Mark Hofman SANS Institute/Shearwater Solutions

Transcription

1 Risk and Compliance Mark Hofman SANS Institute/Shearwater Solutions 06 November 2012

2 The risks we face Agenda How are we compromised o The standards we face Why do they fail? How can they work? What else is there?

3 Compliance!= Security Security!= Compliance

4 The risks we face Key loggers Weak or stolen Credentials Data Exfiltration Brute Force Attacks Backdoors Tampering Social engineering Phishing

5 The risks we face Extortion DOS/DDOS SQLi Non Compliance with standards Internal Challenges Complex systemsstems Unknown Systems Operational Challenges Resourcing

6 How are we compromised? 1. Spear Phishing Based on google, facebook, linkedin or other social media and public information 2. Lateral movement 3. Consolidation within target environment 4. Identify and exfiltrate data

7 How are we compromised? 1. Internet facing server compromise 2. Lateral movement 3. Consolidation within target environment 4. Identify and exfiltrate t data WheredoStandardsfit?

8 Standards The Standards we face ISO series es PCI DSS SOX/JSOX COBIT ITIL etc..

9 27000 Series ISO/IEC Information security management systems Requirements ISO/IEC Code of practice for information security management ISO/IEC Information security management system implementation guidance ISO/IEC Information security management Measurement ISO/IEC Information security risk management ISO/IEC Requirements for bodies providing audit and certification of information security management systems ISO/IEC Information technology -- Security techniques -- Information security management for inter-sector and inter organizational communications ISO/IEC Information security management guidelines for telecommunications organizations based on ISO/IEC ISO/IEC Guidelines for information and communications technology readiness for business continuity ISO/IEC Network security overview and concepts ISO/IEC Security incident management ISO Information security management in health using ISO/IEC ISO/IEC Guidelines for information security management systems auditing (focused on the management system) ISO/IEC Guidance for auditors on ISMS controls (focused on the information security controls) ISO/IEC Guideline on the integrated implementation of ISO/IEC and ISO/IEC ISO/IEC Information security governance framework ISO/IEC Information security management guidelines for the finance and insurance sectors ISO/IEC Guideline for cybersecurity (essentially, 'being a good neighbor' on the Internet) ISO/IEC IT network security, a multi-part standard based on ISO/IEC 18028:2006 (part 1 is published already) ISO/IEC Guideline for application security ISO/IEC Guidelines for security of outsourcing ISO/IEC Guidelines for identification, collection and/or acquisition and preservation of digital evidence

10 27001 ISO/IEC Information security management systems Risk Based Standard (Yours) High Level Can certify against the standard Has some required documents Security policy, BCP, Incident Response Plan and more Shades of grey are ok Act Plan Check Do

11 PCI DSS PCI P2PE PCI PTS PCI PA-DSS PCI DSS Risk Based Standard (payment brands) Prescriptive Black and white

12 SOX/COBIT/COSO/ITIL Risk Based Standards d (Not necessarily yours) ) Management frameworks Government FISMA (USA) Information Security Manual (AU)

13

14 Why do they fail to protect? ISO Focus is on the management age e process Risks often not correctly identified Not integrated into normal processes Seen as a hindrance

15 Why do they fail to protect? PCI DSS Can be resource intensive e Not integrated into normal processes Ignores risks not specifically addressed by PCI DSS Segmentation Not using controls to best advantage

16 Why do they not work? Tick Approach Addressing the standard not the basic security requirements Not addressing real risks Prioritization

17 How can they work? If you have to comply, make the standard work for you. The Security team(s) need to embrace the standard(s) Operational teams need to embrace the standard(s) Internal Audit teams need to work with the other teams to make the standards work Management needs to ask what can we get out of it?

18 How can they work? Make sure processes fit with the organisation KISS Principle (not too much red tape) Assess risks regularly

19 How can they work? Get the basics correct Know what youaepoec are protecting Know your systems and network Automate Monitor &R Report Assess Risks Select Controls Implement Controls

20 What else is there? 20 Critical Controls DSD 35 mitigating controls Application Whitelisting Patch Applications Patch Operating Systems Reduce privileged access

21 Questions?