6.6 INCIDENT RESPONSE MANAGEMENT SERVICES (INRS) (L )
|
|
- Donna Summers
- 5 years ago
- Views:
Transcription
1 6.6 INCIDENT RESPONSE MANAGEMENT SERVICES (INRS) (L ) Qwest INRS provides Agencies with a proven, reliable set of people, processes and tools to effectively prepare for and respond to computer security incidents, all too common in today s Internet-connected environment. A computer security incident is defined as an adverse event in a computer system or network caused by a failure of a security mechanism or an attempt to breach these mechanisms. Such incidents are becoming more common and their impact is far reaching. When faced with an incident, an organization should be able to respond quickly to protect both its own information and that of others affected. The Office of Management and Budget (OMB) Circular A-130 requires each Agency to be able to respond to security incidents and to share information concerning vulnerabilities and threats. Handling a security incident requires six steps shown in Figure Figure provides a closer look at these six steps as an example of our response to viruses RFP: TQC-JTB December 13, 2006
2 Figure Six Steps for Incident Response Steps 1. Preparation 2. Identification 3. Containment 4. Eradication 5. Recovery 6. Follow-Up Activities Involved and Discussion Assess impacts of viruses and containment efforts Identify software or hardware needed for response Determine types and number of personnel resources needed Develop containment strategy, test it, and reassess its impact Procure items and assign personnel resources identified in assessment phase Identify virus type and assess impact Determine how virus is spread (ports, , other) using tools such as sniffer traces and logs Develop containment strategy to limit spread Identify critical business users and systems, prioritize clean-up Quarantine and physically remove all potentially infected PCs from the network Detect and remove virus Apply OS software patch Install/update virus software Perform a virus scan via a bootable disk, install MS patch, install current virus protection software, and scan Where possible, perform these procedures first on critical PCs Perform quality assessment of each vulnerable PC to ensure that it is clean, protected, and ready to be put back into production All PCs that have passed the Quality Assurance procedure are returned to production status and tested Continue monitoring network traffic as warranted Conduct follow-up analysis roundtable discussion Document lessons learned, change preparation plans accordingly The Security Operations Center (SOC) infrastructure is designed on best-ofbreed technology and is modular for rapid expansion and transaction processing. Our Security Information Manager is scalable to tens of thousands of log events per second, regardless of geographical location. The Qwest Team provides information security services to most Government Agencies as well as the financial, information technology, energy, aerospace, health, entertainment, and publishing industries. We are set apart by the personalization and attention we give to each of our customers. We understand that having a lead engineer assigned as a point of contact along with trained, cleared personnel delivering services provides peace of mind RFP: TQC-JTB December 13, 2006
3 6.6.1 Technical Approach to Incident Response Management Service Delivery (L ) Qwest INRS provides Incident Response Capability (IRC) assessment, an incident tracking system, a mock-crisis management scenario, incident response support services, and on-site support. We offer IRC development, a successful process for minimizing incident impacts and exposures, and a core staff of recognized incident response experts. Qwest resources include world-class information protection laboratories, and world-wide deployment of proprietary, country-approved tools Approach to Incident Response Management Service Delivery (L (a)) information required by any Agency. to capture and track the 1282 RFP: TQC-JTB December 13, 2006
4 1283 RFP: TQC-JTB December 13, 2006
5 Qwest INRS complies with these required standards, including the Federal Information Systems Management Act of 2002 (FISMA), Federal Information Processing Standards 199, Internet Engineering Task Force (IETF)-RFC2350, US- Corporate Emergency Response Team (CERT), and the National Institute of Standards and Technology (SP) The system is available any time from any place over the public Internet. Qwest s IRTS system, a secure data repository for an Agency, is available This system will aid by recording and tracking reported events. Authorized Agency contacts will have 1284 RFP: TQC-JTB December 13, 2006
6 remote access to the IRTS to run reports and as a tool to manage the INRS program Benefits of Incident Response Management Services Technical Approach (L (b)) Qwest s INRS approach offers user Agencies these benefits, as shown in Figure Figure Features and Benefits of Qwest INRS Approach Feature Consistent, Fast, and Skilled Response to Incidents Quick Recovery from Network Events Life Cycle Approach to INRS Strong Legal Remediation Regulatory Compliance Analysis of the Current Environment Documentation of the Computing Environment Benefit Responding to incidents systematically so that all the appropriate steps are taken Smart response to network threats limits data loss and minimizes overall network disruption. Documented knowledgebase of information provides the Agency with a robust experience that is leveraged for future threats. Agency will have sound documentation and recorded evidence in which to use for remediation activities that may require legal attention. Besides of the business reasons for an incident response capability, Agencies must comply with applicable laws, regulations, and policies directing a coordinated, effective defense against information security threats The Agency will benefit from a consistent, predictable, and effective response to threats with Qwest INRS. This documentation is utilized to cover regulatory requirements, which suggest an auditor-ready book for review of all systems 1285 RFP: TQC-JTB December 13, 2006
7 Feature Fully Tested Pilot Implementation Complete Set of Best Practices Knowledgebase to be used for Agency Operational Procedures Benefit Agency will have peace of mind knowing their trusted partner has a rigorously documented and tested SOP on file and is prepared to respond to threats. Qwest INRS Best Practices in tandem with the Agency s SOPs provide documentation for Agency employees threat response. Qwest s INRS technical approach is effective in providing a means to address FISMA, which requires Government Agencies to institute an information security program with the ability to manage and annually reassess risk. Qwest INRS offering supports the Federal Enterprise Architecture (FEA), as noted in Figure Figure Qwest INRS Meets FEA Requirements FEA Requirement Improve utilization of Government information resources Improve Service Delivery Enhance Cost Savings and Cost Avoidance Maximize Technology Investments Increase Cross-Agency and Inter-Government collaboration Simplify Processes and Unify Work across Agencies Improve Performance Metrics Feature and Substantiation The Qwest Team will leverage its experience and lessons learned to improve security techniques, such as effective incident response and restoration. This allows Agencies to focus on core missions and service delivery to constituents. Successful processes for minimizing incident impact/exposures; specialized tools Qwest s INRS is supported by certified security professionals. Their expertise enables the Agency to comply with regulations regarding notification of incidents that might expose private information. Qwest s INRS limits Agency staff time identifying and responding to sophisticated network events such as viruses, attacks, and other malicious activity. Access to world-class information protection laboratories and their resources. Qwest s INRS enables Agency administrators to share threat response information across various departments in order to ensure malicious activity can be controlled and potentially eliminated across the network. A smart, collective effort to thwart expensive intrusions and disruptions is the best collaborative defense. The Qwest Team offers worldwide deployment of incident expertise with countryspecific tools. Core staff of industry-recognized incident response experts RFP: TQC-JTB December 13, 2006
8 Solutions to Incident Response Management Services Problems (L (c)) During operation a variety of problems have arisen and we have instituted effective solutions. We codify the lessons learned and apply them to improve methods. Figure presents several potential problems and our solution/mitigation approach. Figure Anticipated INRS Problems and Qwest Solutions Problem Many users are not incident response experts. Agencies may have unique networks, systems, architectures, or requirements. Incidents don't always happen during standard business hours Satisfaction of Incident Response Management Services Performance Requirements Incident Response Management Services Quality of Service (L (a)) Our Incident Response Service performance metrics are shown in Figure Figure Qwest INRS Key Performance Indicators (KPIs) Key Performance Indicator (KPI) Response Time (Telephone) Service Level Routine Performance Standard (Threshold) Within 1 hour of the notification for a Low category incident Within 15 minutes of the notification for a High category incident Acceptable Quality Level (AQL) 1 hour 15 minutes Response Time (On-Site) Routine Within 36 hours of the notification for a Low category incident Within 24 hours of the notification for a High category incident. 36 hours 24 hours 1287 RFP: TQC-JTB December 13, 2006
9 Qwest INRS meets all performance requirements. We have proven monitoring and measurement systems, procedures, and evaluation methods in place. The Government performance metrics are consistent with commercial standards and we are able to meet each of these performance requirements by staffing our SOC 24x7x365. Qwest has the necessary resources available to respond to incidents encountered by Agencies Approach for Monitoring and Measuring Incident Response Management Services (L (b)) All incident response reports are tracked in our Trouble Ticket System. Reports are processed by analysts according to an established work flow and response times are tracked for each report and event Verification of Incident Response Management Services (L (c)) Data to support the measurement of the Government-specified KPIs is collected on a continuous basis; computed statistics are made available to authorized customer personnel. The raw data is collected through the INRS system, network, and availability monitoring tools, and through our customer change/problem tracking system Incident Response Management Services Performance Requirements (L (d)) 1288 RFP: TQC-JTB December 13, 2006
10 Additional Incident Response Management Services Performance Metrics (L (e)) Satisfaction of Incident Response Management Services Specifications (L ) The Qwest Team will provide a time-tested INRS from our 24x7x365 SOC. Qwest fully complies with all mandatory stipulated and narrative capabilities, features, and interface requirements for INRS. The following Figure and Section summarize Qwest s response to the INRS capabilities listed in RFP C , features of RFP C , and interfaces of RFP C These subsections are intended to provide the technical description required per L (a) and do not limit or caveat Qwest s compliance in any way Satisfaction of Incident Response Management Service Requirements (L (a)) Because of our broad inter-agency view, we will provide notification of threats to Agencies well in advance, protecting them from incidents in the long run. Examples of this support are as follows: 1289 RFP: TQC-JTB December 13, 2006
11 Fraud/Incident Support: Qwest will provide expert, incident-specific support before, during, and after investigations of fraud and security incidents. We offer high-level expertise, customized solutions for various incidents, and focus on technical, human and business assessments. Pre-Incident Planning and Preparation: We offer policy and procedures development and review, organizational assessments, education and awareness training. During Incident: Services include incident handling and analysis, onsite incident response support and coordination, and, if appropriate, forensics and evidence collection. Post-Incident: This includes artifact handling, analysis and response, forensic analysis, reports, conclusions and recommendations, and aftermath assessment Satisfaction of INRS Capability Requirements (L (a); C ) Qwest INRS offering meets the required capabilities as shown in Figure Figure Qwest INRS Capabilities Required INRS Capabilities 1. The contractor shall review the Agency s security infrastructure and develop the appropriate strategic plans in collaboration with the Agency. These plans shall detail the incident response process, identify internal resources, assign duties to team members, descr be policies, define severity levels, list escalation chains, and specify emergency/recovery procedures. 2. The contractor shall provide the Agency with effective incident response support on a 24x7x RFP: TQC-JTB December 13, 2006
12 Required INRS Capabilities 3. The contractor shall provide incident analysis and assessment in order to determine the scope and impact of incidents. 4. The contractor shall coordinate with the Agency to handle potential security incidents according to the appropriate response procedures. 5. The contractor shall provide countermeasures to contain the security incident, limit its spread, and protect internal systems. 6. The contractor shall recommend the fixes necessary to eliminate identified vulnerabilities and the appropriate procedures to guard against future attacks. 7. The contractor shall provide the Agency with secure Web access to incident analysis findings and recommendations. 8. The contractor shall assist the Agency in containing the damage and restoring affected systems to their normal operational state. 9. The contractor shall assist the Agency in testing restored systems in order to ensure that identified vulnerabilities have been corrected. 10. The contractor shall provide dedicated support until resolution of the problem. 11. The contractor shall provide postincident investigative and forensics services. This includes isolating the impacted area, capturing and collecting data, categorizing malicious or illegal events, and performing 1291 RFP: TQC-JTB December 13, 2006
13 Required INRS Capabilities reconstruction analyses. The contractor shall handle and preserve the data collected according to sound scientific and evidence rules, as the information may serve as evidence in administrative actions and legal proceedings. The contractor shall trace the offenders and assist in prosecuting attackers, as required. 12. The contractor shall provide telephone support to the Agency, as required. 13. The contractor shall deploy cyber security personnel to Agency sites to handle security incidents, as necessary. 14. The contractor shall provide security awareness training to Agency personnel as required. This includes mock attack drills, emerging threats and vulnerabilities workshops, and new incident response tools and processes demonstrations. The frequency and nature of training activities may vary according to Agency needs Satisfaction of INRS Interface Requirements (L (a); C ) All incident response analysis and recommendations will be available Proposed Enhancements for Incident Response Management Services (L (b)) 1292 RFP: TQC-JTB December 13, 2006
14 Network Modifications Required for Incident Response Management Services Delivery (L (c)) Experience with Incident Response Management Services Delivery (L (d)) Qwest has many years of experience in providing INRS for large and small organizations and Government Agencies with multiple platforms and products. Our INRS monitors the US-CERT and was asked for assistance with Presidential Decision Directive 63 (PDD-63). PDD-63 focused on securing the nation s critical infrastructures, and as a trusted advisor in this area, we helped establish and support the first Financial Services ISAC (FS/ISAC) RFP: TQC-JTB December 13, 2006
15 Managed Tiered Security Services (MTSS) Approach (L (e)) INRS is part of Qwest's MTSS technical solution. Design, implementation and delivery according to GSA's MTSP, Figure , will be addressed to meet an Agency s requirements based on security service levels identified as described in Section 6.8. A defense-in-depth strategy and technical solution that includes INRS best practices will be structured to the network architecture as described in MTSP Tier 2 - Protected Service will provide security enhancements to the subscribing Agency with additional protection from unauthorized activities and the proliferation of malicious code. Protected service will also mitigate the potential for Denial of Service attacks. Security enhancements include a 1294 RFP: TQC-JTB December 13, 2006
16 combination of firewall, premises-based virtual private network (encrypted tunnels), filtering router, proxy server, and boundary anti-virus detection technologies configurable to the subscribing Agency's security policy(s) and specifications. Tier 2 is tailored to Sensitive But Unclassified mission functions and information. It employs both technical and network management components appropriate to the respective mission and/or information sensitivity RFP: TQC-JTB December 13, 2006
6.0 SECURITY SERVICES 6.1 MANAGED FIREWALL SERVICE (L )
6.0 SECURITY SERVICES 6.1 MANAGED FIREWALL SERVICE (L.34.1.6) Qwest s Managed Firewall Service is a proven global managed security service that provides an effective front line of defense for Agencies
6.2 OPTIONAL SECURITY SERVICES
6.2 OPTIONAL SECURITY SERVICES This section presents Qwest s proposed optional services for the Networx program. In our selection of optional services we applied two criteria: Does the Qwest Team have
locuz.com SOC Services
locuz.com SOC Services 1 Locuz IT Security Lifecycle services combine people, processes and technologies to provide secure access to business applications, over any network and from any device. Our security
5.7 DEDICATED HOSTING SERVICES (DHS)
5.7 DEDICATED HOSTING SERVICES (DHS) Qwest s Networx Dedicated Hosting Services provides a secure and highly available environment for Agency applications, which allows Agencies to free up valuable resources.
Continuous protection to reduce risk and maintain production availability
Industry Services Continuous protection to reduce risk and maintain production availability Managed Security Service Answers for industry. Managing your industrial cyber security risk requires world-leading
Enterprise SM VOLUME 1, SECTION 5.4: ANTI-VIRUS MANAGEMENT SERVICE
VOLUME 1, SECTION 5.4: ANTI-VIRUS MANAGEMENT SERVICE 5.4 ANTI-VIRUS MANAGEMENT SERVICE [C.2.10.4, M.2.1.3] The Level 3 Team s (AVMS) will meet or exceed the Government s requirements for AVMS, as defined
CCISO Blueprint v1. EC-Council
CCISO Blueprint v1 EC-Council Categories Topics Covered Weightage 1. Governance (Policy, Legal, & Compliance) & Risk Management 1.1 Define, implement, manage and maintain an information security governance
Incident Response Services
Services Enhanced with Supervised Machine Learning and Human Intelligence Empowering clients to stay one step ahead of the adversary. Secureworks helps clients enable intelligent actions to outsmart and
Appendix 12 Risk Assessment Plan
Appendix 12 Risk Assessment Plan DRAFT December 13, 2006 Revision XX Qwest Government Services, Inc. 4250 North Fairfax Drive Arlington, VA 22203 A12-1 RFP: TQC-JTB-05-0001 December 13, 2006 REVISION HISTORY
Department of Management Services REQUEST FOR INFORMATION
RESPONSE TO Department of Management Services REQUEST FOR INFORMATION Cyber-Security Assessment, Remediation, and Identity Protection, Monitoring, and Restoration Services September 3, 2015 250 South President
3.0 NETWORX ARCHITECTURE FOR IP-BASED SERVICES (L ) (M.2.1) (a), M.2.1.1(a))
3.0 NETWORX ARCHITECTURE FOR IP-BASED SERVICES (L.34.1.3) (M.2.1) (a), M.2.1.1(a)) Qwest offers a unique combination of technical vision, true service convergence, and a proven track record of delivering
5.6 WEB CONFERENCING SERVICE (WCS) (L )
5.6 WEB CONFERENCING SERVICE (WCS) (L.34.1.5) Qwest s Networx WCS uses a simple online interface to conduct live interactive meetings and deliver high-impact presentations, demonstrations and training
University of Pittsburgh Security Assessment Questionnaire (v1.7)
Technology Help Desk 412 624-HELP [4357] technology.pitt.edu University of Pittsburgh Security Assessment Questionnaire (v1.7) Directions and Instructions for completing this assessment The answers provided
Service. Sentry Cyber Security Gain protection against sophisticated and persistent security threats through our layered cyber defense solution
Service SM Sentry Cyber Security Gain protection against sophisticated and persistent security threats through our layered cyber defense solution Product Protecting sensitive data is critical to being
Cybersecurity: Incident Response Short
Cybersecurity: Incident Response Short August 2017 Center for Development of Security Excellence Contents Lesson 1: Incident Response 1-1 Introduction 1-1 Incident Definition 1-1 Incident Response Capability
Appendix 3 Disaster Recovery Plan
Appendix 3 Disaster Recovery Plan DRAFT March 5, 2007 Revision XX Qwest Government Services, Inc. 4250 North Fairfax Drive Arlington, VA 22203 A3-i RFP: TQC-JTB-05-0002 March 5, 2007 REVISION HISTORY Revision
4.0 TRANSPORT/IP/OPTICAL SERVICES 4.1 MANDATORY SERVICES
4.0 TRANSPORT/IP/OPTICAL SERVICES 4.1 MANDATORY SERVICES The following sections present Qwest s response to the mandatory Transport/IP/Optical services for the Networx Universal program. Qwest is an established
Cyber Security For Business
Cyber Security For Business In today s hostile digital environment, the importance of securing your data and technology cannot be overstated. From customer assurance, liability mitigation, and even your
Appendix 12 Risk Assessment Plan
Appendix 12 Risk Assessment Plan DRAFT March 5, 2007 Revision XX Qwest Government Services, Inc. 4250 North Fairfax Drive Arlington, VA 22203 A12-i RFP: TQC-JTB-05-0002 March 5, 2007 REVISION HISTORY Revision
5.10 CUSTOMER SPECIFIC DESIGN AND ENGINEERING SERVICES (L )
5.10 CUSTOMER SPECIFIC DESIGN AND ENGINEERING SERVICES (L.34.1.5) Qwest s Networx Customer Specific Design and Engineering Services provide systems and applications test facilities domestically and nondomestically
Gujarat Forensic Sciences University
Gujarat Forensic Sciences University Knowledge Wisdom Fulfilment Cyber Security Consulting Services Secure Software Engineering Infrastructure Security Digital Forensics SDLC Assurance Review & Threat
IT SECURITY RISK ANALYSIS FOR MEANINGFUL USE STAGE I
Standards Sections Checklist Section Security Management Process 164.308(a)(1) Information Security Program Risk Analysis (R) Assigned Security Responsibility 164.308(a)(2) Information Security Program
Kenna Platform Security. A technical overview of the comprehensive security measures Kenna uses to protect your data
Kenna Platform Security A technical overview of the comprehensive security measures Kenna uses to protect your data V3.0, MAY 2017 Multiple Layers of Protection Overview Password Salted-Hash Thank you
SECURITY & PRIVACY DOCUMENTATION
Okta s Commitment to Security & Privacy SECURITY & PRIVACY DOCUMENTATION (last updated September 15, 2017) Okta is committed to achieving and preserving the trust of our customers, by providing a comprehensive
Securing Your Digital Transformation
Securing Your Digital Transformation Security Consulting Managed Security Leveraging experienced, senior experts to help define and communicate risk and security program strategy using real-world data,
INFORMATION SECURITY-SECURITY INCIDENT RESPONSE
Information Technology Services Administrative Regulation ITS-AR-1506 INFORMATION SECURITY-SECURITY INCIDENT RESPONSE 1.0 Purpose and Scope The purpose of the Security Response Administrative Regulation
External Supplier Control Obligations. Cyber Security
External Supplier Control Obligations Cyber Security Control Title Control Description Why this is important 1. Cyber Security Governance The Supplier must have cyber risk governance processes in place
CYBER RESILIENCE & INCIDENT RESPONSE
CYBER RESILIENCE & INCIDENT RESPONSE www.nccgroup.trust Introduction The threat landscape has changed dramatically over the last decade. Once the biggest threats came from opportunist attacks and preventable
SOC-2 Requirement Solution Brief. EventTracker 8815 Centre Park Drive, Columbia MD SOC-2
Requirement Solution Brief 8815 Centre Park Drive, Columbia MD 21045 About delivers business critical software and services that transform high-volume cryptic log data into actionable, prioritized intelligence
Defining Computer Security Incident Response Teams
Defining Computer Security Incident Response Teams Robin Ruefle January 2007 ABSTRACT: A computer security incident response team (CSIRT) is a concrete organizational entity (i.e., one or more staff) that
Reinvent Your 2013 Security Management Strategy
Reinvent Your 2013 Security Management Strategy Laurent Boutet 18 septembre 2013 Phone:+33 6 25 34 12 01 Email:laurent.boutet@skyboxsecurity.com www.skyboxsecurity.com What are Your Key Objectives for
GDPR Update and ENISA guidelines
GDPR Update and ENISA guidelines 2016 [Type text] There are two topics that should be uppermost in every CISO's mind, how to address the growing demand for Unified Communications (UC) and how to ensure
Enhancing the Cybersecurity of Federal Information and Assets through CSIP
TECH BRIEF How BeyondTrust Helps Government Agencies Address Privileged Access Management to Improve Security Contents Introduction... 2 Achieving CSIP Objectives... 2 Steps to improve protection... 3
IBM Global Technology Services Provide around-the-clock expertise and protect against Internet threats.
IBM Global Technology Services Provide around-the-clock expertise and protect against Internet threats. Enhancing cost to serve and pricing maturity Keeping up with quickly evolving ` Internet threats
ISO/IEC Solution Brief ISO/IEC EventTracker 8815 Centre Park Drive, Columbia MD 21045
Solution Brief 8815 Centre Park Drive, Columbia MD 21045 About delivers business critical software and services that transform high-volume cryptic log data into actionable, prioritized intelligence that
Cyber Security Program
Cyber Security Program Cyber Security Program Goals and Objectives Goals Provide comprehensive Security Education and Awareness to the University community Build trust with the University community by
SYMANTEC: SECURITY ADVISORY SERVICES. Symantec Security Advisory Services The World Leader in Information Security
SYMANTEC: SECURITY ADVISORY SERVICES Symantec Security Advisory Services The World Leader in Information Security Knowledge, as the saying goes, is power. At Symantec we couldn t agree more. And when it
Information Security Controls Policy
Information Security Controls Policy Classification: Policy Version Number: 1-00 Status: Published Approved by (Board): University Leadership Team Approval Date: 30 January 2018 Effective from: 30 January
INCIDENTRESPONSE.COM. Automate Response. Did you know? Your playbook overview - Malware Outbreak
Automate Response Congratulations on selecting IncidentResponse.com to retrieve your custom incident response playbook guide. This guide has been created especially for you for use in within your security
NERC CIP VERSION 6 BACKGROUND COMPLIANCE HIGHLIGHTS
NERC CIP VERSION 6 COMPLIANCE BACKGROUND The North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) Reliability Standards define a comprehensive set of requirements
Stephanie Zierten Associate Counsel Federal Reserve Bank of Boston
Stephanie Zierten Associate Counsel Federal Reserve Bank of Boston Cybersecurity Landscape Major Data Breaches (e.g., OPM, IRS) Data Breach Notification Laws Directors Derivative Suits Federal Legislation
Solutions Technology, Inc. (STI) Corporate Capability Brief
Solutions Technology, Inc. (STI) Corporate Capability Brief STI CORPORATE OVERVIEW Located in the metropolitan area of Washington, District of Columbia (D.C.), Solutions Technology Inc. (STI), women owned
Symantec Security Monitoring Services
24x7 real-time security monitoring and protection Protect corporate assets from malicious global threat activity before it impacts your network. Partnering with Symantec skilled and experienced analysts
New Guidance on Privacy Controls for the Federal Government
New Guidance on Privacy Controls for the Federal Government IAPP Global Privacy Summit 2012 March 9, 2012 Dr. Ron Ross Computer Security Division, NIST Martha Landesberg, J.D., CIPP/US The Privacy Office,
CA Security Management
CA Security CA Security CA Security In today s business environment, security remains one of the most pressing IT concerns. Most organizations are struggling to protect an increasing amount of disparate
Incident Response Services to Help You Prepare for and Quickly Respond to Security Incidents
Services to Help You Prepare for and Quickly Respond to Security Incidents The Challenge The threat landscape is always evolving and adversaries are getting harder to detect; and with that, cyber risk
DEVELOP YOUR TAILORED CYBERSECURITY ROADMAP
ARINC cybersecurity solutions DEVELOP YOUR TAILORED CYBERSECURITY ROADMAP Getting started is as simple as assessing your baseline THE RIGHT CYBERSECURITY SOLUTIONS FOR YOUR UNIQUE NEEDS Comprehensive threat
Criminal Justice Information Security (CJIS) Guide for ShareBase in the Hyland Cloud
Criminal Justice Information Security (CJIS) Guide for ShareBase in the Hyland Cloud Introduction The Criminal Justice Information Security (CJIS) Policy is a publically accessible document that contains
A company built on security
Security How we handle security at Flywheel Flywheel was founded in 2012 on a mission to create an exceptional platform to help creatives do their best work. As the leading WordPress hosting provider for
4.1.8 PREMISES-BASED IP VPN SERVICES (PBIP-VPNS) (L )
4.1.8 PREMISES-BASED IP VPN SERVICES (PBIP-VPNS) (L.34.1.4) Qwest achieved an industry first with our premises-based IP VPN services. Our Networx PBIP-VPNS employs a proven service delivery model to ensure
Security and Privacy Governance Program Guidelines
Security and Privacy Governance Program Guidelines Effective Security and Privacy Programs start with attention to Governance. Governance refers to the roles and responsibilities that are established by
Cyber Risk Program Maturity Assessment UNDERSTAND AND MANAGE YOUR ORGANIZATION S CYBER RISK.
Cyber Risk Program Maturity Assessment UNDERSTAND AND MANAGE YOUR ORGANIZATION S CYBER RISK. In today s escalating cyber risk environment, you need to make sure you re focused on the right priorities by
5.6 WEB CONFERENCING SERVICE (WCS) (L )
5.6 WEB CONFERENCING SERVICE (WCS) (L.34.1.5) Qwest s Networx WCS uses a simple online interface to conduct live interactive meetings and deliver high-impact presentations, demonstrations and training
Data Security and Privacy Principles IBM Cloud Services
Data Security and Privacy Principles IBM Cloud Services 2 Data Security and Privacy Principles: IBM Cloud Services Contents 2 Overview 2 Governance 3 Security Policies 3 Access, Intervention, Transfer
Accelerate Your Enterprise Private Cloud Initiative
Cisco Cloud Comprehensive, enterprise cloud enablement services help you realize a secure, agile, and highly automated infrastructure-as-a-service (IaaS) environment for cost-effective, rapid IT service
Education Network Security
Education Network Security RECOMMENDATIONS CHECKLIST Learn INSTITUTE Education Network Security Recommendations Checklist This checklist is designed to assist in a quick review of your K-12 district or
3.4 DISASTER RECOVERY (L , M.3.9, comp_req_id 806)
3.4 DISASTER RECOVERY (L.34.2.3.4, M.3.9, comp_req_id 806) Three key objectives that GSA has as part of the award of the Networx contract are to ensure service continuity, high-quality service, and operations
Appendix 6 Operational Support Systems Change Management Plan
Appendix 6 Operational Support Systems Change Management Plan DRAFT December 13, 2006 Revision XX Qwest Government Services, Inc. 4250 North Fairfax Drive Arlington, VA 22203 A6-1 RFP: TQC-JTB-05-0001
INCIDENTRESPONSE.COM. Automate Response. Did you know? Your playbook overview - Data Theft
Automate Response Congratulations on selecting IncidentResponse.com to retrieve your custom incident response playbook guide. This guide has been created especially for you for use in within your security
Cloud for Government: A Transformative Digital Tool to Better Serve Communities
Cloud for Government: A Transformative Digital Tool to Better Serve Communities 1 005181004 From state to local agencies, government organizations crave access to the same cloud-based tools enabling digital
Certified Information Security Manager (CISM) Course Overview
Certified Information Security Manager (CISM) Course Overview This course teaches students about information security governance, information risk management, information security program development,
GDPR: Get Prepared! A Checklist for Implementing a Security and Event Management Tool. Contact. Ashley House, Ashley Road London N17 9LZ
GDPR: Get Prepared! A Checklist for Implementing a Security and Event Management Tool Contact Ashley House, Ashley Road London N17 9LZ 0333 234 4288 info@networkiq.co.uk The General Data Privacy Regulation
Incident Response. Is Your CSIRT Program Ready for the 21 st Century?
Incident Response Is Your CSIRT Program Ready for the 21 st Century? Speaker Bio Traditional Response Concepts Technical Incidents Requiring Technical Responses Virus/ Malware Network Intrusion Disaster
Today s cyber threat landscape is evolving at a rate that is extremely aggressive,
Preparing for a Bad Day The importance of public-private partnerships in keeping our institutions safe and secure Thomas J. Harrington Today s cyber threat landscape is evolving at a rate that is extremely
3.4 NON-DOMESTIC SERVICES (L )(C.2.1.9)
3.4 NON-DOMESTIC SERVICES (L.34.1.3.4)(C.2.1.9) Qwest uses a combination of owned assets and strategic international partners to deliver non-domestic services ensuring that providers with local knowledge
NEN The Education Network
NEN The Education Network School e-security Checklist This checklist sets out 20 e-security controls that, if implemented effectively, will help to ensure that school networks are kept secure and protected
Build a viable plan for disaster recovery and crisis management.
Disaster recovery and crisis management solutions To support your IT objectives Build a viable plan for disaster recovery and crisis management. Highlights Build a plan to help respond to and recover from
Cyber Security Technologies
1 / Cyber Security Technologies International Seminar on Cyber Security: An Action to Establish the National Cyber Security Center Lisbon, 12 th September 2013 23 / Key highlights - Thales Group Thales
New York Cybersecurity. New York Cybersecurity. Requirements for Financial Services Companies (23NYCRR 500) Solution Brief
Publication Date: March 10, 2017 Requirements for Financial Services Companies (23NYCRR 500) Solution Brief EventTracker 8815 Centre Park Drive, Columbia MD 21045 About EventTracker EventTracker s advanced
Security Monitoring Engineer / (NY or NC) Director, Information Security. New York, NY or Winston-Salem, NC. Location:
Position: Reports to: Location: Security Monitoring Engineer / (NY or NC) Director, Information Security New York, NY or Winston-Salem, NC Position Summary: The Clearing House (TCH) Information Security
INFORMATION ASSURANCE DIRECTORATE
National Security Agency/Central Security Service INFORMATION ASSURANCE DIRECTORATE CGS Signature Repository A Signature Repository provides a group of signatures for use by network security tools such
INCIDENTRESPONSE.COM. Automate Response. Did you know? Your playbook overview - Unauthorized Access
Automate Response Congratulations on selecting IncidentResponse.com to retrieve your custom incident response playbook guide. This guide has been created especially for you for use in within your security
Cybersecurity Auditing in an Unsecure World
About This Course Cybersecurity Auditing in an Unsecure World Course Description $5.4 million that s the average cost of a data breach to a U.S.-based company. It s no surprise, then, that cybersecurity
Cyber Security Solutions Mitigating risk and enhancing plant reliability
P OW E R G E N E R AT I O N Cyber Security Solutions Mitigating risk and enhancing plant reliability 2 CYBER SECURITY SOLUTIONS MITIGATING RISK AND ENHANCING PLANT RELIABILITY Providing a roadmap to achieve
DATA SHEET RISK & CYBERSECURITY PRACTICE EMPOWERING CUSTOMERS TO TAKE COMMAND OF THEIR EVOLVING RISK & CYBERSECURITY POSTURE
DATA SHEET RISK & CYBERSECURITY PRACTICE EMPOWERING CUSTOMERS TO TAKE COMMAND OF THEIR EVOLVING RISK & CYBERSECURITY POSTURE EXECUTIVE SUMMARY ALIGNING CYBERSECURITY WITH RISK The agility and cost efficiencies
Appendix 6 Operational Support Systems Change Management Plan
Appendix 6 Operational Support Systems Change Management Plan DRAFT March 5, 2007 Revision XX Qwest Government Services, Inc. 4250 North Fairfax Drive Arlington, VA 22203 A6-i RFP: TQC-JTB-05-0002 March
Position Title: IT Security Specialist
Position Title: IT Security Specialist SASRIA SOC LIMITED Sasria, a state-owned company, is the only short-term insurer in South Africa that provides affordable voluntary cover against special risks such
INCIDENTRESPONSE.COM. Automate Response. Did you know? Your playbook overview - Virus Outbreak
Automate Response Congratulations on selecting IncidentResponse.com to retrieve your custom incident response playbook guide. This guide has been created especially for you for use in within your security
align security instill confidence
align security instill confidence cyber security Securing data has become a top priority across all industries. High-profile data breaches and the proliferation of advanced persistent threats have changed
HP Fortify Software Security Center
HP Fortify Software Security Center Proactively Eliminate Risk in Software Trust Your Software 92% of exploitable vulnerabilities are in software National Institute for Standards and Technology (NIST)
INCIDENTRESPONSE.COM. Automate Response. Did you know? Your playbook overview - Elevation of Privilege
Automate Response Congratulations on selecting IncidentResponse.com to retrieve your custom incident response playbook guide. This guide has been created especially for you for use in within your security
Six Weeks to Security Operations The AMP Story. Mike Byrne Cyber Security AMP
Six Weeks to Security Operations The AMP Story Mike Byrne Cyber Security AMP 1 Agenda Introductions The AMP Security Operations Story Lessons Learned 2 Speaker Introduction NAME: Mike Byrne TITLE: Consultant
Certified Information Systems Auditor (CISA)
Certified Information Systems Auditor (CISA) 1. Domain 1 The Process of Auditing Information Systems Provide audit services in accordance with IT audit standards to assist the organization in protecting
Information Security Management Criteria for Our Business Partners
Information Security Management Criteria for Our Business Partners Ver. 2.1 April 1, 2016 Global Procurement Company Information Security Enhancement Department Panasonic Corporation 1 Table of Contents
SANS Top 20 CIS. Critical Security Control Solution Brief Version 6. SANS Top 20 CIS. EventTracker 8815 Centre Park Drive, Columbia MD 21045
Critical Security Control Solution Brief Version 6 8815 Centre Park Drive, Columbia MD 21045 About delivers business critical software and services that transform high-volume cryptic log data into actionable,
Security by Default: Enabling Transformation Through Cyber Resilience
Security by Default: Enabling Transformation Through Cyber Resilience FIVE Steps TO Better Security Hygiene Solution Guide Introduction Government is undergoing a transformation. The global economic condition,
Information Security Incident Response Plan
Information Security Incident Response Plan Purpose It is the objective of the university to maintain secure systems and data. In order to comply with federal, state, and local law and contractual obligations,
Computer Security Incident Response Plan. Date of Approval: 23-FEB-2014
Computer Security Incident Response Plan Name of Approver: Mary Ann Blair Date of Approval: 23-FEB-2014 Date of Review: 31-MAY-2016 Effective Date: 23-FEB-2014 Name of Reviewer: John Lerchey Table of Contents
SOC 3 for Security and Availability
SOC 3 for Security and Availability Independent Practioner s Trust Services Report For the Period October 1, 2015 through September 30, 2016 Independent SOC 3 Report for the Security and Availability Trust
Staffing Services UnderDefense your source of experienced professionals to solve security staffing challenges today
Security Staffing Services UnderDefense your source of experienced professionals to solve security staffing challenges today Staff Augmentation, Executive Staffing, Flex Staffing Achieving our main goal
POLICY FOR DATA AND INFORMATION SECURITY AT BMC IN LUND. October Table of Contents
POLICY FOR DATA AND INFORMATION SECURITY AT BMC IN LUND October 2005 Table of Contents Introduction... 1 Purpose Of This Policy... 1 Responsibility... 1 General Policy... 2 Data Classification Policy...
THE ACCENTURE CYBER DEFENSE SOLUTION
THE ACCENTURE CYBER DEFENSE SOLUTION A MANAGED SERVICE FOR CYBER DEFENSE FROM ACCENTURE AND SPLUNK. YOUR CURRENT APPROACHES TO CYBER DEFENSE COULD BE PUTTING YOU AT RISK Cyber-attacks are increasingly
Internet of Things. The Digital Oilfield: Security in SCADA and Process Control. Mahyar Khosravi
Internet of Things The Digital Oilfield: Security in SCADA and Process Control Mahyar Khosravi makhosra@cisco.com Critical infrastructures worldwide not ready to battle cyber attacks, claims new study.
Ensuring System Protection throughout the Operational Lifecycle
Ensuring System Protection throughout the Operational Lifecycle The global cyber landscape is currently occupied with a diversity of security threats, from novice attackers running pre-packaged distributed-denial-of-service
Google Cloud & the General Data Protection Regulation (GDPR)
Google Cloud & the General Data Protection Regulation (GDPR) INTRODUCTION General Data Protection Regulation (GDPR) On 25 May 2018, the most significant piece of European data protection legislation to
RFP/RFI Questions for Managed Security Services. Sample MSSP RFP Template
RFP/RFI Questions for Managed Security Services Sample MSSP RFP Template Table of Contents Request for Proposal Template Overview 1 Introduction... 1 How to Use this Document... 1 Suggested RFP Outline
BUILDING AND MAINTAINING SOC
BUILDING AND MAINTAINING SOC Digit Oktavianto KOMINFO 7 December 2016 digit dot oktavianto at gmail dot com 1 Digit Oktavianto Profile in 1 Page Currently working as a Security Architect Professional Certifications:
Security Monitoring. Managed Vulnerability Services. Managed Endpoint Protection. Platform. Platform Managed Endpoint Detection and Response
Security Operations Flexible and Scalable Solutions to Improve Your Security Capabilities Security threats continue to rise each year and are increasing in sophistication and malicious intent. Unfortunately,
Cyber Defense Maturity Scorecard DEFINING CYBERSECURITY MATURITY ACROSS KEY DOMAINS
Cyber Defense Maturity Scorecard DEFINING CYBERSECURITY MATURITY ACROSS KEY DOMAINS Cyber Defense Maturity Scorecard DEFINING CYBERSECURITY MATURITY ACROSS KEY DOMAINS Continual disclosed and reported
Cyber Security Audit & Roadmap Business Process and
Cyber Security Audit & Roadmap Business Process and Organizations planning for a security assessment have to juggle many competing priorities. They are struggling to become compliant, and stay compliant,