A Pragmatic Path to Compliance. Jaffa Law

Transcription

1 A Pragmatic Path to Compliance Jaffa Law

2 Introduction & Agenda What are the typical regulatory & corporate governance requirements? What do they imply in terms of adjusting the organization's security posture? IBM's vision and solutions address these requirements with visibility, controls & automation, IBM helps organizations with a pragmatic path to compliance 2

3 What are the typical regulatory & corporate governance requirements? Regulations across the World could be divided into 4 categories Prescriptive Not Prescriptive Stick PCI Sarbanes-Oxley, FISMA, HIPAA, Great majority of domestic regulations Carrot [NOTHING] Basel II 3

4 What do regulations imply in terms of adjusting the organization's security posture? Visibility on what is happening in your organization What are the Risks? What could go wrong with my critical assets? What are the Incidents? Exactly how many incidents did we have thus far? Which ones are acceptable and which ones are not What are the Impacts? 4

5 What do regulations imply in terms of adjusting the organization's security posture? A key component of achieving compliance to Regulations is to demonstrate that you know the key risks to your key assets have a plan to address these risks are putting in place mechanisms to reduce the risks (Mitigating Controls) can measure and demonstrate the effectiveness of these mitigating controls 5

6 What do regulations imply in terms of adjusting the organization's security posture? Prove that you know who is doing what Normal Users / Privileged Users / Anonymous Users Identity Management Identity Access User Behavior Prove that your systems hosting critical information assets are (and remain) protected Configuration Monitoring Prove that access to Critical Information Assets is under control Identity Management Access Management 6

7 Visibility The need is to deploy technologies to collect information regarding Incidents User Incidents What are users (internal, external, partners, anonymous) doing with my information assets System Configuration How are my systems configured (and remain configured) from an asset protection point of view 7

8 IBM Tivoli Security Information & Event Management (TSIEM) 8 8

9 Now all Logs in Your Enterprise in a Single Language ComprehendWindows z/os AIX Oracle SAP ISS FireWall-1 Exchange IIS Solaris Translate logs to English IBM s W7 SIEM SIEM saves saves your your information information security security and and compliance compliance staff staff time time and and money money by by automating automating monitoring monitoring across across the the enterprise. enterprise. 9 9

10 Translate Logs into Common Format IBM s W7 Methodology Comprehend Who did What type of action on What? When did he do it and Where, From Where and Where To? We do do the hard work, so so you don t have to!! 10 10

11 Demonstrate Compliance Quick Drill-down Policy Exceptions Special Attentions Failures Trends Reporting DBs Aggregation DBs Enterprise Overview Reports Distribution Self-audit 11 11

12 Security Compliance Manager (SCM) Overview IBM Tivoli Security Compliance Manager is a security policy compliance product that checks systems and applications for vulnerabilities and identifies violations against security policies Key benefits: Checks systems and applications for vulnerabilities by identifying violations against security policies Decreases cost by moving from manual processes, which can last days, to automated scans of systems and desktops lasting only minutes. Decreases IT costs through automation and centralization Integrates with other Tivoli software to take actions to fix violations before damage is done 12 12

13 Proactive Use of Security Compliance Manager 1. Establish corporate security policies (based on system usage, platforms, applications, etc.) 5. Results used to notify system owners of compliance issues requiring mitigation 2. Use/create/modify an SCM policy to collect the necessary information and make appropriate checks to detect compliance 4. SCM audits the new policy and reports are generated on status 3. Deploy the policies (simply associate the policies with the appropriate groups of systems) 13 13

14 Reactive Use of Security Compliance Manager 1. A Microsoft vulnerability is announced targeting Windows systems running the Local Security Authority Subsystem Service (LSASS) 5. Users or IT Operations are notified with instructions on how to fix non-compliant systems 2. Scared of potential damage from Sasser, a policy is created to detect Windows systems running LSASS and to ensure machines are patched 4. SCM audits the new policy and reports are generated on status 3. The new SCM security policy is instantly deployed across Microsoft desktops and servers 14 14

15 IBM Governance and Risk Management Business alignment, visibility and control Another Threat to consider Source: Data Loss Risks During Downsizing, Ponemon Institute LLC,Feb 23, IBM Corporation 15

16 Entitle Users to Applications and Data (Identity Management) Tivoli 16 Identity Manager 16

17 Improve security and compliance readiness through TIM automated security policy enforcement, audit, and reporting 30% or more of all accounts are orphans Gartner Group 1 1. Know the users, understand business context 2. Match accounts to real people 3. Eliminate rouge or orphan accounts 4. Management review and attestation of user rights 5. Remove access rights without valid business need 6. Prevent rouge user changes: detect, correct, and notify Authoritative Identity Source (Human Resources, Customer Master, etc.) 4 TIM Trusted Identity Store John C. Doe 2 Accounts jcd0895 jdoe03 Sarah_s4 nbody Business Applications 6 Recertification Request Sarah s Manager 5 Access Revalidated and Audited Sarah K. Smith 3 doej smiths17 ackerh05 Cisco Web Secure ACS Applications Databases Infrastructure Rouge Administrator 17 17

18 Managing Access to Applications & Data Tivoli Unified Single 18 Sign On 18

19 Unified Single Sign On BEFORE AFTER Access Manager Security Services Unified policy Single user registry Centralized audit and other J2EE Too many Figure passwords 1. Unified, Policy-Based to Security remember for the Web Multiple admins with multiple access control tools User and access control information everywhere Compliance? To what? Web single sign-on Enterprise Single Sign On SOA Identities = Security policy = User & group info = Audit 19 19

20 Getting started with Identity and Access Assurance Single Sign On & Password Management User Provisioning / Role Management Tivoli Identity Manager Accounts on 70 different Accounts on 70 different types of systems managed. types of systems managed. Plus, In-House Systems & Plus, In-House Systems & portals portals Applications Databases Operating Systems HR Systems/ ID stores Networks & Physical Access Access Attestation 1 Security log management & reporting Authoritative Identity Source (Human Resources, Customer Master, etc.) TIM Trusted Identity Store 2 Accounts jcd0895 jdoe03 Sarah_s4 4 John C. Doe nbody Business Applications Recertification Request Sarah s Manager 3 ackerh05 5 Access Revalidated and Audited Sarah K. Smith doej smiths17 Cisco Secure ACS 20

21 IBM Tivoli Security delivering on the IBM Security Strategy Tivoli Security Solutions Identity and Access Assurance Reduce cost and risk by easing the onboarding and offboarding of users, reporting on user activity and ongoing certification Data & Application Security Protect business information & reputation by safeguarding data in use or at rest Security Management for System z Improve mainframe security administration & enable integrated mainframe & distributed security workloads 21

22 IBM: Comprehensive Security Risk & Compliance Management The only security vendor in the market with end-to-end coverage of the security foundation 15,000 researchers, developers and SMEs on security initiatives 3,000+ security & risk management patents 200+ security customer references and 50+ published case studies 40+ years of proven success securing the zseries environment $1.5 Billion security spent in

23 23

24 Trademarks and disclaimers Intel, Intel logo, Intel Inside, Intel Inside logo, Intel Centrino, Intel Centrino logo, Celeron, Intel Xeon, Intel SpeedStep, Itanium, and Pentium are trademarks or registered trademarks of Intel Corporation or its subsidiaries in the United States and other countries./ Linux is a registered trademark of Linus Torvalds in the United States, other countries, or both. Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft Corporation in the United States, other countries, or both. IT Infrastructure Library is a registered trademark of the Central Computer and Telecommunications Agency which is now part of the Office of Government Commerce. ITIL is a registered trademark, and a registered community trademark of the Office of Government Commerce, and is registered in the U.S. Patent and Trademark Office. UNIX is a registered trademark of The Open Group in the United States and other countries. Java and all Java-based trademarks are trademarks of Sun Microsystems, Inc. in the United States, other countries, or both. Other company, product, or service names may be trademarks or service marks of others. Information is provided "AS IS" without warranty of any kind. The customer examples described are presented as illustrations of how those customers have used IBM products and the results they may have achieved. Actual environmental costs and performance characteristics may vary by customer. Information concerning non-ibm products was obtained from a supplier of these products, published announcement material, or other publicly available sources and does not constitute an endorsement of such products by IBM. Sources for non-ibm list prices and performance numbers are taken from publicly available information, including vendor announcements and vendor worldwide homepages. IBM has not tested these products and cannot confirm the accuracy of performance, capability, or any other claims related to non-ibm products. Questions on the capability of non-ibm products should be addressed to the supplier of those products. All statements regarding IBM future direction and intent are subject to change or withdrawal without notice, and represent goals and objectives only. Some information addresses anticipated future capabilities. Such information is not intended as a definitive statement of a commitment to specific levels of performance, function or delivery schedules with respect to any future products. Such commitments are only made in IBM product announcements. The information is presented here to communicate IBM's current investment and development activities as a good faith effort to help with our customers' future planning. Performance is based on measurements and projections using standard IBM benchmarks in a controlled environment. The actual throughput or performance that any user will experience will vary depending upon considerations such as the amount of multiprogramming in the user's job stream, the I/O configuration, the storage configuration, and the workload processed. Therefore, no assurance can be given that an individual user will achieve throughput or performance improvements equivalent to the ratios stated here. Prices are suggested U.S. list prices and are subject to change without notice. Starting price may not include a hard drive, operating system or other features. Contact your IBM representative or Business Partner for the most current pricing in your geography. Photographs shown may be engineering prototypes. Changes may be incorporated in production models. IBM Corporation All rights reserved. References in this document to IBM products or services do not imply that IBM intends to make them available in every country. Trademarks of International Business Machines Corporation in the United States, other countries, or both can be found on the World Wide Web at 24