BUILDING CYBERSECURITY CAPABILITY, MATURITY, RESILIENCE
|
|
- Clementine Patterson
- 5 years ago
- Views:
Transcription
1 BUILDING CYBERSECURITY CAPABILITY, MATURITY, RESILIENCE 1
2 WHAT IS YOUR SITUATION? Excel spreadsheets Manually intensive Too many competing priorities Lack of effective reporting Too many consultants Not enough internal knowledge/expertise Not sure which framework or standard Board/C-Suite not confident (and not familiar) etc This presentation contains proprietary information and may not be distributed without the express written permission of the CMMI Institute CMMI Institute.
3 OUR APPROACH IS BASED UPON INTERVIEWS WITH HUNDREDS OF ORGANIZATIONS AROUND THE WORLD
4 ORGANIZATIONS NEED HELP WITH CYBERSECURITY SITUATION UNDERSTANDING READINESS, RISK, RESILIENCE It s a risk based world AND ORGANIZATIONS ARE INSUFFICIENTLY PREPARED FOR CYBER THREATS 87 There is more talk about tech governance than action * % of board directors and C-level execs say they lack confidence in their organization s level of cybersecurity Cybersecurity policies and defenses are the #1 corporate governance technology challenge, yet only 21% of organizational leaders are briefed on risk topics at every senior leadership meeting 53% of organizations believe that malicious attacks are on the rise y/y, but 48% don t feel confident in their teams ability to address complex attacks Organizations need help framing the business case, prioritizing resources and spend to improve cyber readiness and a way to benchmark progress 4 5/6/ ISACA. All Rights Reserved. Data Sources; ISACA State of Cyber Security Report 2017 E&Y Report
5 FROM COMPLIANCE TO RESILIENCE COPERNICAN SHIFT C A P A B I L I T I E S C O M P L I A N C E / C E R T I F I C A T I O N C O M P L I A N C E / C E R T I F I C A T I O N R I S K - B A S E D C A P A B I L I T I E S COMPLIANCE-BASED RISK REDUCTION RESILIENCE-DRIVEN RISK REDUCTION 5 5/6/ ISACA. All Rights Reserved.
6 CYBER SECURITY READINESS & RESILIENCE ASSESS THE RISKS, SCALE THE CAPABILITIES, ENTERPRISE-WIDE SecOps: SecOps describes effective integration of security and IT/OT operations in three key areas: Mission priorities & dependencies Threat information Secure and available technology S E C O P S E N T E R P R I S E S E C U R I T Y R I S K M G M T C A P A B I L I T Y M A T U R I T Y Capability Maturity: Focusing on risk-based capabilities is foundational to building resilience W O R K F O R C E R E A D I N E S S Workforce Readiness: 60% of all attacks were carried out by insiders. 75% involved malicious intent. The workforce is our greatest point of vulnerability and opportunity. 6 5/6/ ISACA. All Rights Reserved.
7 Cyber Security Assessment Solution BENEFITS AND IMPACT STANDARDIZED MATURITY Defines maturity for people, process and technology; includes hygiene; enables industry benchmarking ORGANIZATION- WIDE, RISK-BASED Defines the organization s risk profile and sets maturity targets ROADMAP DEVELOPMENT Provides risk-based prioritization of gaps in capabilities, maturity to support roadmap development, investment options COMPLIANCE VIEWS Provides views into compliance with industrystandard COBIT 5, ISO27001, NIST CSF, CMMI Threat Kill Chain, etc. WE PRESENT OUR RESULTS IN LAYPERSON S TERMS SIMPLE GRAPHICS TO SUPPORT BOARD COMMUNICATION OUR COMPREHENSIVE SCOPE LEVERAGES LEADING FRAMEWORKS, STANDARDS AND CONTROLS
8 CMMI CYBER SECURITY CAPABILITY ASSESSMENT SUPPORTS THE LEADING INDUSTRY STANDARDS
9 DYNAMIC CYBER ASSESSMENT ARCHITECTURE 1. ENSURE GOVERNANCE FRAMEWORK 2. ESTABLISH RISK MANAGEMENT ESTABLISH GOVERNANCE GOVERN CYBERSECURITY RESOURCES ESTABLISH STAKEHOLDER REPORTING ESTABLISH RISK STRATEGY ESTABLISH BUSINESS RISK CONTEXT IMPLEMENT RISK MANAGEMENT Apply Information Security Management Policy Process Evaluate Resource Management Needs Apply Stakeholder Reporting Requirements Apply Risk Management Strategy Determine Mission Dependencies Apply Organization Risk Mgmt. Process Apply Governance System Direct Resource Management Needs Direct Stakeholder Communication and Reporting Apply Risk Management Determine Legal / Regulatory Requirements Integrate Risk Mgmt. Program Direct Governance System Monitor Resource Management Needs Monitor Stakeholder Communication Monitor Governance System Define Organizational Risk Tolerance Determine Critical Infrastructure Requirements Determine Strategic Risk Objectives Manage External Participation 3. IDENTIFY AND MANAGE RISKS IMPLEMENT RISK IDENTIFICATION Asset Discovery & Identification ENSURE ACCESS CONTROL MANAGEMENT Manage Identities and Credentials ESTABLISH ORGANIZATIONAL TRAINING General User Training ESTABLISH DATA SECURITY PROTECTION Safeguard Data at Rest Vulnerability Identification Manage Access to Systems Role-based User Training Safeguard Data in Transit Supply Chain Risk Identification Identification of Roles & Responsibilities Information Classification Considerations Manage Access Permissions 3 rd Party Training Manage Asset Lifecycle Manage Network Integrity & Segregation Manage Communication Protections 5. ENSURE RISK DETECTION ESTABLISH CYBERSECURITY INCIDENT DETECTION ESTABLISH CONTINUOUS MONITORING ESTABLISH DETECTION Capacity Planning Integrity and Data Leak Prevention 4. ENSURE RISK MITIGATION ESTABLISH SECURE APPLICATION ESTABLISH INFORMATION PROTETCION PROVISIONS ESTABLISH PROTECTION PLANNING ESTABLISH PROTECTIVE TECHNOLOGY PROVISIONS Secure Application Development Apply Configuration Baselines Apply Information Sharing Apply Logging and Audit Processes Secure Development Testing Apply Change Control Develop and Maintain Response Plans Manage System Engineering Process Safeguard Development Environment Manage Software Update/Release Processes 6. ENSURE RISK RESPONSE ESTABLISH INCIDENT RESPONSE ESTABLISH INCIDENT ANALYSIS Apply Backup Processes Apply Maintenance Processes Apply Mobile Device Management MITIGATE DETECTED INCIDENTS Develop and Maintain Recovery Plans Apply Personnel Security Apply Vulnerability Mgmt. (Patch) Process Apply Retention and Destruction Measures Apply Media Protections Safeguard Operational Environment 7. ENSURE RESILIENCE ESTABLISH INCIDENT RECOVERY Apply Network Baselines Monitor Networks Detect Malicious Code Aggregate / Correlate Data Monitor Physical Detect Mobile Code and Browser Protection Determine Impacts Monitor Personnel Apply Security Assessment Alert Thresholds Monitor 3 rd Parties Test Detection Processes 9 5/6/ ISACA. All Rights Reserved. Execute Response Plan Implement Incident Investigation Processes Ensure Incident Containment Response Roles & Responsibilities Implement Forensics Capability Ensure Incident Mitigation Incident Reporting Ensure Information Sharing Apply Response Categorization Execute Recovery Plan Recovery Communications
10 CYBERMATURITY PLATFORM CISO Define the scope of the assessment and the organization s risk profile; Risk-based maturity targets are defined RISK PROFILE RISK- BASED MATURITY TARGETS Define organizational priorities; Approve roadmap Board WORKFLOW PROCESS Operations Level Select practices to determine practice area level maturity ISO / CSF / COBIT THREAT VIEW MEASURED MATURITY VS. RISK BASED TARGETS CISO MEASURED MATURITY VS. INDUSTRY RISK PRIORITIZED GAPS AND TECHNICAL SOLUTIONS Develop risk mitigation roadmap MEASURED MATURITY VS. INDUSTRY PRIORITIZED ROADMAP
11 SELECT YOUR COMPANY S UNIQUE RISK PROFILE 2 For each Potential Vulnerability, users will assign the likelihood of each Risk Event resulting from Security Scenario VL VERY LOW L LOW H HIGH VH VERY HIGH Once likelihood of Security Scenarios have been assigned, users will assign an impact for each Risk Event 11 5/6/ ISACA. All Rights Reserved.
12 MEASURING MATURITY BASED ON ACTIVITY IDENTIFY AND MANAGE RISKS IMPLEMENT RISK IDENTIFICATION VULNERABILITY IDENTIFICATION MATURITY LEVEL ACTIVITY AUDIT 5 The organization collaborates with relevant partners (e.g., facilities management, system operations staff) to periodically catalog known vulnerabilities. 5 Staff have been trained and qualified to perform vulnerability identification activities as planned. 5 Relevant managers oversee performance of the vulnerability identification activities. 4 Issues related to vulnerability identification are tracked and reported to relevant managers. 4 Underlying causes for vulnerabilities are identified (e.g., through root-cause analysis) 4 Risks related to the performance of vulnerability identification activities are identified, analyzed, disposed of, monitored, and controlled. 4 Vulnerability identification activities are periodically reviewed to ensure they are adhering to the plan. 3 Stakeholders for vulnerability management activities have been identified and made aware of their roles. 3 A standard set of tools and/or methods is used to identify vulnerabilities. 3 Vulnerability management tools identify those types of platform (e.g., OS, application, device) affected by known vulnerabilities 2 Approved and diverse vulnerability sources are identified and documented. 2 Automated vulnerability scanning tools review all applicable systems on the network (a & b required) a. An SCAP-validated vulnerability scanner is used that looks for both code-based vulnerabilities and configuration-based vulnerabilities b. Vulnerability scans are executed on all applicable devices on a weekly or more frequent basis 2 Risk scores compare the effectiveness of system administrators and departments in reducing risk. 2 Vulnerability scanning occurs in authenticated mode using a dedicated account with administrative rights. (a1 & b OR a2 & b required) a1. Vulnerability Agents operate locally on each applicable end system to analyze the security configuration a2. Remote scanners have administrative rights on each applicable end system to analyze the security configuration b. Dedicated account is used for authenticated vulnerability scans (not used for any other activities) 2 Only authorized employees have access to the vulnerability management user interface and that roles are applied to each user. 2 There exists a documented plan for performing vulnerability identification activities. 2 Vulnerabilities are categorized and prioritized. 2 Specific vulnerabilities that may impact mission-critical personnel, facilities, and resources are identified and catalogued. 1 A repository is used for recording information about vulnerabilities and their resolutions. 1 Vulnerability management tools identify those types of platform (e.g., OS, application, device) affected by known vulnerabilities 1 The organization has identified potential logical vulnerabilities that might lead to known risks. 1 Tools are in place to periodically identify new/updated vulnerabilities that may impact organizational systems. 1 Subscription mechanisms ensure that current vulnerability lists are maintained. PRACTICE AREA MATURITY LEVEL 1 OVERALL MATURITY FOR THIS PRACTICE AREA IS L1 AS NOT ALL BOXES WERE CHECKED FO R L2
13 OUTPUT REPORTS MEASURED MATURITY VS. MEASURED MATURITY RISK-BASED TARGET CAPABILITY AREA IMPLEMENT RISK IDENTIFICATION ENSURE ACCESS CONTROL MANAGEMENT Capability areas sorted by risk ESTABLISH DATA SECURITY PROTECTION ESTABLISH GOVERNANCE ELEMENTS ESTABLISH BUSINESS ENVIRONMENT GOVERN CYBERSECURITY RESOURCES ESTABLISH STAKEHOLDER REPORTING ESTABLISH RISK STRATEGY ESTABLISH BUSINESS RISK CONTEXT IMPLEMENT RISK MANAGEMENT ESTABLISH ORGANIZATIONAL TRAINING ESTABLISH SECURE APPLICATION DEVELOPMENT ESTABLISH INFORMATION PROTECTION PROVISIONS ESTABLISH PROTECTION PLANNING ESTABLISH PROTECTIVE TECHNOLOGY PROVISIONS ESTABLISH CYBERSECURITY INCIDENT DETECTION ESTABLISH CONTINOUS MONITORING ESTABLISH DETECTION PROCESSES ESTABLISH INCIDENT RESPONSE ESTABLISH INCIDENT ANALYSIS MITIGATE DETECTED INCIDENTS ESTABLISH INCIDENT RECOVERY 13 5/6/ ISACA. All Rights Reserved
14 THE ROADMAP PRIORITIZES THE HIGHEST RISK PRACTICE AREAS 296 INCOMPLETE PRACTICES ALIGN TO HIGH RISK PRACTICES AREAS 3
15 4 ENTERPRISE VIEW OF NIST CYBERSECURITY FRAMEWORK ALIGNMENT THE ENTERPRISE CAN MONITOR THEIR PROGRESS AGAINST THE NIST CYBERSECURITY FRAMEWORK
16 UNIT VIEW OF NIST CYBERSECURITY FRAMEWORK ALIGNMENT EACH UNIT CAN MONITOR THEIR PROGRESS AGAINST THE NIST CYBERSECURITY FRAMEWORK 4 Unit 1 Unit 2
17 TRACKING TOOLS KEEP TEAM ON-TRACK
18 WHAT IS YOUR SITUATION? Excel sheets Manually intensive Too many FTEs Lack of reporting Too many consultants Not enough internal knowledge/expertise Not sure what framework or standard etc This presentation contains proprietary information and may not be distributed without the express written permission of the CMMI Institute CMMI Institute.
19 BACK-UP This presentation contains proprietary information and may not be distributed without the express written permission of the CMMI Institute CMMI Institute.
20 This presentation contains proprietary information and may not be distributed without the express written permission of the CMMI Institute CMMI Institute.
21 GARTNER GRC VS IRM 21 5/6/ ISACA. All Rights Reserved.
THE POWER OF TECH-SAVVY BOARDS:
THE POWER OF TECH-SAVVY BOARDS: LEADERSHIP S ROLE IN CULTIVATING CYBERSECURITY TALENT SHANNON DONAHUE DIRECTOR, INFORMATION SECURITY PRACTICES 1 IT S A RISK-BASED WORLD: THE 10 MOST CRITICAL UNCERTAINTIES
More informationFunction Category Subcategory Implemented? Responsible Metric Value Assesed Audit Comments
Function Category Subcategory Implemented? Responsible Metric Value Assesed Audit Comments 1 ID.AM-1: Physical devices and systems within the organization are inventoried Asset Management (ID.AM): The
More informationCertified Information Security Manager (CISM) Course Overview
Certified Information Security Manager (CISM) Course Overview This course teaches students about information security governance, information risk management, information security program development,
More informationDesigning and Building a Cybersecurity Program
Designing and Building a Cybersecurity Program Based on the NIST Cybersecurity Framework (CSF) Larry Wilson lwilson@umassp.edu ISACA Breakfast Meeting January, 2016 Designing & Building a Cybersecurity
More informationINTELLIGENCE DRIVEN GRC FOR SECURITY
INTELLIGENCE DRIVEN GRC FOR SECURITY OVERVIEW Organizations today strive to keep their business and technology infrastructure organized, controllable, and understandable, not only to have the ability to
More informationRSA RISK FRAMEWORKS MAKING DIGITAL RISK MANAGEABLE
WHITEPAPER RSA RISK FRAMEWORKS MAKING DIGITAL RISK MANAGEABLE CONTENTS Executive Summary........................................ 3 Transforming How We Think About Security.......................... 4 Assessing
More informationMapping Your Requirements to the NIST Cybersecurity Framework. Industry Perspective
Mapping Your Requirements to the NIST Cybersecurity Framework Industry Perspective 1 Quest has the solutions and services to help your organization identify, protect, detect, respond and recover, better
More informationCyber Defense Maturity Scorecard DEFINING CYBERSECURITY MATURITY ACROSS KEY DOMAINS
Cyber Defense Maturity Scorecard DEFINING CYBERSECURITY MATURITY ACROSS KEY DOMAINS Cyber Defense Maturity Scorecard DEFINING CYBERSECURITY MATURITY ACROSS KEY DOMAINS Continual disclosed and reported
More informationCYBERSECURITY MATURITY ASSESSMENT
CYBERSECURITY MATURITY ASSESSMENT ANTICIPATE. IMPROVE. PREPARE. The CrowdStrike Cybersecurity Maturity Assessment (CSMA) is unique in the security assessment arena. Rather than focusing solely on compliance
More informationNCSF Foundation Certification
NCSF Foundation Certification Overview This ACQUIROS accredited training program is targeted at IT and Cybersecurity professionals looking to become certified on how to operationalize the NIST Cybersecurity
More informationCyber Resilience. Think18. Felicity March IBM Corporation
Cyber Resilience Think18 Felicity March 1 2018 IBM Corporation Cyber Resilience Cyber Resilience is the ability of an organisation to maintain its core purpose and integrity during and after a cyber attack
More informationEnhancing the Cybersecurity of Federal Information and Assets through CSIP
TECH BRIEF How BeyondTrust Helps Government Agencies Address Privileged Access Management to Improve Security Contents Introduction... 2 Achieving CSIP Objectives... 2 Steps to improve protection... 3
More informationSOLUTION BRIEF RSA ARCHER IT & SECURITY RISK MANAGEMENT
RSA ARCHER IT & SECURITY RISK MANAGEMENT INTRODUCTION Organizations battle growing security challenges by building layer upon layer of defenses: firewalls, antivirus, intrusion prevention systems, intrusion
More informationISO STANDARD IMPLEMENTATION AND TECHNOLOGY CONSOLIDATION
ISO STANDARD IMPLEMENTATION AND TECHNOLOGY CONSOLIDATION Cathy Bates Senior Consultant, Vantage Technology Consulting Group January 30, 2018 Campus Orientation Initiative and Project Orientation Project
More informationMITIGATE CYBER ATTACK RISK
SOLUTION BRIEF MITIGATE CYBER ATTACK RISK CONNECTING SECURITY, RISK MANAGEMENT & BUSINESS TEAMS TO MINIMIZE THE WIDESPREAD IMPACT OF A CYBER ATTACK DIGITAL TRANSFORMATION CREATES NEW RISKS As organizations
More informationSecuring an IT. Governance, Risk. Management, and Audit
Securing an IT Organization through Governance, Risk Management, and Audit Ken Sigler Dr. James L. Rainey, III CRC Press Taylor & Francis Group Boca Raton London New York CRC Press Is an imprint cf the
More informationTHE TRIPWIRE NERC SOLUTION SUITE
CONFIDENCE: SECURED BUSINESS INTELLIGENCE SOLUTION BRIEF THE TRIPWIRE NERC SOLUTION SUITE A TAILORED SUITE OF PRODUCTS AND SERVICES TO AUTOMATE NERC CIP COMPLIANCE u u We ve been able to stay focused on
More informationCompTIA Cybersecurity Analyst+
CompTIA Cybersecurity Analyst+ Course CT-04 Five days Instructor-Led, Hands-on Introduction This five-day, instructor-led course is intended for those wishing to qualify with CompTIA CSA+ Cybersecurity
More informationWhy you should adopt the NIST Cybersecurity Framework
Why you should adopt the NIST Cybersecurity Framework It s important to note that the Framework casts the discussion of cybersecurity in the vocabulary of risk management Stating it in terms Executive
More informationNew York Cybersecurity. New York Cybersecurity. Requirements for Financial Services Companies (23NYCRR 500) Solution Brief
Publication Date: March 10, 2017 Requirements for Financial Services Companies (23NYCRR 500) Solution Brief EventTracker 8815 Centre Park Drive, Columbia MD 21045 About EventTracker EventTracker s advanced
More informationThe Common Controls Framework BY ADOBE
The Controls Framework BY ADOBE The following table contains the baseline security subset of control activities (derived from the Controls Framework by Adobe) that apply to Adobe s enterprise offerings.
More informationK12 Cybersecurity Roadmap
K12 Cybersecurity Roadmap Introduction Jason Brown, CISSP Chief Information Security Officer Merit Network, Inc jbrown@merit.edu @jasonbrown17 https://linkedin.com/in/jasonbrown17 2 Agenda 3 Why Use the
More informationCybersecurity: Considerations for Internal Audit. Gina Gondron Senior Manager Frazier & Deeter Geek Week August 10, 2016
Cybersecurity: Considerations for Internal Audit Gina Gondron Senior Manager Frazier & Deeter Geek Week August 10, 2016 Agenda Key Risks Incorporating Internal Audit Resources Questions 2 San Francisco
More informationICBA Summary of FFIEC Cybersecurity Assessment Tool (May 2017 Update)
ICBA Summary of FFIEC Cybersecurity Assessment Tool (May 2017 Update) June 2017 INSERT YEAR HERE Contact Information: Jeremy Dalpiaz AVP, Cyber and Data Security Policy Jeremy.Dalpiaz@icba.org ICBA Summary
More informationDFARS Compliance. SLAIT Consulting SECURITY SERVICES. Mike D Arezzo Director of Security Services. SLAITCONSULTING.com
DFARS Compliance SLAIT Consulting SECURITY SERVICES Mike D Arezzo Director of Security Services Introduction 18+ year career in Information Technology and Security General Electric (GE) as Software Governance
More informationManchester Metropolitan University Information Security Strategy
Manchester Metropolitan University Information Security Strategy 2017-2019 Document Information Document owner Tom Stoddart, Information Security Manager Version: 1.0 Release Date: 01/02/2017 Change History
More informationSOLUTION BRIEF Virtual CISO
SOLUTION BRIEF Virtual CISO programs that prepare you for tomorrow s threats today Organizations often find themselves in a vise between ever-evolving cyber threats and regulatory requirements that tighten
More informationDefensible Security DefSec 101
Defensible Security DefSec 101 Security Day November 2017 Information Security Branch Paul Falohun Senior Security Analyst Dan Lathigee Senior Project Manager Content 1 Introduction 2 DefSec for PSO 3
More informationMay 14, :30PM to 2:30PM CST. In Plain English: Cybersecurity and IT Exam Expectations
May 14, 2018 1:30PM to 2:30PM CST In Plain English: Cybersecurity and IT Exam Expectations Options to Join Webinar and audio Click on the link: https://www.webcaster4.com/webcast/page/584/24606 Choose
More information2018 WTA Spring Meeting Are You Ready for a Breach? Troy Hawes, Senior Manager
2018 WTA Spring Meeting Are You Ready for a Breach? Troy Hawes, Senior Manager NIST Cybersecurity Framework (CSF) Executive Order 13636 Improving Critical Infrastructure Cybersecurity tasked the National
More informationImproving Cybersecurity through the use of the Cybersecurity Framework
Improving Cybersecurity through the use of the Cybersecurity Framework March 11, 2015 Tom Conkle G2, Inc. Agenda Cybersecurity Framework Why it was created What is it Why it matters How do you use it 2
More informationNebraska CERT Conference
Nebraska CERT Conference Security Methodology / Incident Response Patrick Hanrion Security Center of Excellence Sr. Security Consultant Agenda Security Methodology Security Enabled Business Framework methodology
More informationTechnology Risk Management in Banking Industry. Rocky Cheng General Manager, Information Technology, Bank of China (Hong Kong) Limited
Technology Risk Management in Banking Industry Rocky Cheng General Manager, Information Technology, Bank of China (Hong Kong) Limited Change in Threat Landscape 2 Problem & Threats faced by Banking Industry
More informationInformation Technology Branch Organization of Cyber Security Technical Standard
Information Technology Branch Organization of Cyber Security Technical Standard Information Management, Administrative Directive A1461 Cyber Security Technical Standard # 1 November 20, 2014 Approved:
More informationReinvent Your 2013 Security Management Strategy
Reinvent Your 2013 Security Management Strategy Laurent Boutet 18 septembre 2013 Phone:+33 6 25 34 12 01 Email:laurent.boutet@skyboxsecurity.com www.skyboxsecurity.com What are Your Key Objectives for
More informationHIPAA RISK ADVISOR SAMPLE REPORT
HIPAA RISK ADVISOR SAMPLE REPORT HIPAA Security Analysis Report The most tangible part of any annual security risk assessment is the final report of findings and recommendations. It s important to have
More informationCybersecurity Auditing in an Unsecure World
About This Course Cybersecurity Auditing in an Unsecure World Course Description $5.4 million that s the average cost of a data breach to a U.S.-based company. It s no surprise, then, that cybersecurity
More informationTurning Risk into Advantage
Turning Risk into Advantage How Enterprise Wide Risk Management is helping customers succeed in turbulent times and increase their competitiveness Glenn Tjon Partner KPMG Advisory Presentation Overview
More information"Charting the Course... Certified Information Systems Auditor (CISA) Course Summary
Course Summary Description In this course, you will perform evaluations of organizational policies, procedures, and processes to ensure that an organization's information systems align with overall business
More information2018 HIPAA One All Rights Reserved. Beyond HIPAA Compliance to Certification
2018 HIPAA One All Rights Reserved. Beyond HIPAA Compliance to Certification Presenters Jared Hamilton CISSP CCSK, CCSFP, MCSE:S Healthcare Cybersecurity Leader, Crowe Horwath Erika Del Giudice CISA, CRISC,
More informationCyber Semantic Landscape Ontology and Taxonomy
The Cyber Semantic Landscape Ontology and Taxonomy (CSLOT) provides a structured approach to the dynamic needs of the Cyber security concepts, theories, standards, and compliance issues facing the 21st
More informationEvaluating and Improving Cybersecurity Capabilities of the Electricity Critical Infrastructure
Evaluating and Improving Cybersecurity Capabilities of the Electricity Critical Infrastructure March 2015 Pamela Curtis Dr. Nader Mehravari Katie Stewart Cyber Risk and Resilience Management Team CERT
More informationMike Spear, Ops Leader Greg Maciel, Cyber Director INDUSTRIAL CYBER SECURITY PROGRAMS
Mike Spear, Ops Leader Greg Maciel, Cyber Director INDUSTRIAL CYBER SECURITY PROGRAMS Can You Answer These Questions? 1 What s my company s exposure to the latest industrial cyber threat? Are my plants
More informationBonnie A. Goins Adjunct Industry Professor Illinois Institute of Technology
Bonnie A. Goins Adjunct Industry Professor Illinois Institute of Technology It s a hot topic!! Executives are asking their CISOs a LOT of questions about it Issues are costly, from a financial and a reputational
More informationRisk: Security s New Compliance. Torsten George VP Worldwide Marketing and Products, Agiliance Professional Strategies - S23
Risk: Security s New Compliance Torsten George VP Worldwide Marketing and Products, Agiliance Professional Strategies - S23 Agenda Market Dynamics Organizational Challenges Risk: Security s New Compliance
More information2016 Nationwide Cyber Security Review: Summary Report. Nationwide Cyber Security Review: Summary Report
Nationwide Cyber Security Review: Summary Report Nationwide Cyber Security Review: Summary Report ii Nationwide Cyber Security Review: Summary Report Acknowledgments The Multi-State Information Sharing
More informationDeveloping a Model for Cyber Security Maturity Assessment
Developing a Model for Cyber Security Maturity Assessment Tariq Al-idrissi, Associate Vice President IT, Trent University Ian Thomson, Information Security Officer, Trent University June 20 th, 2018 (8:45am
More informationCISM Certified Information Security Manager
CISM Certified Information Security Manager Firebrand Custom Designed Courseware Logistics Start Time Breaks End Time Fire escapes Instructor Introductions Introduction to Information Security Management
More informationBusiness continuity management and cyber resiliency
Baker Tilly refers to Baker Tilly Virchow Krause, LLP, an independently owned and managed member of Baker Tilly International. Business continuity management and cyber resiliency Introductions Eric Wunderlich,
More informationIncident Response Services to Help You Prepare for and Quickly Respond to Security Incidents
Services to Help You Prepare for and Quickly Respond to Security Incidents The Challenge The threat landscape is always evolving and adversaries are getting harder to detect; and with that, cyber risk
More informationSecurity Metrics Framework
HP Enterprise Services Metrics Framework Richard Archdeacon October 2012 Effective Spending: Better metrics allow intelligent spending on security that matters The current primary focus of information
More informationTEL2813/IS2820 Security Management
TEL2813/IS2820 Security Management Security Management Models And Practices Lecture 6 Jan 27, 2005 Introduction To create or maintain a secure environment 1. Design working security plan 2. Implement management
More informationHealthcare Security Success Story
Regional Forum on Cybersecurity in the Era of Emerging Technologies & the Second Meeting of the Successful Administrative Practices -2017 Cairo, Egypt 28-29 November 2017 Healthcare Security Success Story
More informationDATA SHEET RISK & CYBERSECURITY PRACTICE EMPOWERING CUSTOMERS TO TAKE COMMAND OF THEIR EVOLVING RISK & CYBERSECURITY POSTURE
DATA SHEET RISK & CYBERSECURITY PRACTICE EMPOWERING CUSTOMERS TO TAKE COMMAND OF THEIR EVOLVING RISK & CYBERSECURITY POSTURE EXECUTIVE SUMMARY ALIGNING CYBERSECURITY WITH RISK The agility and cost efficiencies
More informationthe SWIFT Customer Security
TECH BRIEF Mapping BeyondTrust Solutions to the SWIFT Customer Security Controls Framework Privileged Access Management and Vulnerability Management Table of ContentsTable of Contents... 2 Purpose of This
More informationPresented by Ingrid Fredeen and Pamela Passman. Copyright 2017NAVEXGlobal,Inc. AllRightsReserved. Page 0
Cyber Security and Inside Threats: Turning Policies into Practices Presented by Ingrid Fredeen and Pamela Passman Copyright 2017NAVEXGlobal,Inc. AllRightsReserved. Page 0 Presented By Ingrid Fredeen, J.D.
More informationNCSF Foundation Certification
NCSF Foundation Certification Overview This ACQUIROS accredited training program is targeted at IT and Cybersecurity professionals looking to become certified on how to operationalize the NIST Cybersecurity
More informationSDLC Maturity Models
www.pwc.com SDLC Maturity Models SecAppDev 2017 Bart De Win Bart De Win? 20 years of Information Security Experience Ph.D. in Computer Science - Application Security Author of >60 scientific publications
More informationDepartment of Management Services REQUEST FOR INFORMATION
RESPONSE TO Department of Management Services REQUEST FOR INFORMATION Cyber-Security Assessment, Remediation, and Identity Protection, Monitoring, and Restoration Services September 3, 2015 250 South President
More informationIntegrating Cyber Security with Business Continuity Management to Build the Resilient Enterprise
February 11 14, 2018 Gaylord Opryland Resort and Convention Center, Nashville #DRI2018 Integrating Cyber Security with Business Continuity Management to Build the Resilient Enterprise Tejas Katwala CEO
More informationCyber Risk Program Maturity Assessment UNDERSTAND AND MANAGE YOUR ORGANIZATION S CYBER RISK.
Cyber Risk Program Maturity Assessment UNDERSTAND AND MANAGE YOUR ORGANIZATION S CYBER RISK. In today s escalating cyber risk environment, you need to make sure you re focused on the right priorities by
More informationWhat It Takes to be a CISO in 2017
What It Takes to be a CISO in 2017 Doug Copley Deputy CISO Sr. Security & Privacy Strategist February 2017 IMAGINE You re the CISO In Bangladesh Of a bank On a Friday when you re closed You realize 6 huge
More informationThreat and Vulnerability Assessment Tool
TABLE OF CONTENTS Threat & Vulnerability Assessment Process... 3 Purpose... 4 Components of a Threat & Vulnerability Assessment... 4 Administrative Safeguards... 4 Logical Safeguards... 4 Physical Safeguards...
More informationCOMPLIANCE BRIEF: NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY S FRAMEWORK FOR IMPROVING CRITICAL INFRASTRUCTURE CYBERSECURITY
COMPLIANCE BRIEF: NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY S FRAMEWORK FOR IMPROVING CRITICAL INFRASTRUCTURE CYBERSECURITY OVERVIEW On February 2013, President Barack Obama issued an Executive Order
More informationRocky Mountain Cyberspace Symposium 2018 DoD Cyber Resiliency
Rocky Mountain Cyberspace Symposium 2018 DoD Cyber Resiliency Mr. Ed Brindley Acting Deputy Cyber Security Department of Defense 7 March 2018 SUPPORT THE WARFIGHTER 2 Overview Secretary Mattis Priorities
More informationalign security instill confidence
align security instill confidence cyber security Securing data has become a top priority across all industries. High-profile data breaches and the proliferation of advanced persistent threats have changed
More informationCertified Information Systems Auditor (CISA)
Certified Information Systems Auditor (CISA) 1. Domain 1 The Process of Auditing Information Systems Provide audit services in accordance with IT audit standards to assist the organization in protecting
More informationHow to Develop Key Performance Indicators for Security
SESSION ID: How to Develop Key Performance Indicators for Security James Tarala Principal and Senior Instructor Enclave Security / The SANS Institute @isaudit Laying a Foundation For metrics to be effective,
More informationCybersecurity Today Avoid Becoming a News Headline
Cybersecurity Today 2017 Avoid Becoming a News Headline Topics Making News Notable Incidents Current State of Affairs Common Points of Failure Three Quick Wins How to Prepare for and Respond to Cybersecurity
More informationIndustrial Defender ASM. for Automation Systems Management
Industrial Defender ASM for Automation Systems Management INDUSTRIAL DEFENDER ASM FOR AUTOMATION SYSTEMS MANAGEMENT Industrial Defender ASM is a management platform designed to address the overlapping
More informationRethinking Information Security Risk Management CRM002
Rethinking Information Security Risk Management CRM002 Speakers: Tanya Scott, Senior Manager, Information Risk Management, Lending Club Learning Objectives At the end of this session, you will: Design
More informationNational Initiative for Cyber Education (NICE) and the Cybersecurity Workforce Framework: Attract and Retain the Best in InfoSec.
National Initiative for Cyber Education (NICE) and the Cybersecurity Workforce Framework: Attract and Retain the Best in InfoSec April 12, 2018 1 Introduction to NICE - The National Initiative for Cybersecurity
More informationFlorida Government Finance Officers Association. Staying Secure when Transforming to a Digital Government
Florida Government Finance Officers Association Staying Secure when Transforming to a Digital Government Agenda Plante Moran Introductions Technology Pressures and Challenges Facing Government Technology
More informationRSA IT Security Risk Management
RSA IT Security Risk Adding Insight to Security March 18, 2014 Wael Jaroudi GRC Sales Specialist 1 Where is Security Today? Companies have built layer upon layer of security, but is it helping? Complexity
More informationCYBERSECURITY RESILIENCE
CLOSING THE IN CYBERSECURITY RESILIENCE AT U.S. GOVERNMENT AGENCIES Two-thirds of federal IT executives in a new survey say their agency s ability to withstand a cyber event, and continue to function,
More informationCYBERSECURITY FOR STARTUPS AND SMALL BUSINESSES OVERVIEW OF CYBERSECURITY FRAMEWORKS
CYBERSECURITY FOR STARTUPS AND SMALL BUSINESSES OVERVIEW OF CYBERSECURITY FRAMEWORKS WILLIAM (THE GONZ) FLINN M.S. INFORMATION SYSTEMS SECURITY MANAGEMENT; COMPTIA SECURITY+, I-NET+, NETWORK+; CERTIFIED
More informationBuilding a Resilient Security Posture for Effective Breach Prevention
SESSION ID: GPS-F03B Building a Resilient Security Posture for Effective Breach Prevention Avinash Prasad Head Managed Security Services, Tata Communications Agenda for discussion 1. Security Posture 2.
More informationHow to Underpin Security Transformation With Complete Visibility of Your Attack Surface
How to Underpin Security Transformation With Complete Visibility of Your Attack Surface YOU CAN T SECURE WHAT YOU CAN T SEE There are many reasons why you may be considering or engaged in a security transformation
More informationUsing Metrics to Gain Management Support for Cyber Security Initiatives
Using Metrics to Gain Management Support for Cyber Security Initiatives Craig Schumacher Chief Information Security Officer Idaho Transportation Dept. January 2016 Why Metrics Based on NIST Framework?
More informationSecurity Architecture
Security Architecture RDX s top priority is to safeguard our customers sensitive information. Introduction RDX understands that our customers have turned over the keys to their sensitive data stores to
More informationThe SANS Institute Top 20 Critical Security Controls. Compliance Guide
The SANS Institute Top 20 Critical Security Controls Compliance Guide February 2014 The Need for a Risk-Based Approach A common factor across many recent security breaches is that the targeted enterprise
More informationHelping the C-Suite Define Cyber Risk Appetite. The executive Imperative
Helping the C-Suite Define Cyber Risk Appetite The executive Imperative Welcome Steve Schlarman GRC Strategist CISSP, CISM @steveschlarman Executive Priorities Growth is the highest priority. 54 % 25 %
More informationBalancing Compliance and Operational Security Demands. Nov 2015 Steve Winterfeld
Balancing Compliance and Operational Security Demands Nov 2015 Steve Winterfeld What is more important? Compliance with laws / regulations Following industry best practices Developing a operational practice
More informationEU General Data Protection Regulation (GDPR) Achieving compliance
EU General Data Protection Regulation (GDPR) Achieving compliance GDPR enhancing data protection and privacy The new EU General Data Protection Regulation (GDPR) will apply across all EU member states,
More informationAutomating the Top 20 CIS Critical Security Controls
20 Automating the Top 20 CIS Critical Security Controls SUMMARY It s not easy being today s CISO or CIO. With the advent of cloud computing, Shadow IT, and mobility, the risk surface area for enterprises
More informationThe Business Value of including Cybersecurity and Vendor Risk in ERM
The Business Value of including Cybersecurity and Vendor Risk in ERM Yo Delmar, Vice President, Customer Engagement, MetricStream RMA GCOR XI April 4 5, 2017 Hyatt Regency, Cambridge, MA Tuesday 2:30 pm
More informationFederal Civilian Executive branch State, Local, Tribal, Territorial government (SLTT) Private Sector (PS) Unclassified / Business Networks
Brownsville Public Utilities Board Cyber Security Initiative A result of the BPUB IT Strategic Plan implemented a Cyber Security Framework (CSF) that utilizes : Security standards Tools and Best practices
More informationSecurity Management Models And Practices Feb 5, 2008
TEL2813/IS2820 Security Management Security Management Models And Practices Feb 5, 2008 Objectives Overview basic standards and best practices Overview of ISO 17799 Overview of NIST SP documents related
More informationSession ID: CISO-W22 Session Classification: General Interest
Session ID: CISO-W22 Session Classification: General Interest Pain Points What are your two biggest information security-related pain points?* Mobile Device Security Security Awareness Training User Behavior
More informationInformation Technology Security Plan Policies, Controls, and Procedures Identify Governance ID.GV
Information Technology Security Plan Policies, Controls, and Procedures Identify Governance ID.GV Location: https://www.pdsimplified.com/ndcbf_pdframework/nist_csf_prc/documents/identify/ndcbf _ITSecPlan_IDGV2017.pdf
More informationDigital Service Management (DSM)
Digital Service Management (DSM) A Proactive, Collaborative and Balanced Approach for Securing, Managing and Improving the Online Services that Drive the Digital Enterprise itsm003 v.3.0 Agenda and Objectives
More informationISO/IEC Solution Brief ISO/IEC EventTracker 8815 Centre Park Drive, Columbia MD 21045
Solution Brief 8815 Centre Park Drive, Columbia MD 21045 About delivers business critical software and services that transform high-volume cryptic log data into actionable, prioritized intelligence that
More informationCybersecurity What Companies are Doing & How to Evaluate. Miguel Romero - NAIC David Gunkel & Dan Ford Rook Security
Cybersecurity What Companies are Doing & How to Evaluate Miguel Romero - NAIC David Gunkel & Dan Ford Rook Security Learning Objectives At the end of this presentation, you will be able to: Explain the
More informationPONEMON INSTITUTE RESEARCH REPORT 2018 STUDY ON GLOBAL MEGATRENDS IN CYBERSECURITY
PONEMON INSTITUTE RESEARCH REPORT 2018 STUDY ON GLOBAL MEGATRENDS IN CYBERSECURITY Benchmark research sponsored by Raytheon. Independently conducted by Ponemon Institute LLC. February 2018 2018 Study on
More informationNew York Department of Financial Services Cybersecurity Regulation Compliance and Certification Deadlines
New York Department of Financial Services Cybersecurity Regulation Compliance and Certification Deadlines New York Department of Financial Services ( DFS ) Regulation 23 NYCRR 500 requires that entities
More informationSecurity and Privacy Governance Program Guidelines
Security and Privacy Governance Program Guidelines Effective Security and Privacy Programs start with attention to Governance. Governance refers to the roles and responsibilities that are established by
More informationConvergence of BCM and Information Security at Direct Energy
Convergence of BCM and Information Security at Direct Energy Karen Kemp Direct Energy Session ID: GRC-403 Session Classification: Advanced About Direct Energy Direct Energy was acquired by Centrica Plc
More informationDo You Know Your Organization's Top 10 Security Risks?
SESSION ID: GRC-F01 Do You Know Your Organization's Top 10 Security Risks? Min-Hwei Liu Director, Information Security, Aetna 14,300 Network alerts # of Applications # of Servers Monitored What does the
More informationMark Littlejohn June 23, 2016 DON T GO IT ALONE. Achieving Cyber Security using Managed Services
Mark Littlejohn June 23, 2016 DON T GO IT ALONE Achieving Cyber Security using Managed Services Speaker: Mark Littlejohn 1 Mark is an industrial technology professional with over 30 years of experience
More informationData Protection. Practical Strategies for Getting it Right. Jamie Ross Data Security Day June 8, 2016
Data Protection Practical Strategies for Getting it Right Jamie Ross Data Security Day June 8, 2016 Agenda 1) Data protection key drivers and the need for an integrated approach 2) Common challenges data
More information