATA IN USE Active data user is currently interacting with Screen Capture Copy/Paste Print & Fax Document editing and creation

32 DATA IN MOTION Data currently traversing through a network Internal or External Instant Messaging Websites

33 DATA AT REST Data being stored Hard drives NAS File Servers Databases Removable Media Backups

34 DLP SOLUTIONS Data Matching Structured Data Fingerprinting Statistical Methods Rule and RegEx Matching Published Lexicons Conceptual Definitions Keywords

35 TECHNICAL SOLUTION DEPLOYMENT Endpoint Control user capabilities on endpoint systems Data in Use Workstations Network Prevention Detect sensitive data flowing through border and block traffic which violates DLP rules Data at Rest Switch , SSL, Web proxy Databases or Repositories Data in Motion Switch Network Discovery Scan the network and specific hosts/shares to identify and report (and potentially quarantine) unprotected sensitive data Network Monitoring Detect and report on sensitive data in motion Internet

36 RULE ENFORCEMENT Data is scanned Data rule is triggered Data is actioned

37 PROGRAM BENEFITS Data compliance for audits Meet certification requirements Streamlined risk management Improved Recovery Time Objective (RTO) Streamlined user access and collaboration Simplified encryption Actionable security intelligence SIEM integration Monitor for sensitive info based on classification Alert for data leakage Active data leakage deterrence

38 PROGRAM CHALLENGES Difficulty in identifying all relevant data loss channels within the organization Complexity of information flows within the extended enterprise User capabilities to access, copy and send sensitive data outside of the company, including across borders Growing number and complexity of regulatory requirements to protect sensitive information, particularly for companies operating in many different states and internationally Lack of forensic / incident response capabilities to effectively respond to data loss and data breaches Encryption tools allow malicious users to hide their activity from most DLP technology Maximizing the value of a data

39 FUNDAMENTAL QUESTIONS TO ANSWER What sensitive data do you hold? What is your highest risk sensitive data considering personally identifiable data, customer data and intellectual property? Where does your sensitive data reside, both internally and with third parties? Where is your data going? Do you comply with the relevant data privacy laws?

40 ADDITIONAL QUESTIONS FOR THE BOARD & C-SUITE Are you confident your intellectual property, trade secrets, proprietary information and customer data are protected from insiders? Are your regulatory and compliance obligations for data protection and privacy being met? Does your Information Security function know what data is most valuable to the business? Are stakeholders inquiring what the organization is doing to proactively protect sensitive information? Have you had a significant data loss incident in the past?

41 REFERENCES Google data classification policy for Word & Excel Templates

Data Loss Prevention:

Data Loss Prevention: Data Loss Prevention: Considerations from an IT Audit Perspective ISACA November Luncheon 11 November 2010 Agenda What is data loss prevention (DLP)? Ernst & Young point of view on DLP Data loss risk assessment

More information

Security Policies and Procedures Principles and Practices

Security Policies and Procedures Principles and Practices Security Policies and Procedures Principles and Practices by Sari Stern Greene Chapter 3: Information Security Framework Objectives Plan the protection of the confidentiality, integrity and availability

More information

Best Practices for a Successful DLP Deployment

Best Practices for a Successful DLP Deployment Best Practices for a Successful DLP Deployment TITUS White Paper Information in this document is subject to change without notice. Complying with all applicable copyright laws is the responsibility of

More information

Checklist: Credit Union Information Security and Privacy Policies

Checklist: Credit Union Information Security and Privacy Policies Checklist: Credit Union Information Security and Privacy Policies Acceptable Use Access Control and Password Management Background Check Backup and Recovery Bank Secrecy Act/Anti-Money Laundering/OFAC

More information

McAfee Total Protection for Data Loss Prevention

McAfee Total Protection for Data Loss Prevention McAfee Total Protection for Data Loss Prevention Protect data leaks. Stay ahead of threats. Manage with ease. Key Advantages As regulations and corporate standards place increasing demands on IT to ensure

More information

EU GDPR & NEW YORK CYBERSECURITY REQUIREMENTS 3 KEYS TO SUCCESS

EU GDPR & NEW YORK CYBERSECURITY REQUIREMENTS 3 KEYS TO SUCCESS EU GDPR & NEW YORK CYBERSECURITY REQUIREMENTS 3 KEYS TO SUCCESS MEET THE EXPERTS DAVID O LEARY Director, Forsythe Security Solutions THOMAS ECK Director, Forsythe Security Solutions ALEX HANWAY Product

More information

ISO/IEC Solution Brief ISO/IEC EventTracker 8815 Centre Park Drive, Columbia MD 21045

ISO/IEC Solution Brief ISO/IEC EventTracker 8815 Centre Park Drive, Columbia MD 21045 Solution Brief 8815 Centre Park Drive, Columbia MD 21045 About delivers business critical software and services that transform high-volume cryptic log data into actionable, prioritized intelligence that

More information

Information Security Policy

Information Security Policy April 2016 Table of Contents PURPOSE AND SCOPE 5 I. CONFIDENTIAL INFORMATION 5 II. SCOPE 6 ORGANIZATION OF INFORMATION SECURITY 6 I. RESPONSIBILITY FOR INFORMATION SECURITY 6 II. COMMUNICATIONS REGARDING

More information

NORTH AMERICAN SECURITIES ADMINISTRATORS ASSOCIATION Cybersecurity Checklist for Investment Advisers

NORTH AMERICAN SECURITIES ADMINISTRATORS ASSOCIATION Cybersecurity Checklist for Investment Advisers Identify Protect Detect Respond Recover Identify: Risk Assessments & Management 1. Risk assessments are conducted frequently (e.g. annually, quarterly). 2. Cybersecurity is included in the risk assessment.

More information

Archiving. Services. Optimize the management of information by defining a lifecycle strategy for data. Archiving. ediscovery. Data Loss Prevention

Archiving. Services. Optimize the management of information by defining a lifecycle strategy for data. Archiving. ediscovery. Data Loss Prevention Symantec Enterprise Vault TransVault CommonDesk ARCviewer Vault LLC Optimize the management of information by defining a lifecycle strategy for data Backup is for recovery, archiving is for discovery.

More information

Data Compromise Notice Procedure Summary and Guide

Data Compromise Notice Procedure Summary and Guide Data Compromise Notice Procedure Summary and Guide Various federal and state laws require notification of the breach of security or compromise of personally identifiable data. No single federal law or

More information

A company built on security

A company built on security Security How we handle security at Flywheel Flywheel was founded in 2012 on a mission to create an exceptional platform to help creatives do their best work. As the leading WordPress hosting provider for

More information

ANATOMY OF A DATA BREACH: DEVELOPMENTS IN DATA SECURITY AND CLOUD COMPUTING LAW

ANATOMY OF A DATA BREACH: DEVELOPMENTS IN DATA SECURITY AND CLOUD COMPUTING LAW ANATOMY OF A DATA BREACH: DEVELOPMENTS IN DATA SECURITY AND CLOUD COMPUTING LAW Janis Kestenbaum (Federal Trade Commission) John O Tuel (GlaxoSmithKline) Alfred Saikali (Shook Hardy & Bacon) Christopher

More information

FFIEC Cyber Security Assessment Tool. Overview and Key Considerations

FFIEC Cyber Security Assessment Tool. Overview and Key Considerations FFIEC Cyber Security Assessment Tool Overview and Key Considerations Overview of FFIEC Cybersecurity Assessment Tool Agenda Overview of assessment tool Review inherent risk profile categories Review domain

More information

Cyber Security. The Question of the Day. Sylint Group, Inc. How did we come up with the company name Sylint and what does it mean?

Cyber Security. The Question of the Day. Sylint Group, Inc. How did we come up with the company name Sylint and what does it mean? Cyber Security One of the Most Critical Risk Mitigation Efforts to Bridge the Gap Between Compliance and Ethics Charly Shugg, Brigadier General, USAF, Retired Partner Chief Operating Officer Sylint Group,

More information

HIPAA Compliance: What it is, what it means, and what to do about it. Adam Carlson, Security Solutions Consultant Intapp

HIPAA Compliance: What it is, what it means, and what to do about it. Adam Carlson, Security Solutions Consultant Intapp HIPAA Compliance: What it is, what it means, and what to do about it. Adam Carlson, Security Solutions Consultant Intapp Agenda Introductions HIPAA Background and History Overview of HIPAA Requirements

More information

Preventing Corporate Espionage: Investigations, Data Analyses and Business Intelligence

Preventing Corporate Espionage: Investigations, Data Analyses and Business Intelligence Preventing Corporate Espionage: Investigations, Data Analyses and Business Intelligence Presented by Keith Barger and Audra A. Dial March 19, 2014 2014 Kilpatrick Townsend & Stockton LLP Protection of

More information

ISO COMPLIANCE GUIDE. How Rapid7 Can Help You Achieve Compliance with ISO 27002

ISO COMPLIANCE GUIDE. How Rapid7 Can Help You Achieve Compliance with ISO 27002 ISO 27002 COMPLIANCE GUIDE How Rapid7 Can Help You Achieve Compliance with ISO 27002 A CONTENTS Introduction 2 Detailed Controls Mapping 3 About Rapid7 8 rapid7.com ISO 27002 Compliance Guide 1 INTRODUCTION

More information

CloudSOC and Security.cloud for Microsoft Office 365

CloudSOC and  Security.cloud for Microsoft Office 365 Solution Brief CloudSOC and Email Security.cloud for Microsoft Office 365 DID YOU KNOW? Email is the #1 delivery mechanism for malware. 1 Over 40% of compliance related data in Office 365 is overexposed

More information

GM Information Security Controls

GM Information Security Controls : Table of Contents 2... 2-1 2.1 Responsibility to Maintain... 2-2 2.2 GM s Right to Monitor... 2-2 2.3 Personal Privacy... 2-3 2.4 Comply with Applicable Laws and Site Specific Restrictions... 2-3 2.5

More information

Information Technology General Control Review

Information Technology General Control Review Information Technology General Control Review David L. Shissler, Senior IT Auditor, CPA, CISA, CISSP Office of Internal Audit and Risk Assessment September 15, 2016 Background Presenter Senior IT Auditor

More information

for the Dental Industry

for the Dental Industry for the Dental Industry If you re practicing dentistry, you ll also need to be an expert on email encryption and patient privacy. Dental practices are among the fastest growing adopters of cloud email

More information

Cybersecurity Auditing in an Unsecure World

Cybersecurity Auditing in an Unsecure World About This Course Cybersecurity Auditing in an Unsecure World Course Description $5.4 million that s the average cost of a data breach to a U.S.-based company. It s no surprise, then, that cybersecurity

More information

Sarbanes-Oxley Act (SOX)

Sarbanes-Oxley Act (SOX) Sarbanes-Oxley Act (SOX) Introduction The Sarbanes-Oxley (SOX) Act was introduced in 2002 to protect shareholders and the general public from fraudulent accounting activities by bringing greater accountability

More information

SECURITY & PRIVACY DOCUMENTATION

SECURITY & PRIVACY DOCUMENTATION Okta s Commitment to Security & Privacy SECURITY & PRIVACY DOCUMENTATION (last updated September 15, 2017) Okta is committed to achieving and preserving the trust of our customers, by providing a comprehensive

More information

GDPR: A technical perspective from Arkivum

GDPR: A technical perspective from Arkivum GDPR: A technical perspective from Arkivum Under the GDPR, you have a general obligation to implement technical and organisational measures to show that you have considered and integrated data protection

More information

Cloud Computing Standard 1.1 INTRODUCTION 2.1 PURPOSE. Effective Date: July 28, 2015

Cloud Computing Standard 1.1 INTRODUCTION 2.1 PURPOSE. Effective Date: July 28, 2015 Cloud Computing Standard Effective Date: July 28, 2015 1.1 INTRODUCTION Cloud computing services are application and infrastructure resources that users access via the Internet. These services, contractually

More information

DFARS Compliance. SLAIT Consulting SECURITY SERVICES. Mike D Arezzo Director of Security Services. SLAITCONSULTING.com

DFARS Compliance. SLAIT Consulting SECURITY SERVICES. Mike D Arezzo Director of Security Services. SLAITCONSULTING.com DFARS Compliance SLAIT Consulting SECURITY SERVICES Mike D Arezzo Director of Security Services Introduction 18+ year career in Information Technology and Security General Electric (GE) as Software Governance

More information

Seven Requirements for Successfully Implementing Information Security Policies and Standards

Seven Requirements for Successfully Implementing Information Security Policies and Standards Seven Requirements for Successfully Implementing and Standards A guide for executives Stan Stahl, Ph.D., President, Citadel Information Group Kimberly A. Pease, CISSP, Vice President, Citadel Information

More information

Checklist for Applying ISO 27000, PCI DSS v2 & NIST to Address HIPAA & HITECH Mandates. Ali Pabrai, MSEE, CISSP (ISSAP, ISSMP)

Checklist for Applying ISO 27000, PCI DSS v2 & NIST to Address HIPAA & HITECH Mandates. Ali Pabrai, MSEE, CISSP (ISSAP, ISSMP) Checklist for Applying ISO 27000, PCI DSS v2 & NIST to Address HIPAA & HITECH Mandates Ali Pabrai, MSEE, CISSP (ISSAP, ISSMP) ecfirst, chief executive Member, InfraGard Compliance Mandates Key Regulations

More information

Business continuity management and cyber resiliency

Business continuity management and cyber resiliency Baker Tilly refers to Baker Tilly Virchow Krause, LLP, an independently owned and managed member of Baker Tilly International. Business continuity management and cyber resiliency Introductions Eric Wunderlich,

More information

HIPAA Compliance Checklist

HIPAA Compliance Checklist HIPAA Compliance Checklist Hospitals, clinics, and any other health care providers that manage private health information today must adhere to strict policies for ensuring that data is secure at all times.

More information

New York Department of Financial Services Cybersecurity Regulation Compliance and Certification Deadlines

New York Department of Financial Services Cybersecurity Regulation Compliance and Certification Deadlines New York Department of Financial Services Cybersecurity Regulation Compliance and Certification Deadlines New York Department of Financial Services ( DFS ) Regulation 23 NYCRR 500 requires that entities

More information

TARGET2-SECURITIES INFORMATION SECURITY REQUIREMENTS

TARGET2-SECURITIES INFORMATION SECURITY REQUIREMENTS Target2-Securities Project Team TARGET2-SECURITIES INFORMATION SECURITY REQUIREMENTS Reference: T2S-07-0270 Date: 09 October 2007 Version: 0.1 Status: Draft Target2-Securities - User s TABLE OF CONTENTS

More information

New York Cybersecurity. New York Cybersecurity. Requirements for Financial Services Companies (23NYCRR 500) Solution Brief

New York Cybersecurity. New York Cybersecurity. Requirements for Financial Services Companies (23NYCRR 500) Solution Brief Publication Date: March 10, 2017 Requirements for Financial Services Companies (23NYCRR 500) Solution Brief EventTracker 8815 Centre Park Drive, Columbia MD 21045 About EventTracker EventTracker s advanced

More information

Google Cloud & the General Data Protection Regulation (GDPR)

Google Cloud & the General Data Protection Regulation (GDPR) Google Cloud & the General Data Protection Regulation (GDPR) INTRODUCTION General Data Protection Regulation (GDPR) On 25 May 2018, the most significant piece of European data protection legislation to

More information

Why you MUST protect your customer data

Why you MUST protect your customer data Why you MUST protect your customer data If you think you re exempt from compliance with customer data security and privacy laws because you re a small business, think again. Businesses of all sizes are

More information

Data Protection. Practical Strategies for Getting it Right. Jamie Ross Data Security Day June 8, 2016

Data Protection. Practical Strategies for Getting it Right. Jamie Ross Data Security Day June 8, 2016 Data Protection Practical Strategies for Getting it Right Jamie Ross Data Security Day June 8, 2016 Agenda 1) Data protection key drivers and the need for an integrated approach 2) Common challenges data

More information

The SANS Institute Top 20 Critical Security Controls. Compliance Guide

The SANS Institute Top 20 Critical Security Controls. Compliance Guide The SANS Institute Top 20 Critical Security Controls Compliance Guide February 2014 The Need for a Risk-Based Approach A common factor across many recent security breaches is that the targeted enterprise

More information

Putting It All Together:

Putting It All Together: Putting It All Together: The Interplay of Privacy & Security Regina Verde, MS, MBA, CHC Chief Corporate Compliance & Privacy Officer University of Virginia Health System 2017 ISPRO Conference October 24,

More information

Data Management and Security in the GDPR Era

Data Management and Security in the GDPR Era Data Management and Security in the GDPR Era Franck Hourdin; Vice President, EMEA Security Russ Lowenthal; Director, Database Security Product Management Mike Turner; Chief Operating Officer, Capgemini

More information

Watson Developer Cloud Security Overview

Watson Developer Cloud Security Overview Watson Developer Cloud Security Overview Introduction This document provides a high-level overview of the measures and safeguards that IBM implements to protect and separate data between customers for

More information

What is Penetration Testing?

What is Penetration Testing? What is Penetration Testing? March 2016 Table of Contents What is Penetration Testing?... 3 Why Perform Penetration Testing?... 4 How Often Should You Perform Penetration Testing?... 4 How Can You Benefit

More information

Information Security Management Criteria for Our Business Partners

Information Security Management Criteria for Our Business Partners Information Security Management Criteria for Our Business Partners Ver. 2.1 April 1, 2016 Global Procurement Company Information Security Enhancement Department Panasonic Corporation 1 Table of Contents

More information

The Role of the Data Protection Officer

The Role of the Data Protection Officer The Role of the Data Protection Officer Adrian Ross LLB (Hons), MBA GRC Consultant IT Governance Ltd 28 July 2016 www.itgovernance.co.uk Introduction Adrian Ross GRC consultant Infrastructure services

More information

ISO STANDARD IMPLEMENTATION AND TECHNOLOGY CONSOLIDATION

ISO STANDARD IMPLEMENTATION AND TECHNOLOGY CONSOLIDATION ISO STANDARD IMPLEMENTATION AND TECHNOLOGY CONSOLIDATION Cathy Bates Senior Consultant, Vantage Technology Consulting Group January 30, 2018 Campus Orientation Initiative and Project Orientation Project

More information

INCIDENTRESPONSE.COM. Automate Response. Did you know? Your playbook overview - Data Theft

INCIDENTRESPONSE.COM. Automate Response. Did you know? Your playbook overview - Data Theft Automate Response Congratulations on selecting IncidentResponse.com to retrieve your custom incident response playbook guide. This guide has been created especially for you for use in within your security

More information

Choosing the Right Solution for Strategic Deployment of Encryption

Choosing the Right Solution for Strategic Deployment of  Encryption Choosing the Right Solution for Strategic Deployment of Email Encryption White Paper: Enterprise Email Encryption Email Protection Buyer s Guide Choosing the Right Solution for Strategic Deployment of

More information

Recommendations for Implementing an Information Security Framework for Life Science Organizations

Recommendations for Implementing an Information Security Framework for Life Science Organizations Recommendations for Implementing an Information Security Framework for Life Science Organizations Introduction Doug Shaw CISA, CRISC Director of CSV & IT Compliance Azzur Consulting Agenda Why is information

More information

BULLETPROOF365 SECURING YOUR IT. Bulletproof365.com

BULLETPROOF365 SECURING YOUR IT. Bulletproof365.com BULLETPROOF365 SECURING YOUR IT Bulletproof365.com INTRODUCING BULLETPROOF365 The world s leading productivity platform wrapped with industry-leading security, unmatched employee education and 24x7 IT

More information

Hacking and Cyber Espionage

Hacking and Cyber Espionage Hacking and Cyber Espionage September 19, 2013 Prophylactic and Post-Breach Concerns for In-House Counsel Raymond O. Aghaian, McKenna Long & Aldridge LLP Elizabeth (Beth) Ferrell, McKenna Long & Aldridge

More information

AN IPSWITCH WHITEPAPER. 7 Steps to Compliance with GDPR. How the General Data Protection Regulation Applies to External File Transfers

AN IPSWITCH WHITEPAPER. 7 Steps to Compliance with GDPR. How the General Data Protection Regulation Applies to External File Transfers AN IPSWITCH WHITEPAPER 7 Steps to Compliance with GDPR How the General Data Protection Regulation Applies to External File Transfers Introduction Stolen personal data drives a thriving black market for

More information

The Impact of Cybersecurity, Data Privacy and Social Media

The Impact of Cybersecurity, Data Privacy and Social Media Doing Business in a Connected World The Impact of Cybersecurity, Data Privacy and Social Media Security Incident tprevention and Response: Customizing i a Formula for Results Joseph hm. Ah Asher Marcus

More information

Performing a Vendor Security Review TCTC 2017 FALL EVENT PRESENTER: KATIE MCINTOSH

Performing a Vendor Security Review TCTC 2017 FALL EVENT PRESENTER: KATIE MCINTOSH Performing a Vendor Security Review TCTC 2017 FALL EVENT PRESENTER: KATIE MCINTOSH 1 Speaker Bio Katie McIntosh, CISM, CRISC, CISA, CIA, CRMA, is the Cyber Security Specialist for Central Hudson Gas &

More information

Baseline Information Security and Privacy Requirements for Suppliers

Baseline Information Security and Privacy Requirements for Suppliers Baseline Information Security and Privacy Requirements for Suppliers INSTRUCTION 1/00021-2849 Uen Rev H Ericsson AB 2017 All rights reserved. The information in this document is the property of Ericsson.

More information

7 Steps to information protection

7 Steps to information protection 7 Steps to information protection 7 Steps to information protection Executive summary Vulnerability, risk, and information protection challenges Every organization is at risk of confidential information

More information

HIPAA UPDATE. Michael L. Brody, DPM

HIPAA UPDATE. Michael L. Brody, DPM HIPAA UPDATE Michael L. Brody, DPM Objectives: How to respond to a patient s request for a copy of their records. Understand your responsibilities after you send information out to another doctor, hospital

More information

Employee Security Awareness Training Program

Employee Security Awareness Training Program Employee Security Awareness Training Program Date: September 15, 2015 Version: 2015 1. Scope This Employee Security Awareness Training Program is designed to educate any InComm employee, independent contractor,

More information

Department of Public Health O F S A N F R A N C I S C O

Department of Public Health O F S A N F R A N C I S C O PAGE 1 of 9 Category: Information Technology Security and HIPAA DPH Unit of Origin: Department of Public Health Policy Owner: Phillip McDown, CISSP Phone: 255-3577 CISSPCISSP/C Distribution: DPH-wide Other:

More information

GDPR compliance. GDPR preparedness with OpenText InfoArchive. White paper

GDPR compliance. GDPR preparedness with OpenText InfoArchive. White paper White paper GDPR preparedness with OpenText InfoArchive The new EU privacy law, GDPR, will be in effect in less than a year. OpenText has the solutions to help you prepare and comply to this new law. Contents

More information

Disruptive Technologies Legal and Regulatory Aspects. 16 May 2017 Investment Summit - Swiss Gobal Enterprise

Disruptive Technologies Legal and Regulatory Aspects. 16 May 2017 Investment Summit - Swiss Gobal Enterprise Disruptive Technologies Legal and Regulatory Aspects 16 May 2017 Investment Summit - Swiss Gobal Enterprise Legal and Regulatory Framework in Switzerland Legal and regulatory Framework: no laws or provisions

More information

What is HIPPA/PCI? Understanding HIPAA. Understanding PCI DSS

What is HIPPA/PCI? Understanding HIPAA. Understanding PCI DSS What is HIPPA/PCI? In this digital era, where every bit of information pertaining to individuals has gone digital and is stored in digital form somewhere or the other, there is a need protect the individuals

More information

Understanding the Impact of Data Privacy January 2012

Understanding the Impact of Data Privacy January 2012 Understanding the Impact of Data Privacy January 2012 Presented By: Eric Dieterich Agenda Why is data privacy important Quantifying the costs of a data breach Clarifying the differences between a privacy

More information

SDR Guide to Complete the SDR

SDR Guide to Complete the SDR I. General Information You must list the Yale Servers & if Virtual their host Business Associate Agreement (BAA ) in place. Required for the new HIPAA rules Contract questions are critical if using 3 Lock

More information

SARBANES-OXLEY (SOX) ACT

SARBANES-OXLEY (SOX) ACT SARBANES-OXLEY (SOX) ACT Table of Contents Introduction 03 Who is affected by SOX? 05 Why should my organization 05 comply with SOX? What does SOX require for email 06 compliance? How can my organization

More information

Disaster Recovery Self-Audit

Disaster Recovery Self-Audit Disaster Recovery Self-Audit Disaster Recovery Audit There are 3 steps to this process: 1. Identify all data and IT-related functions (like credit card processing, documents on your file server, member

More information

PROTECTING BRANDS IN CYBERSPACE

PROTECTING BRANDS IN CYBERSPACE Speaker Profile Abhishek Agarwal, CIPP/US: Security & Privacy Leader at Kraft Foods Manage compliance programs to safeguard consumer, customers and employee information. Responsible for protecting brand

More information

Records Management and Retention

Records Management and Retention Records Management and Retention Category: Governance Number: Audience: University employees and Board members Last Revised: January 29, 2017 Owner: Secretary to the Board Approved by: Board of Governors

More information

AUDIT REPORT. Network Assessment Audit Audit Opinion: Needs Improvement. Date: December 15, Report Number: 2014-IT-03

AUDIT REPORT. Network Assessment Audit Audit Opinion: Needs Improvement. Date: December 15, Report Number: 2014-IT-03 AUDIT REPORT Network Assessment Audit Audit Opinion: Needs Improvement Date: December 15, 2014 Report Number: 2014-IT-03 Table of Contents: Page Executive Summary Background 1 Audit Objectives and Scope

More information

Bringing cyber to the Board of Directors & C-level and keeping it there. Dirk Lybaert, Proximus September 9 th 2016

Bringing cyber to the Board of Directors & C-level and keeping it there. Dirk Lybaert, Proximus September 9 th 2016 Bringing cyber to the Board of Directors & C-level and keeping it there Dirk Lybaert, Proximus September 9 th 2016 Dirk Lybaert Chief Group Corporate Affairs We constantly keep people connected to the

More information

"Charting the Course... Certified Information Systems Auditor (CISA) Course Summary

Charting the Course... Certified Information Systems Auditor (CISA) Course Summary Course Summary Description In this course, you will perform evaluations of organizational policies, procedures, and processes to ensure that an organization's information systems align with overall business

More information

An Introduction to the ISO Security Standards

An Introduction to the ISO Security Standards An Introduction to the ISO Security Standards Agenda Security vs Privacy Who or What is the ISO? ISO 27001:2013 ISO 27001/27002 domains Building Blocks of Security AVAILABILITY INTEGRITY CONFIDENTIALITY

More information

MaaS360 Secure Productivity Suite

MaaS360 Secure Productivity Suite MaaS360 Secure Productivity Suite Frequently Asked Questions (FAQs) What is MaaS360 Secure Productivity Suite? MaaS360 Secure Productivity Suite integrates a set of comprehensive mobile security and productivity

More information

HIPAA Privacy, Security and Breach Notification

HIPAA Privacy, Security and Breach Notification HIPAA Privacy, Security and Breach Notification HCCA East Central Regional Annual Conference October 2013 Disclaimer The information contained in this document is provided by KPMG LLP for general guidance

More information

Elements of a Swift (and Effective) Response to a HIPAA Security Breach

Elements of a Swift (and Effective) Response to a HIPAA Security Breach Elements of a Swift (and Effective) Response to a HIPAA Security Breach Susan E. Ziel, RN BSN MPH JD Krieg DeVault LLP Past President, The American Association of Nurse Attorneys Disclaimer The information

More information

DeliverySlip for Dental Practices

DeliverySlip for Dental Practices DeliverySlip for Dental Practices Introduction This white paper will detail why email encryption has become a must have tool for dental practices. In addition to HIPAA and Omnibus Rule compliance, it also

More information

Cybersecurity What Companies are Doing & How to Evaluate. Miguel Romero - NAIC David Gunkel & Dan Ford Rook Security

Cybersecurity What Companies are Doing & How to Evaluate. Miguel Romero - NAIC David Gunkel & Dan Ford Rook Security Cybersecurity What Companies are Doing & How to Evaluate Miguel Romero - NAIC David Gunkel & Dan Ford Rook Security Learning Objectives At the end of this presentation, you will be able to: Explain the

More information

HIPAA COMPLIANCE AND DATA PROTECTION Page 1

HIPAA COMPLIANCE AND DATA PROTECTION Page 1 HIPAA COMPLIANCE AND DATA PROTECTION info@resultstechnology.com 877.435.8877 Page 1 CONTENTS Introduction..... 3 The HIPAA Security Rule... 4 The HIPAA Omnibus Rule... 6 HIPAA Compliance and RESULTS Cloud

More information

PCI Policy Compliance Using Information Security Policies Made Easy. PCI Policy Compliance Information Shield Page 1

PCI Policy Compliance Using Information Security Policies Made Easy. PCI Policy Compliance Information Shield Page 1 PCI Policy Compliance Using Information Security Policies Made Easy PCI Policy Compliance Information Shield Page 1 PCI Policy Compliance Using Information Security Policies Made Easy By David J Lineman

More information

Administration and Data Retention. Best Practices for Systems Management

Administration and Data Retention. Best Practices for Systems Management Administration and Data Retention Best Practices for Systems Management Agenda Understanding the Context for IT Management Concepts for Managing Key IT Objectives Aptify and IT Management Best Practices

More information

VMware vcloud Air SOC 1 Control Matrix

VMware vcloud Air SOC 1 Control Matrix VMware vcloud Air SOC 1 Control Objectives/Activities Matrix VMware vcloud Air goes to great lengths to ensure the security and availability of vcloud Air services. In this effort, we have undergone a

More information

How To Establish A Compliance Program. Richard E. Mackey, Jr. SystemExperts Corporation

How To Establish A Compliance Program. Richard E. Mackey, Jr. SystemExperts Corporation How To Establish A Compliance Program Richard E. Mackey, Jr. Vice president SystemExperts Corporation Agenda High level requirements A written program A sample structure Elements of the program Create

More information

SIEM: Five Requirements that Solve the Bigger Business Issues

SIEM: Five Requirements that Solve the Bigger Business Issues SIEM: Five Requirements that Solve the Bigger Business Issues After more than a decade functioning in production environments, security information and event management (SIEM) solutions are now considered

More information

Symantec DLP: Detection Innovation and Expanded Coverage

Symantec DLP: Detection Innovation and Expanded Coverage Symantec DLP: Detection Innovation and Expanded Coverage Ernie Simmons, Tory Gilbert IIP Technical Field Enablement DLP: Detection Innovation and Expanded Coverage 1 Topics DLP and Detection Overview Vector

More information

WORKSHARE SECURITY OVERVIEW

WORKSHARE SECURITY OVERVIEW WORKSHARE SECURITY OVERVIEW April 2016 COMPANY INFORMATION Workshare Security Overview Workshare Ltd. (UK) 20 Fashion Street London E1 6PX UK Workshare Website: www.workshare.com Workshare Inc. (USA) 625

More information

VANGUARD POLICY MANAGERTM

VANGUARD POLICY MANAGERTM VANGUARD TM VANGUARD dramatically reduces security risks and improves regulatory compliance, minimizing the need for expensive remediation, while increasing staff productivity. Policy Manager provides

More information

HIPAA Regulatory Compliance

HIPAA Regulatory Compliance Secure Access Solutions & HIPAA Regulatory Compliance Privacy in the Healthcare Industry Privacy has always been a high priority in the health profession. However, since the implementation of the Health

More information

Certified Information Systems Auditor (CISA)

Certified Information Systems Auditor (CISA) Certified Information Systems Auditor (CISA) 1. Domain 1 The Process of Auditing Information Systems Provide audit services in accordance with IT audit standards to assist the organization in protecting

More information

Enhance Your Cyber Risk Awareness and Readiness. Singtel Business

Enhance Your Cyber Risk Awareness and Readiness. Singtel Business Singtel Business Product Factsheet Brochure Managed Cyber Security Defense Readiness Services Assessment Enhance Your Cyber Risk Awareness and Readiness Much focus is on knowing one s enemy in today s

More information

An Overview of the Gramm-Leach-Bliley (GLB) Act and the Safeguards Rule

An Overview of the Gramm-Leach-Bliley (GLB) Act and the Safeguards Rule An Overview of the Gramm-Leach-Bliley (GLB) Act and the Safeguards Rule Legal Disclaimer: This overview is not intended as legal advice and should not be taken as such. We recommend that you consult legal

More information

Top Privacy Issues for Infosec Professionals

Top Privacy Issues for Infosec Professionals Top Privacy Issues for Infosec Professionals Gregory Reid, CEO, InFuture LLC Sam Pfeifle, Content Director, International Association of Privacy Professionals (IAPP) Where Security Meets Privacy Why privacy

More information

Data Classification is a Business Imperative. TITUS White Paper

Data Classification is a Business Imperative. TITUS White Paper Data Classification is a Business Imperative TITUS White Paper Information in this document is subject to change without notice. Complying with all applicable copyright laws is the responsibility of the

More information

Support for the HIPAA Security Rule

Support for the HIPAA Security Rule white paper Support for the HIPAA Security Rule PowerScribe 360 Reporting v1.1 healthcare 2 Summary This white paper is intended to assist Nuance customers who are evaluating the security aspects of PowerScribe

More information

Five Steps to Faster Data Classification

Five Steps to Faster Data Classification CONTENTS OF THIS WHITE PAPER Unstructured Data Challenge... 1 Classifying Unstructured Data... 1 Faster, More Successful Data Classification... 2 Identify Data Owners... 2 Define Data of Interest... 3

More information

POLICY FOR DATA AND INFORMATION SECURITY AT BMC IN LUND. October Table of Contents

POLICY FOR DATA AND INFORMATION SECURITY AT BMC IN LUND. October Table of Contents POLICY FOR DATA AND INFORMATION SECURITY AT BMC IN LUND October 2005 Table of Contents Introduction... 1 Purpose Of This Policy... 1 Responsibility... 1 General Policy... 2 Data Classification Policy...

More information

ISO/IEC INTERNATIONAL STANDARD. Information technology Security techniques Code of practice for information security management

ISO/IEC INTERNATIONAL STANDARD. Information technology Security techniques Code of practice for information security management INTERNATIONAL STANDARD ISO/IEC 17799 Second edition 2005-06-15 Information technology Security techniques Code of practice for information security management Technologies de l'information Techniques de

More information

Managing Privacy Risk & Compliance in Financial Services. Brett Hamilton Advisory Solutions Consultant ServiceNow

Managing Privacy Risk & Compliance in Financial Services. Brett Hamilton Advisory Solutions Consultant ServiceNow Managing Privacy Risk & Compliance in Financial Services Brett Hamilton Advisory Solutions Consultant ServiceNow 1 Speaker Introduction INSERT PHOTO Name: Brett Hamilton Title: Advisory Solutions Consultant

More information

ISSMP is in compliance with the stringent requirements of ANSI/ISO/IEC Standard

ISSMP is in compliance with the stringent requirements of ANSI/ISO/IEC Standard Certification Exam Outline Effective Date: April 2013 About CISSP-ISSMP The Information Systems Security Management Professional (ISSMP) is a CISSP who specializes in establishing, presenting, and governing

More information

Data Privacy and Protection GDPR Compliance for Databases

Data Privacy and Protection GDPR Compliance for Databases Data Privacy and Protection GDPR Compliance for Databases Walo Weber, Senior Sales Engineer September, 2016 Agenda GDPR: who, what, why, when Requirements for databases Discovery Classification Masking

More information

Carbon Black PCI Compliance Mapping Checklist

Carbon Black PCI Compliance Mapping Checklist Carbon Black PCI Compliance Mapping Checklist The following table identifies selected PCI 3.0 requirements, the test definition per the PCI validation plan and how Carbon Black Enterprise Protection and

More information