Software Assurance Ecosystem Knowledge Architecture. 1 Wednesday, December 31, 2008
|
|
|
- Augustine Clarke
- 5 years ago
- Views:
Transcription
1 Software Assurance Ecosystem Knowledge Architecture 1 1 Wednesday, December 31, 2008
2 What Do The Building Blocks for Measuring Assurance Look Like? Standard ways for enumerating things we care about Languages/Formats for encoding/ carrying high fidelity content about the things we care about Repositories of this content for use in communities or individual organizations
3 The Building Blocks Are: Enumerations Catalog the fundamental entities in Software Assurance Vulnerabilities (CVE), configuration issues (CCE), software packages (CPE), attack patterns (CAPEC), weaknesses in code/design/architecture (CWE) Languages/Formats Support the creation of machine-readable state assertions, assessment results, and messages Configuration/vulnerability/patch/asset patterns (XCCDF & OVAL), software security patterns (SBVR), event patterns (CEE), malware patterns (MAEC), risk of a vulnerability (CVSS), config risk (CCSS), weakness risk (CWSS), information messages (CAIF & *DEF) Knowledge Repositories Packages of assertions supporting a specific application Vulnerability advisories & alerts, (US-CERT Advisories/ IAVAs), configuration assessment (NIST Checklists, CIS Benchmarks, NSA Configuration Guides, DISA STIGS), asset inventory (NIST/DHS NVD), code assessment & certification (NIST SAMATE, DoD DIACAP & emass)
4 Common Weakness Enumeration (CWE) Weaknesses are characteristics of software that may lead to vulnerability Existence of weaknesses in software can be objectively measured through the use of various techniques and tools Software assurance is determined by the absence of weaknesses identified as relevant for a given context and assurance level CWE is an effort targeted at standardizing the capture and description of weaknesses and providing a useful collection to be leveraged by the community Community effort developed from dozens of sources CWE version 1.1 was released December 2008 Already being used in education, tools, software risk assessment, policy, etc. 4 Wednesday, December 31, 2008
5 What is the Common Attack Pattern Effort targeted at: Standardizing the capture and description of attack patterns Collecting known attack patterns into an integrated enumeration that can be consistently and effectively leveraged by the community Classifying attack patterns such that users can easily identify the subset of the entire enumeration that is appropriate for their context Sponsored by DHS Led by Cigital 5
6 Knowledge Repositories Mitigating Risk Exposures Responding to Security Threats Asset Definition Configuration Guidance Vulnerability Alert Threat Alert Incident Report CPE/OVAL XCCDF/OVAL/ CCE CVE/CWE/ OVAL/CVSS CVE/CWE/CVSS/ CME/CAPEC/MAEC CAIF/IDMEF/IODEF/CVE/CWE/ OVAL/CPE/CME/MAEC/CEE/CRF Asset Inventory Configuration Guidance Analysis Vulnerability Analysis Threat Analysis Intrusion Detection Incident Management OVAL/XCCDF/ CCE/CPE/CRF System & Software Assurance Guidance/ Requirements CWE/CAPEC/ SBVR/MAEC Assessment of System Development, Integration, & Sustainment Activities and Certification & Accreditation CPE/ OVAL/ CRF CCE/ OVAL/ CRF/ XCCDF/ CPE CVE/CWE/ CVSS/CRF/ CCE/ OVAL/ XCCDF/ CPE CVE/CWE/ CVSS/CRF/ CCE/OVAL/ XCCDF/CPE/ CME/CAPEC/ MAEC CVE/CWE/ CVSS/CRF/ CCE/OVAL/ XCCDF/CPE/ CME/CAPEC/ MAEC/CEE Operations Security Management Processes Operational Enterprise Networks CVE/CWE/CVSS/CCE/OVAL/XCCDF/ CPE/CME/CAPEC/MAEC/CEE/CRF CVE/CWE/CVSS/CCE/OVAL/XCCDF/ CPE/CME/CAPEC/MAEC/CEE/CRF Development & Sustainment Security Management Processes Enterprise IT Change Management Centralized Reporting Enterprise IT Asset Management
7 [makingsecuritymeasurable.mitre.org]
8 Practical Measurement Framework Harmonized with five prevailing system/software and security measurement approaches Provides basic measures development and implementation processes Provides general measures examples Integrates with existing measurement programs Incorporates Making Security Measurable products Provides an overarching framework for summarizing SwA measures and communicating them to stakeholders Creat e/ Updat e Meas ures Collec t Data Store Data Analy ze and Comp ile Data Repor t Meas ures Use Meas ures Continuous Improvement
9 What Is Measurable Today? Enumerations of Things That We Want to Know About: Common Weakness Enumeration (CWE) Common Attack Pattern Enumeration and Classification (CAPEC) Common Vulnerabilities and Exposures (CVE) Common Configuration Enumeration (CCE) Ways of Expressing Details About Enumerated Items: Open Vulnerability and Assessment Language (OVAL) XML Configuration Checklist Data Format (XCCDF) Common Platform Enumeration (CPE) Common Vulnerabilities Scoring System (CVSS) Common Configuration Scoring System (CCSS) Common Weakness Scoring System (CWSS) Repositories of Content with Measurement Criteria SCAP (Secure Content Automation Protocol) Other measurable items include quality and project management measures which are well developed and available for use
MAKING SECURITY MEASURABLE AND MANAGEABLE
MAKING SECURITY MEASURABLE AND MANAGEABLE Robert A. Martin The MITRE Corporation Bedford, MA ABSTRACT The security and integrity of information systems is a critical issue within most types of organizations.
Cyber Observables and Integration with EMAP EMAP 2011 Developer Days
Cyber Observables and Integration with EMAP EMAP 2011 Developer Days Sean Barnum Aug 2011 Knowledge Repositories Asset Definition Configuration Guidance Vulnerability Alert Threat Alert Incident Report
Tenable SCAP Standards Declarations. June 4, 2015 (Revision 11)
Tenable SCAP Standards Declarations June 4, 2015 (Revision 11) Table of Contents Center for Internet Security (CIS)... 3 Common Criteria (NIAP)... 3 Common Vulnerability Enumeration (CVE)... 3 Common Configuration
Software Assurance: Enabling Education and Training to better address needs of Security Automation and Software Supply Chain Risk Management
Software Assurance: Enabling Education and Training to better address needs of Security Automation and Software Supply Chain Risk Joe Jarzombek, PMP, CSSLP Director for Software Assurance Cyber Security
AUTOMATED PROCESSES IN COMPUTER SECURITY
AUTOMATED PROCESSES IN COMPUTER SECURITY Maroš Barabas Doctoral Degree Programme (3), FIT BUT E-mail: ibarabas@fit.vutbr.cz Supervised by: Petr Hanáček E-mail: hanacek@fit.vutbr.cz ABSTRACT This article
Software Security Weaknesses Avoiding and Testing
Software Security Weaknesses ---------------- Avoiding and Testing 18 December 2007 Robert A. Martin Goal of the Common Weakness Enumeration Initiative To improve the quality of software with respect to
Providing Cybersecurity Inventory, Compliance Tracking, and C2 in a Heterogeneous Tool Environment
Providing Cybersecurity Inventory, Compliance Tracking, and C2 in a Heterogeneous Tool Environment Joseph L. Wolfkiel Secure Configuration Management Lead Engineer May 2018 1 Disclaimer The information
Improving FISMA Effectiveness and Efficiency Through the Security Content Automation Program (SCAP)
Improving FISMA Effectiveness and Efficiency Through the Security Content Automation Program (SCAP) Shared Interest Group (SIG): Security and Privacy Date Released: January 28, 2008 The following White
Practical OpenSCAP Security Standard Compliance and Reporting. Robin Price II Senior Solutions Architect Martin Preisler Senior Software Engineer
Practical OpenSCAP Security Standard Compliance and Reporting Robin Price II Senior Solutions Architect Martin Preisler Senior Software Engineer INTRODUCTION AGENDA Review some slides Follow along demostration
INFORMATION ASSURANCE DIRECTORATE
National Security Agency/Central Security Service INFORMATION ASSURANCE DIRECTORATE CGS Vulnerability Vulnerability Assessment is the systematic examination of an Enterprise to determine the adequacy of
Software & Supply Chain Assurance: Enabling Enterprise Resilience through Security Automation, Software Assurance and Supply Chain Risk Management
Software & Supply Chain Assurance: Enabling Enterprise Resilience through Security Automation, Software Assurance and Supply Chain Risk Management Joe Jarzombek, PMP, CSSLP Director for Software & Supply
Enabling Distributed Event Management: Interoperability for Automated Response and Prevention. Sean Barnum George Saylor Aug 2011
Enabling Distributed Event Management: Interoperability for Automated Response and Prevention Sean Barnum George Saylor Aug 2011 The HS SEDI FFRDC is managed and operated by The MITRE Corporation for DHS.
Risk Analysis and Measurement with CWRAF
Risk Analysis and Measurement with CWRAF - Common Weakness Risk Analysis Framework - April 4, 2012 Making Security Measurable (MSM) Software Assurance Enterprise Security Management Threat Management Design
Supply Chain Information Exchange: Non-conforming & Authentic Components
Supply Chain Information Exchange: Non-conforming & Authentic Components Joe Jarzombek Director for Software and Supply Chain Assurance Stakeholder Engagement & Cyber Infrastructure Resilience Agenda Purpose
Certifying Applications for Known Security Weaknesses
Certifying Applications for Known Security Weaknesses ----------------------------------------------------------------- The Common Weakness Enumeration (CWE) Effort Robert A. Martin - MITRE QuickTime QuickTime
SCAP Security Guide Questions / Answers. Ján Lieskovský Contributor WorkShop November 2015
SCAP Security Guide Questions / Answers Ján Lieskovský Contributor WorkShop November 2015 Agenda Introductory Notes SSG Repository Structure Contributing To SSG Developer Workflow Introductory Notes SCAP
Meeting RMF Requirements around Compliance Monitoring
Meeting RMF Requirements around Compliance Monitoring An EiQ Networks White Paper Meeting RMF Requirements around Compliance Monitoring Purpose The purpose of this paper is to provide some background on
Current and Future Issues in Security
Current and Future Issues in Security Rick Therrien TAG-SS Co-chair (Incumbent) Operations Internal Revenue Service July 10, 2008 Infrastructure Security Goals Research emerging trends and requirements
Attack Vectors in Computer Security
Attack Vectors in Computer Security Who Am I @WillGoard My first proper hacksoc talk I speak fluent greek Sell more pizzas have more fun Why attack vectors? Didn t know what to do for my dissertation Started
SCAP Security Guide Questions / Answers. Contributor WorkShop Volume #2
SCAP Security Guide Questions / Answers Contributor WorkShop Volume #2 Ján Lieskovský January 2016 Agenda Introductory Notes Source Code / Repository Notes (Moved to Appendix for self-study) SCAP Security
Security Automation Developer Days July 9-13, 2012
Monday July 9 th 2012 10:00-10:10 Welcome Introduce the organizers of the event and the major players; describe MITRE s role for the event; and describe the goals for this event. 10:10 12:00 CCE David
What can an Acquirer do to prevent developers from make dangerous software errors? OWASP AppSec DC 2012 April 5, 2012
What can an Acquirer do to prevent developers from make dangerous software errors? OWASP AppSec DC 2012 April 5, 2012 Key questions Do acquirers know why they need include requirements for secure code?
CSAM Support for C&A Transformation
CSAM Support for C&A Transformation Cyber Security Assessment and Management (CSAM) 1 2 3 4 5 Five Services, One Complete C&A Solution Mission/Risk-Based Policy & Implementation/Test Guidance Program Management
MIS Week 9 Host Hardening
MIS 5214 Week 9 Host Hardening Agenda NIST Risk Management Framework A quick review Implementing controls Host hardening Security configuration checklist (w/disa STIG Viewer) NIST 800-53Ar4 How Controls
K12 Cybersecurity Roadmap
K12 Cybersecurity Roadmap Introduction Jason Brown, CISSP Chief Information Security Officer Merit Network, Inc jbrown@merit.edu @jasonbrown17 https://linkedin.com/in/jasonbrown17 2 Agenda 3 Why Use the
Operated by Los Alamos National Security, LLC for the U.S. Department of Energy's NNSA
Operated by Los Alamos National Security, LLC for the U.S. Department of Energy's NNSA Jovial about Joval LANL s latest SCAP Adventure Angelo Ortiz May 22, 2018 Operated by Los Alamos National Security,
Understanding How. Weaknesses: CAPEC
Understanding How They Attack Your Weaknesses: CAPEC Robert A. Martin Sean Barnum May 2011 HS SEDI is a trademark of the U.S. Department of Homeland Security (DHS). Report Documentation Page Form Approved
Security Automation Developer Days Winter 2010 Conference Preliminary High Level Agenda
Security Automation Developer Days Winter 2010 Conference Preliminary High Level Agenda Dates: Monday, February 22, 2010 thru Wednesday, February 24, 2010 Location: NIST, Gaithersburg Campus, Building
SecurityCenter 5.0 SCAP Assessments. May 28, 2015 (Revision 2)
SecurityCenter 5.0 SCAP Assessments May 28, 2015 (Revision 2) Table of Contents Overview... 3 Standards and Conventions... 3 Abbreviations... 3 Simple Assessment Procedure... 4 XCCDF Certified vs. Lower-Tier
Applied SCAP: Automating Security Compliance and Remediation. Shawn Wells Maintainer, SCAP Security Guide 31-JULY-2014
Applied SCAP: Automating Security Compliance and Remediation Shawn Wells Maintainer, SCAP Security Guide 31-JULY-2014 45 MINUTES, 3 GOALS (+15 MIN Q&A) 1. Detail Security Automation Technology + Initiatives
Nessus v6 SCAP Assessments. November 18, 2014 (Revision 1)
Nessus v6 SCAP Assessments November 18, 2014 (Revision 1) Table of Contents Overview... 3 Standards and Conventions... 3 Abbreviations... 3 Simple Assessment Procedure... 3 XCCDF Certified vs. Lower-Tier
INFORMATION ASSURANCE DIRECTORATE
National Security Agency/Central Security Service INFORMATION ASSURANCE DIRECTORATE CGS Host Intrusion Detection The Host Intrusion Detection helps to detect malicious activity by monitoring for anomalies
Ranking Vulnerability for Web Application based on Severity Ratings Analysis
Ranking Vulnerability for Web Application based on Severity Ratings Analysis Nitish Kumar #1, Kumar Rajnish #2 Anil Kumar #3 1,2,3 Department of Computer Science & Engineering, Birla Institute of Technology,
Protocols for exchange of cyber security information
Protocols for exchange of cyber security information Ing. Július Baráth, PhD. julius.barath@aos.sk Department of informatics Armed Forces Academy Liptovský Mikuláš, Slovakia doc. Ing. Marcel Harakaľ, PhD.
FISMA COMPLIANCE FOR CONTAINERIZED APPS
FISMA COMPLIANCE FOR CONTAINERIZED APPS Using Atomic Scan and OpenSCAP with containers Jason Callaway Red Hat Principal Solutions Architect jcallawa@redhat.com @jasoncallaway jasoncallaway.com AGENDA Slides
Introducing Cyber Observer
"Organizations are failing at early breach detection, with more than 92% of breaches undetected by the breached organization. The situation can be improved with stronger threat intelligence, the addition
Cybersecurity Technical Risk Indicators:
Cybersecurity Technical Risk Indicators: A Measure of Technical Debt Joe Jarzombek, CSSLP, PMP Global Manager, Software Supply Chain Solutions Synopsys Software Integrity Group Previously Director, Software
Supporting Situationally Aware Cybersecurity Systems. 30 th September 2015
Supporting Situationally Aware Cybersecurity Systems 30 th September 2015 Zareen Syed, Tim Finin, Ankur Padia and Lisa Mathews University of Maryland Baltimore County 1000 Hilltop Circle, MD, USA 21250
HITRUST CSF Roadmap for 2018 and Beyond HITRUST Alliance.
HITRUST CSF Roadmap for 2018 and Beyond HITRUST CSF Roadmap 2017 HITRUST CSF v9 Update 21 CFR Part 11 (FDA electronic signatures) Add FFIEC IT Examination (InfoSec), FedRAMP, DHS Critical Resilience Review
Software Assurance Programs Overview
Software Assurance Programs Overview 7 December 2006 Robert A. Martin So What s Going On in Software Assurance Programs 2 MITRE 2006 Slide 2 Software Assurance Programs and Activities Landscape 3 MITRE
WHITE PAPER CONTINUOUS MONITORING INTRODUCTION & CONSIDERATIONS PART 2 OF 3
WHITE PAPER CONTINUOUS MONITORING INTRODUCTION & CONSIDERATIONS PART 2 OF 3 ABSTRACT This white paper is Part 2 in a three-part series of white papers on the sometimes daunting subject of continuous monitoring
RSA IT Security Risk Management
RSA IT Security Risk Adding Insight to Security March 18, 2014 Wael Jaroudi GRC Sales Specialist 1 Where is Security Today? Companies have built layer upon layer of security, but is it helping? Complexity
Defense Security Service Industrial Security Field Operations National Industrial Security Program (NISP) Authorization Office (NAO)
Defense Security Service Industrial Security Field Operations National Industrial Security Program (NISP) Authorization Office (NAO) Getting Started with the SCAP Compliance Checker and STIG Viewer Job
Security Monitoring Engineer / (NY or NC) Director, Information Security. New York, NY or Winston-Salem, NC. Location:
Position: Reports to: Location: Security Monitoring Engineer / (NY or NC) Director, Information Security New York, NY or Winston-Salem, NC Position Summary: The Clearing House (TCH) Information Security
Using a Vulnerability Description Ontology for vulnerability coordination
Using a Vulnerability Description Ontology for vulnerability coordination - Removing the pain of repetitive analysis of vulnerability reports - Masanobu Katagi, Takayuki Uchiyama (JPCERT/CC, JP), and Masaki
Appendix 12 Risk Assessment Plan
Appendix 12 Risk Assessment Plan DRAFT December 13, 2006 Revision XX Qwest Government Services, Inc. 4250 North Fairfax Drive Arlington, VA 22203 A12-1 RFP: TQC-JTB-05-0001 December 13, 2006 REVISION HISTORY
Measuring and Evaluating Cyber Risk in ICS Components, Products and Systems
Measuring and Evaluating Cyber Risk in ICS Components, Products and Systems Copyright 2018 UL LLC. All rights reserved. No portion of this material may be reprinted in any form without the express written
INFORMATION ASSURANCE DIRECTORATE
National Security Agency/Central Security Service INFORMATION ASSURANCE DIRECTORATE CGS Host Intrusion The Host Intrusion employs a response to a perceived incident of interference on a host-based system
Cyber Hygiene: A Baseline Set of Practices
[DISTRIBUTION STATEMENT A] Approved for public Cyber Hygiene: A Baseline Set of Practices Matt Trevors Charles M. Wallen Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213 Copyright
Mitigating Software Supply Chain Risks
Software Assurance: A Strategic Initiative of the U.S. Department of Homeland Security to Promote Integrity, Security, and Reliability in Software Mitigating Software Supply Chain Risks 11 Dec 2008 Joe
U.S. FLEET CYBER COMMAND U.S. TENTH FLEET Managing Cybersecurity Risk
U.S. FLEET CYBER COMMAND U.S. TENTH FLEET Managing Cybersecurity Risk Neal Miller, Navy Authorizing Official December 13, 2016 UNCLASSIFIED 1 Some Inconvenient Truths The bad guys and gals still only work
Top 20 Critical Security Controls (CSC) for Effective Cyber Defense. Christian Espinosa Alpine Security
Top 20 Critical Security Controls (CSC) for Effective Cyber Defense Christian Espinosa Alpine Security christian.espinosa@alpinesecurity.com Background Christian Espinosa christian.espinosa@alpinesecurity.com
Avoiding an Information Security Mismanagement Program through Fundamentals. Bill Curtis, SynerComm
Avoiding an Information Security Mismanagement Program through Fundamentals Bill Curtis, SynerComm Husband, father and grandfather 30+ years IT/IS: Army Allen Bradley/Rockwell Automation Bucyrus/Caterpillar
Federal Continuous Monitoring Working Group. March 21, DOJ Cybersecurity Conference 2/8/2011
Federal Continuous Monitoring Working Group March 21, 2011 DOJ Cybersecurity Conference 2/8/2011 4/12/2011 Why Continuous Monitoring? Case for Change Strategy Future State Current State Current State Case
Security Issues Formalization
Security Issues Formalization V. T. Dimitrov University of Sofia, Faculty of Mathematics and Informatics, 5 James Bourchier Blvd, 1164, Sofia, Bulgaria E-mail: cht@fmi.uni-sofia.bg Software bugs are primary
SOLUTION BRIEF. RiskSense Platform. RiskSense Platform the industry s most comprehensive, intelligent platform for managing cyber risk.
RiskSense Platform RiskSense Platform the industry s most comprehensive, intelligent platform for managing cyber risk. 27 RiskSense, Inc. Executive Summary The RiskSense Platform is a Software-as-a-Service
2018 Defense Service Catalog
2018 Defense Service Catalog 1 Table of Contents Oracle Health Check... 3 Oracle Systems Information Assurance... 4 Oracle Exadata Installation, Configuration, and Migration... 5 Oracle Real Application
Designing and Building a Cybersecurity Program
Designing and Building a Cybersecurity Program Based on the NIST Cybersecurity Framework (CSF) Larry Wilson lwilson@umassp.edu ISACA Breakfast Meeting January, 2016 Designing & Building a Cybersecurity
Red Hat Enterprise Linux 6 Security Feature Overview. Steve Grubb Principal Engineer, Red Hat June 23, 2010
Red Hat Enterprise Linux 6 Security Feature Overview Steve Grubb Principal Engineer, Red Hat June 23, 2010 Overview Minimal Platform Install Libcap-ng OpenSCAP FIPS-140 Stronger Hashes Common Criteria
Cybersecurity for Health Care Providers
Cybersecurity for Health Care Providers Montgomery County Medical Society Provider Meeting February 28, 2017 T h e MARYLAND HEALTH CARE COMMISSION Overview Cybersecurity defined Cyber-Threats Today Impact
Threat Centric Vulnerability Management
Threat Centric Vulnerability Management Q. Which vulnerabilities should I address first? A. Your EXPOSED vulnerabilities AND the ones criminals are using. Agenda Understanding exploited vulnerabilities
Dr. Emadeldin Helmy Cyber Risk & Resilience Bus. Continuity Exec. Director, NTRA. The African Internet Governance Forum - AfIGF Dec 2017, Egypt
Dr. Emadeldin Helmy Cyber Risk & Resilience Bus. Continuity Exec. Director, NTRA The African Internet Governance Forum - AfIGF2017 5 Dec 2017, Egypt Agenda Why? Threats Traditional security? What to secure?
Practical OpenSCAP, Security Standard Compliance and Reporting Part 1: CLI (command-line)
Presenters: Robin Price II and Martin Preisler Abstract: OpenSCAP is a family of open source SCAP tools and content that help users create standard security checklists for enterprise systems. Natively
STANDARD INFORMATION SHARING FORMATS. Will Semple Head of Threat and Vulnerability Management New York Stock Exchange
STANDARD INFORMATION SHARING FORMATS Will Semple Head of Threat and Vulnerability Management New York Stock Exchange AGENDA Information Sharing from the Practitioner s view Changing the focus from Risk
Chapter 18 SaskPower Managing the Risk of Cyber Incidents 1.0 MAIN POINTS
Chapter 18 SaskPower Managing the Risk of Cyber Incidents 1.0 MAIN POINTS The Saskatchewan Power Corporation (SaskPower) is the principal supplier of power in Saskatchewan with its mission to deliver power
NIST Security Certification and Accreditation Project
NIST Security Certification and Accreditation Project An Integrated Strategy Supporting FISMA Dr. Ron Ross Computer Security Division Information Technology Laboratory 1 Today s Climate Highly interactive
FISMAand the Risk Management Framework
FISMAand the Risk Management Framework The New Practice of Federal Cyber Security Stephen D. Gantz Daniel R. Phi I pott Darren Windham, Technical Editor ^jm* ELSEVIER AMSTERDAM BOSTON HEIDELBERG LONDON
SafeRiver SME. Added Value Solutions for Embedded Systems. Tools for FuSa and Software Security. Packaged Services. CIR agreed
SafeRiver SME Independent- founded december 2005 18 consultants highly skilled in Software and Formal methods Turnover 2015: 1,5M (excluding R&D public fundings) Added Value Solutions for Embedded Systems
Summit Days. Structure and numbering of JVN, and Security content automation framework. Future of Global Vulnerability Reporting Summit
Future of Global Vulnerability Reporting Summit Summit Days Structure and numbering of JVN, and Security content automation framework November 14, 2012 Masato Terada IT Security Center, IPA FIRST TC @
ISACA Arizona May 2016 Chapter Meeting
ISACA Arizona May 2016 Chapter Meeting Suzanne Farr / Carlos A. Villalba Agenda Introduction Preliminary questions CCM Preliminaries Definition Benefits Challenges Beyond Templates Questions 1 Background
Vulnerability Management
Vulnerability Management Modern Vulnerability Management The IT landscape today is changing and because of that, vulnerability management needs to change too. IT environments today are filled with both
PIPELINE SECURITY An Overview of TSA Programs
PIPELINE SECURITY An Overview of TSA Programs Jack Fox Pipeline Industry Engagement Manager Surface Division Office of Security Policy & Industry Engagement May 5, 2014 TSA and Pipeline Security As the
System Assurance. Beyond Detecting. Vulnerabilities. Djenana Campara. Nikolai Mansourov
System Assurance Beyond Detecting Vulnerabilities Nikolai Mansourov Djenana Campara ELSEVIER AMSTERDAM BOSTON HEIDELBERG LONDON NEW YORK OXFORD PARIS SAN DIEGO SAN FRANCISCO SYDNEY TOKYO Morgan Kaufmann
Semantic Potential of existing Security Advisory Standards
Semantic Potential of existing Security Advisory Standards Secure Business Austria Challenges Well maintained and audited IT infrastructure is critical for ensuring business continuity Ever-growing complexity
CERT Development EFFECTIVE RESPONSE
CERT Development EFFECTIVE RESPONSE CERT Development: EFFECTIVE RESPONSE 2 Effective Response Effective Response Well funded, organized attackers threaten your network IT attacks can result in: Loss of
Chapter 5: Vulnerability Analysis
Chapter 5: Vulnerability Analysis Technology Brief Vulnerability analysis is a part of the scanning phase. In the Hacking cycle, vulnerability analysis is a major and important part. In this chapter, we
NIST Special Publication
DATASHEET NIST Special Publication 800-53 Security and Privacy Controls for Federal Information Systems and Organizations Mapping for Carbon Black BACKGROUND The National Institute of Standards and Technology
Streamlined FISMA Compliance For Hosted Information Systems
Streamlined FISMA Compliance For Hosted Information Systems Faster Certification and Accreditation at a Reduced Cost IT-CNP, INC. WWW.GOVDATAHOSTING.COM WHITEPAPER :: Executive Summary Federal, State and
A Supply Chain Attack Framework to Support Department of Defense Supply Chain Security Risk Management
A Supply Chain Attack Framework to Support Department of Defense Supply Chain Security Risk Management D r. J o h n F. M i l l e r T h e M I T R E C o r p o r a t i o n P e t e r D. K e r t z n e r T h
Evaluating and Improving Cybersecurity Capabilities of the Electricity Critical Infrastructure
Evaluating and Improving Cybersecurity Capabilities of the Electricity Critical Infrastructure March 2015 Pamela Curtis Dr. Nader Mehravari Katie Stewart Cyber Risk and Resilience Management Team CERT
TOP 10 IT SECURITY ACTIONS TO PROTECT INTERNET-CONNECTED NETWORKS AND INFORMATION
INFORMATION TECHNOLOGY SECURITY GUIDANCE TOP 10 IT SECURITY ACTIONS TO PROTECT INTERNET-CONNECTED NETWORKS AND INFORMATION ITSM.10.189 October 2017 INTRODUCTION The Top 10 Information Technology (IT) Security
Ian Bryant (VEDEF WG Co-Chair) 26 th May 2006
!" Ian Bryant (VEDEF WG Co-Chair) 26 th May 2006 Summary of Situation Activity Since Last Meeting Discussion Summary of Situation Activity Since Last Meeting Discussion !"# Many TF-CSIRT members are engaged
CAESARS Framework Extension: An Enterprise Continuous Monitoring Technical Reference Architecture (Draft)
NIST Interagency Report 7756 (Draft) Jointly developed with the Department of Homeland Security CAESARS Framework Extension: An Enterprise Continuous Monitoring Technical Reference Architecture (Draft)
Achieving DoD Software Assurance (SwA)
Achieving DoD Software Assurance (SwA) Thomas Hurt Office of the Deputy Assistant Secretary of Defense for Systems Engineering 20th Annual NDIA Systems Engineering Conference Springfield, VA October 26,
Synergies of the Common Criteria with Other Standards
Synergies of the Common Criteria with Other Standards Mark Gauvreau EWA-Canada 26 September 2007 Presenter: Mark Gauvreau (mgauvreau@ewa-canada.com) Overview Purpose Acknowledgements Security Standards
National Information Assurance Partnership
National Information Assurance Partnership Common Criteria Evaluation and Validation Scheme Validation Report McAfee Policy Auditor 5.2 and epolicy Orchestrator 4.5 Report Number: CCEVS-VR-VID10337-2011
Establishing a Framework for Effective Testing and Validation of Critical Infrastructure Cyber-Security
Establishing a Framework for Effective Testing and Validation of Critical Infrastructure Cyber-Security Michael John SmartSec 2016, Amsterdam www.encs.eu European Network for Cyber Security The European
Nebraska CERT Conference
Nebraska CERT Conference Security Methodology / Incident Response Patrick Hanrion Security Center of Excellence Sr. Security Consultant Agenda Security Methodology Security Enabled Business Framework methodology
Automating the Top 20 CIS Critical Security Controls
20 Automating the Top 20 CIS Critical Security Controls SUMMARY It s not easy being today s CISO or CIO. With the advent of cloud computing, Shadow IT, and mobility, the risk surface area for enterprises
INFORMATION ASSURANCE DIRECTORATE
National Security Agency/Central Security Service INFORMATION ASSURANCE DIRECTORATE CGS Risk Monitoring Risk Monitoring assesses the effectiveness of the risk decisions that are made by the Enterprise.
Total Protection for Compliance: Unified IT Policy Auditing
Total Protection for Compliance: Unified IT Policy Auditing McAfee Total Protection for Compliance Regulations and standards are growing in number, and IT audits are increasing in complexity and cost.
INFORMATION ASSURANCE DIRECTORATE
National Security Agency/Central Security Service INFORMATION ASSURANCE DIRECTORATE CGS Network Intrusion The Network Intrusion helps to detect malicious activity incoming to, outgoing from, and on the
Threat and Vulnerability Assessment Tool
TABLE OF CONTENTS Threat & Vulnerability Assessment Process... 3 Purpose... 4 Components of a Threat & Vulnerability Assessment... 4 Administrative Safeguards... 4 Logical Safeguards... 4 Physical Safeguards...
Cybersecurity Technical Risk Indicators:
Cybersecurity Technical Risk Indicators: A Measure of Technical Debt in Software Supply Chain Risk Management Joe Jarzombek, USAF Lt Col (Retired), CSSLP, PMP Global Manager, Software Supply Chain Solutions
CYSE 411/AIT 681 Secure Software Engineering Topic #3. Risk Management
CYSE 411/AIT 681 Secure Software Engineering Topic #3. Risk Management Instructor: Dr. Kun Sun Outline 1. Risk management 2. Standards on Evaluating Secure System 3. Security Analysis using Security Metrics
TCG Trusted Network Connect. SCAP Messages for IF-M
TCG Trusted Network Connect SCAP Messages for IF-M Revision 16 3 October 2012 Public Review Contact: Please submit comments by January 15, 2012 to scap-messagescomments@trustedcomputinggroup.org Review
System Assurance and Related Standards
System Assurance and Related Standards Dr. Ben Calloni, P.E., CISSP, OCRES Lockheed Martin Fellow, Cybersecurity Lockheed Martin Representative to OMG OMG Board of Directors Co-chair OMG System Assurance
Tanium Comply User Guide. Version 1.7.3
Tanium Comply User Guide Version 1.7.3 August 21, 2018 The information in this document is subject to change without notice. Further, the information provided in this document is provided as is and is
Pillars of Cyber Risk as Competitive Advantage: Enabling Enterprise Resilience & Cyber Security Assurance through Software Supply Chain Management
Pillars of Cyber Risk as Competitive Advantage: Enabling Enterprise Resilience & Cyber Security Assurance through Software Supply Chain Management OMG Cyber Risk Summit Pillars of Cyber Risk as Competitive
The SANS Institute Top 20 Critical Security Controls. Compliance Guide
The SANS Institute Top 20 Critical Security Controls Compliance Guide February 2014 The Need for a Risk-Based Approach A common factor across many recent security breaches is that the targeted enterprise