Jae Gianelloni, CPA, CISA, CISSP Director of Internal Audit Station Casinos
|
|
- Helena Farmer
- 6 years ago
- Views:
Transcription
1
2
3 Jae Gianelloni, CPA, CISA, CISSP Director of Internal Audit Station Casinos
4 What would you do if you were a CEO Exam preparation tips Official student handbook Official question bank Cram courses Other sources Domains to score On the day of the exam Exam duration
5 Security functions that align with the goal, mission, and objective of an organization Confidentiality, integrity, and availability Information security governance with due care and diligence Management of third-party governance Managing personnel security, including security training, education, and awareness System life cycle approach Risk management concepts
6 Introduction to information security governance and risk management Information security governance The risk management process
7
8 Overview of the information security environment Business objectives, goals, business mission Regulations, stakeholders, competitors Risk management -primary objective of security program Proper handling of a risk is based on its potential to have a negative impact on the organization s assets. Wait, Have you see a company that puts an emphasis on security?
9 Aspects of security in a manner that can be understood by management Confidentiality Ensuring that information is accessible only to those authorized to have access Integrity Safeguarding the accuracy and reliability of information and processing methods Availability Ensuring that authorized users have access to information and associated assets when required.
10 Which one of the following individuals would be the most effective organizational owner for an information security program? A.CISSP-certified analyst B. Chief information officer C. Manager of network security D. President and CEO *Source: CISSP Official (ISC)2 Practice Tests, 2016
11 Which one of the following individuals would be the most effective organizational owner for an information security program? A.CISSP-certified analyst B. Chief information officer C. Manager of network security D. President and CEO *Source: CISSP Official (ISC)2 Practice Tests, 2016
12 John s network begins to experience symptoms of slowness. Upon investigation, he realizes that the network is being bombarded with ICMP ECHO REPLY packets and believes that his organization is the victim of a Smurf attack. What principle of information security is being violated? A. Availability B. Integrity C. Confidentiality D. Denial *Source: CISSP Official (ISC)2 Practice Tests, 2016
13 Beth is the security administrator for a public school district. She is implementing a new student information system and is testing the code to ensure that students are not able to alter their own grades. What principle of information security is Beth enforcing? A. Integrity B. Availability C. Confidentiality D. Denial *Source: CISSP Official (ISC)2 Practice Tests, 2016
14 Which of the following is an administrative control that can protect the confidentiality of information? A. Encryption B. Non-disclosure agreement C. Firewall D. Fault tolerance *Source: CISSP Official (ISC)2 Practice Tests, 2016
15 Gary is implementing a new RAID-based disk system designed to keep a server up and running even in the event of a single disk failure. What principle of information security is Gary seeking to enforce? A. Denial B. Confidentiality C. Integrity D. Availability *Source: CISSP Official (ISC)2 Practice Tests, 2016
16 Who is the ideal person to approve an organization s business continuity plan? A. Chief information officer B. Chief executive officer C. Chief information security officer D. Chief operating officer *Source: CISSP Official (ISC)2 Practice Tests, 2016
17
18 Board of Directors Unbiased and independent Ensure shareholder interest is being protected Sets Risk Appetite (Risk Tolerance) and Security Strategy Sarbanes-Oxley Act can hold director responsible if an internal corporate governance framework does not exist Practice Due Diligence Executive Management Responsible for Asset Management, Risk Assessment, Privacy Impact Analysis, Planning & Strategy, Controls and Performance Management, Reviews, Certifications, Audits CEO CFO CSO/CISO CPO CIO
19 IS Security Steering Committee Responsible for decision-making capabilities on tactical and strategic security issues Define acceptable risk for the organization Develop security objectives and strategies Determine priorities of security initiatives based on business needs Review risk assessment and auditing reports Monitor the business impact of security risks Review major security breaches and incidents Approve major changes to security policy and programs
20 Data Owners Ultimately responsible for protection and use of data Responsible for determining sensitivity of classification levels of the data as well as maintaining accuracy and integrity of the data resident on the information system Responsible for ensuring proper security controls are in place Due care responsibility, else can be held negligent Data custodian Responsible for maintenance & protection of the data once classified Performing regular backups and/or restores Periodically validating integrity of the data Retaining records of activity Fulfilling records specified in the company s security policy, standards, and guidelines
21 System Owner Responsible for the systems which process the data Must integrate security considerations into purchasing decisions Security Administrator Responsible for New account creation Implementation of new solutions Testing security patches and components Issuing new passwords Security Analyst Aids in development of policies, standards, and guidelines Helps set various baselines Application Owner Responsible for access control and security for relevant applications
22 Change Control Analyst Responsible for approval or rejection of change requests Data Analyst Responsible for ensuring data stores and structures support business objectives Process Owner Responsible for defining, improving, and monitoring security processes Users Uses data in compliance with access rights/security policy Product Line Manager Responsible for vendor negotiations and compliance to license agreements Auditors Examine security practices and control mechanisms to assure compliance with regulatory or industry standards
23 Service level agreements (SLAs) Prior to providing access to an outsider, care must be taken to ensure that the outsider has proper clearance and awareness of policies and procedures. Contractors and third parties should be bound by SLAs that mandate how work must be done and procedures and timelines that must be followed. Security awareness and training
24 Security Education Training Awareness Attribute Why How What Level Insight Knowledge Information Objective Understanding Skill Awareness Training Method Discussion, Seminar, Reading, Research Lecture, Case Study, Hands-on Interactive, Video, Posters, Games, Newsletters Test Measure Essay Problem Solving T/F, Multiple Choice Impact Timeframe Long-Term Intermediate Short-Term
25 Three audiences Management Staff Technical Employees Examining Responsibilities Liabilities Expectations
26 Used to influence behavior Functions as a data and system control Focuses attention on behavior in the enterprise Reminds the user of appropriate behaviors
27 Used to teach a specific skill Usually attended by personnel who are responsible for implementing and monitoring security controls Often oriented to the data custodian
28 Knowledge Driven Integrates security skills and competencies into a common body of knowledge Adds multidisciplinary study of concepts, issues, and principles Strives to produce IT security specialists and professionals capable of vision and proactive response Management oriented or those involved in the decision making process (information owner)
29 Training is a control Must be monitored and evaluated for effectiveness Utilization of questionnaires and surveys to gauge retention levels and feedback
30 Due Care Leadership to exercise the care that ordinarily prudent and reasonable persons with the same training and experience would exercise under the same circumstances U.S. Courts expect organizations to behave with due care by having the right policies and procedures, access controls, and other security matters Due Diligence Is the enforcement of due care policy and provisions to ensure that the due care steps taken to protect assets are working effectively. An organization may be charged with negligence if it does not properly secure assets and harm occurs
31 Which one of the following security program is designed to provide employees with the knowledge they need to perform their specific work tasks? A. Awareness B. Training C. Education D. Indoctrination *Source: CISSP Official (ISC)2 Practice Tests, 2016
32 In 1991, the federal sentencing guidelines formalized a rule that requires senior executives to take personal responsibility for information security matters. What is the name of this rule? A. Due diligence rule B. Personal liability rule C. Prudent man rule D. Due process rule *Source: CISSP Official (ISC)2 Practice Tests, 2016
33 Which one of the following principles imposes a standard of care upon an individual that is broad and equivalent to what one would expect from a reasonable person under the circumstances? A. Due diligence B. Separation of duties C. Due care D. Least privilege *Source: CISSP Official (ISC)2 Practice Tests, 2016
34 Which one of the following individuals is normally responsible for fulfilling the operational data protection responsibilities delegated by senior management, such as validating data integrity, testing back-ups, and managing security policies? A. Data custodian B. Data owner C. User D. Auditor *Source: CISSP Official (ISC)2 Practice Tests, 2016
35 Which one of the following security program is designed to establish a minimum standard common denominator of security understanding? A. Training B. Education C. Indoctrination D. Awareness *Source: CISSP Official (ISC)2 Practice Tests, 2016
36 System of all necessary policies, procedures, plans, processes, practices, roles, responsibilities, resources, and structures used to protect and preserve info. Corporate Governance COSO Financial Compliance - SOX, GLBA, PCI- DSS Technology CobiT 5, SSAE-16 Medical Compliance HIPAA, HITECH Federal Mandates, State and Local Requirements Industry Standards - ISO/IEC
37 COSO NIST Critical Security Controls for Effective Cyber Defense Formerly SANS Top 20 Critical Controls COBIT Regulatory PCI HIPAA FERPA Others ISO 27000
38 Goal: Identify five areas of internal control necessary to meet the financial reporting and disclosure objectives Public companies working toward SOX 404 compliance have adopted the COSO internal control model framework
39 Goal: Examines the effectiveness, efficiency, confidentiality, integrity, availability, compliance, and reliability aspects of the high-level control objectives Focus is on adequate management and control of information technology Trademark of ISACA
40 Goal: Provide best recommendations on information security management, risks, and controls within the context of an overall information system governance structure Use the standards as the basis for developing security standards and security management practices
41 Goal: Help organizations prioritize security efforts Do not deal with important non-technical aspects of security Emphasize: Addressing most common attack activities Establishing consistency Promote automation
42 Goal: To enhance cardholder data security and facilitate broad adoption of international standards Defines in scope and out of scope systems specific tests More if you are shared hosting provider
43 Goal: To establish controls to safeguard protected health information (PHI) Defines in scope and out of scope systems Provides implementation guidance for controls Required Addressable No guidance provided
44 Strategic High-level, long-range requirements focusing on enabling security, IT, and business objectives Overarching security policy, the alignment of the security program with the direction of the organization Tactical More mid-term focus on events that will affect the entire organization Network redegisn, installation of new equipment and controls, tracking of incidents over a period of months Operational Fighting fires - Short-term plans for mitigating risk until mid or long-term solutions can be put into place Detecting, responding, and recovering from incidents And monitoring compliance and system operations
45 Cost-effective (cost-benefit analysis) Risk-based approach Identify security risks Identify and evaluate risk treatments Select control objective and controls to treat risks and present them to management for approval Meet functional requirements Layered and meet a specific security requirement. They should not depend on another control in the event of a failure. Due care function Meet assurance requirements Confirming that security solutions are selected appropriately, and performing as intended and having the desired effect (i.e., audit logs). Due diligence function Other factors Accountability, flexibility, audit capability
46 Administrative Development and publishing of policies, standards, procedures, and guidelines; risk management; screening of personnel; conducting security awareness training; implementing change control procedures Technical (Logical) Implementing and maintaining access control mechanisms, password and resource management, identification and authentication methods, security devices, and configuration of the infrastructure Physical Controlling access into a facility and departments, locking systems, removing unnecessary media drives, protecting perimeter of the facility, monitoring for intrusion, and environmental controls
47 Deterrent Discourage an attacker Preventive Avoid an incident Corrective Fixes components after an incident Recovery Bring to regular operation Detective Helps identify attacker activities, possibly the attacker Compensating Alternative measure of control
48 Yolanda is the chief privacy officer for a financial institution and is researching privacy issues related to customer checking accounts. Which one of the following laws is most likely to apply to this situation? A. GLBA B. SOX C. HIPPA D. FERPA *Source: CISSP Official (ISC)2 Practice Tests, 2016
49 Tim s organization recently received a contract to conduct sponsored research as a government contractors. What law now likely applies to the information systems involved in this contract? A. FISMA B. PCI DSS C. HIPPA D. GISRA *Source: CISSP Official (ISC)2 Practice Tests, 2016
50 Which one of the following control categories does not accurately describe a fence around a facility? A. Physical B. Detective C. Deterrent D. Preventive *Source: CISSP Official (ISC)2 Practice Tests, 2016
51 Which one of the following is an example of an administrative control? A. Intrusion detection system B. Security awareness training C. Firewalls D. Security guards *Source: CISSP Official (ISC)2 Practice Tests, 2016
52 Renee is designing the long-term security plan for her organization and has a three-to-five-year planning horizon. What type of plan is she developing? A. Operational B. Tactical C. Summary D. Strategic *Source: CISSP Official (ISC)2 Practice Tests, 2016
53 An accounting employee was arrested for participation in an fraud scheme. The employee transferred money to a personal account and then shifted funds around between other accounts every day to disguise the fraud for months. Which one of the following controls might have best allowed the earlier detection of this fraud? A. Separation of duties B. Least privilege C. Defense in depth D. Mandatory vacation *Source: CISSP Official (ISC)2 Practice Tests, 2016
54
55 Risk Management is the process of identifying and assessing risk, reducing it to an acceptable level, and implementing the right mechanisms to maintain that level No 100% secure environment Risk Categories Physical Damage Human Interaction Equipment Malfunction Inside and Outside attack Misuse of data Loss of data Application error
56
57 Risk Analysis A method of identifying vulnerabilities, threats, and assessing potential impacts to determine which countermeasures/safeguards should be implemented 4 goals Identify assets and their value to the organization Identify vulnerabilities and threats Quantify the probability and business impact of these potential threats Application of cost-benefit analysis to the proposed countermeasures
58 Assets must be valued correctly in order to Perform effective cost/benefit analysis Select specific countermeasures and safeguards Determine proper level of insurance coverage to purchase Understand risks cohesively Conform with due care Comply with legal and regulatory requirements Tangible Facilities Resources Systems Information Intangible Reputation Intellectual Property
59 Actual value of an asset is determined by the cost it takes to acquire, develop, and maintain it Considerations: Cost to acquire or develop the asset Cost to maintain and protect the asset Value of the asset to owners and users Value of the asset to adversaries Value of IP Price others are willing to pay Cost to replace Operational and production activities affected if asset is unavailable Liability issues if the asset is compromised Usefulness and role of the asset in the organization
60 Potential Threat Agents Malware Hackers Attackers Intruders Users Fire Employee Contractor Identify all known threats in the environment
61 Assigns numeric and monetary values Attempts to assign independently objective numeric values to components of the risk assessment and to potential losses Present value analysis considers time value of money Payback method does not consider the time value of money Net Present Value (NPV) the higher the value, the greater the benefit Benefit-Cost Ratio (BCR) the higher the ratio, the larger the return Internal Rate of Return (IRR) the higher the return, the greater the benefit
62 Assigns a subjective rating (H/M/L) Does not attempt to assign numeric values to risk assessment components Scenario or opinion oriented Rank threats List vulnerable assets Techniques Delphi group decision making method Brainstorming Storyboarding Focus Groups Surveys Questionnaires Checklists Interviews Meetings
63 Qualitative Pro Requires no calculation Provides opinions of the individuals who know the processes best Provides general areas and indications of risk Con Involves guesswork Assessments and results are subjective Eliminates opportunity to create a dollar value for cost/benefit discussions Standards are not available Difficult to track risk management objective due to subjectivity
64 Quantitative Pro Easier to automate and evaluate Used in risk management performance tracking Provides credible cost/benefit analysis Shows clear cut losses that can be accrued within a one-year timeframe Uses independently verifiable and objective metrics Con Process laborious without automated tools Requires complex calculations Complexity of calculation may cause misunderstanding as to value derivation Additional work necessary to gather environment information Standards are not available
65 Single Loss Expectancy (SLE) SLE = Asset Value X Exposure Factor (EF) EF = Estimated Percentage of Loss given a realized threat Asset Value = $100,000 EF = 35% SLE = $35,000 Annualized Rate of Occurrence (ARO) ARO = Estimated probability of the threat occurring within a one year time frame Range is 0.0 (never) to 1.0 (always) Annual Loss Expectancy (ALE) ALE = SLE x Annualized Rate of Occurrence (ARO) The ALE value is the one used in cost/benefit analysis to choose the appropriate Risk Action
66 Example: Earthquake could create 50% damage to a facility if it occurs. The value of the facility is $1,000,000. The probability of an earthquake is one in ten years Asset Value x EF = SLE $1,000,000 x.50 = $500,000 (SLE) SLE x ARO = ALE $500,000 x (1/10) = $50,000 (ALE) ALE is $50,000, so management should not spend over that value in countermeasures trying to protect against that risk
67 Combine potential loss and probability Calculate Annualized Loss Expectancy (ALE) per threat SLE x Annualized Rate of Occurrence (ARO) = ALE Choose remedial measures to counteract each threat Analyze each countermeasure using a cost/benefit analysis
68 Step 1 Assign Value to Assets Step 2 Estimate Potential Loss Per Threat Step 3 Perform a Threat Analysis Step 4 Derive the Overall Annual Loss Potential per Threat Step 5 Reduce, Transfer, Avoid, or Accept the Risk Note Accept Reduce (=mitigate) Transfer (=insurance) Avoid (=do not use)
69 Hal systems decided to stop offering public NTP services because of a fear that its NTP servers would be used in amplification DDoS attacks. What type of risk management strategy did Hal pursue with respect to its NTP services? A. Risk mitigation B. Risk acceptance C. Risk transference D. Risk avoidance *Source: CISSP Official (ISC)2 Practice Tests, 2016
70 Who is the ideal person to approve an organization s business continuity plan? A. Chief information officer B. Chief executive officer C. Chief information security officer D. Chief operating officer *Source: CISSP Official (ISC)2 Practice Tests, 2016
71 Which one of the following components should be included in an organization s emergency response guidelines? A. List of individuals who should be notified of an emergency incident B. Long tern business continuity protocols C. Activation procedures for the organization s cold sites D. Contact information for ordering equipment *Source: CISSP Official (ISC)2 Practice Tests, 2016
72 Ben is seeking an control objective framework that is widely accepted around the world and focuses specifically on information security controls. Which one of the following frameworks would best meet his needs? A. ITIL B. ISO C. CMM D. PMBOK Guide *Source: CISSP Official (ISC)2 Practice Tests, 2016
73 Which one of the following stakeholders is not typically included on a business continuity planning team? A. Core business function leaders B. Information technology staff C. CEO D. Support departments *Source: CISSP Official (ISC)2 Practice Tests, 2016
74 Asset: Data center Threat: Tornado Rebuilding and reconfiguring the data center would cost $10M. A typical tornado would cause $5M damage. They are likely to experience a tornado one every 200 years. A. EF B. ARO C. ALE *Source: CISSP Official (ISC)2 Practice Tests, 2016
75 Q & A Jae Gianelloni jgianelloni@gmail.com 121
Information Technology General Control Review
Information Technology General Control Review David L. Shissler, Senior IT Auditor, CPA, CISA, CISSP Office of Internal Audit and Risk Assessment September 15, 2016 Background Presenter Senior IT Auditor
More information01.0 Policy Responsibilities and Oversight
Number 1.0 Policy Owner Information Security and Technology Policy Policy Responsibility & Oversight Effective 01/01/2014 Last Revision 12/30/2013 Department of Innovation and Technology 1. Policy Responsibilities
More informationUniversity of Pittsburgh Security Assessment Questionnaire (v1.7)
Technology Help Desk 412 624-HELP [4357] technology.pitt.edu University of Pittsburgh Security Assessment Questionnaire (v1.7) Directions and Instructions for completing this assessment The answers provided
More informationCCISO Blueprint v1. EC-Council
CCISO Blueprint v1 EC-Council Categories Topics Covered Weightage 1. Governance (Policy, Legal, & Compliance) & Risk Management 1.1 Define, implement, manage and maintain an information security governance
More informationSecurity and Privacy Governance Program Guidelines
Security and Privacy Governance Program Guidelines Effective Security and Privacy Programs start with attention to Governance. Governance refers to the roles and responsibilities that are established by
More informationInformation Technology Security Plan Policies, Controls, and Procedures Identify Governance ID.GV
Information Technology Security Plan Policies, Controls, and Procedures Identify Governance ID.GV Location: https://www.pdsimplified.com/ndcbf_pdframework/nist_csf_prc/documents/identify/ndcbf _ITSecPlan_IDGV2017.pdf
More informationTEL2813/IS2820 Security Management
TEL2813/IS2820 Security Management Security Management Models And Practices Lecture 6 Jan 27, 2005 Introduction To create or maintain a secure environment 1. Design working security plan 2. Implement management
More information"Charting the Course... Certified Information Systems Auditor (CISA) Course Summary
Course Summary Description In this course, you will perform evaluations of organizational policies, procedures, and processes to ensure that an organization's information systems align with overall business
More informationMIS5206-Section Protecting Information Assets-Exam 1
Your Name Date 1. Which of the following contains general approaches that also provide the necessary flexibility in the event of unforeseen circumstances? a. Policies b. Standards c. Procedures d. Guidelines
More informationCertified Information Security Manager (CISM) Course Overview
Certified Information Security Manager (CISM) Course Overview This course teaches students about information security governance, information risk management, information security program development,
More informationSecurity Management Models And Practices Feb 5, 2008
TEL2813/IS2820 Security Management Security Management Models And Practices Feb 5, 2008 Objectives Overview basic standards and best practices Overview of ISO 17799 Overview of NIST SP documents related
More informationSECURITY & PRIVACY DOCUMENTATION
Okta s Commitment to Security & Privacy SECURITY & PRIVACY DOCUMENTATION (last updated September 15, 2017) Okta is committed to achieving and preserving the trust of our customers, by providing a comprehensive
More informationSAS 70 Audit Concepts. and Benefits JAYACHANDRAN.B,CISA,CISM. August 2010
JAYACHANDRAN.B,CISA,CISM jb@esecurityaudit.com August 2010 SAS 70 Audit Concepts and Benefits Agenda Compliance requirements Overview Business Environment IT Governance and Compliance Management Vendor
More informationCISM Certified Information Security Manager
CISM Certified Information Security Manager Firebrand Custom Designed Courseware Logistics Start Time Breaks End Time Fire escapes Instructor Introductions Introduction to Information Security Management
More informationThe Common Controls Framework BY ADOBE
The Controls Framework BY ADOBE The following table contains the baseline security subset of control activities (derived from the Controls Framework by Adobe) that apply to Adobe s enterprise offerings.
More informationIT SECURITY RISK ANALYSIS FOR MEANINGFUL USE STAGE I
Standards Sections Checklist Section Security Management Process 164.308(a)(1) Information Security Program Risk Analysis (R) Assigned Security Responsibility 164.308(a)(2) Information Security Program
More informationIsaca EXAM - CISM. Certified Information Security Manager. Buy Full Product.
Isaca EXAM - CISM Certified Information Security Manager Buy Full Product http://www.examskey.com/cism.html Examskey Isaca CISM exam demo product is here for you to test the quality of the product. This
More informationBalancing Compliance and Operational Security Demands. Nov 2015 Steve Winterfeld
Balancing Compliance and Operational Security Demands Nov 2015 Steve Winterfeld What is more important? Compliance with laws / regulations Following industry best practices Developing a operational practice
More informationThreat and Vulnerability Assessment Tool
TABLE OF CONTENTS Threat & Vulnerability Assessment Process... 3 Purpose... 4 Components of a Threat & Vulnerability Assessment... 4 Administrative Safeguards... 4 Logical Safeguards... 4 Physical Safeguards...
More informationNew York Cybersecurity. New York Cybersecurity. Requirements for Financial Services Companies (23NYCRR 500) Solution Brief
Publication Date: March 10, 2017 Requirements for Financial Services Companies (23NYCRR 500) Solution Brief EventTracker 8815 Centre Park Drive, Columbia MD 21045 About EventTracker EventTracker s advanced
More informationExam4Tests. Latest exam questions & answers help you to pass IT exam test easily
Exam4Tests http://www.exam4tests.com Latest exam questions & answers help you to pass IT exam test easily Exam : CISM Title : Certified Information Security Manager Vendor : ISACA Version : DEMO 1 / 10
More informationNew York Department of Financial Services Cybersecurity Regulation Compliance and Certification Deadlines
New York Department of Financial Services Cybersecurity Regulation Compliance and Certification Deadlines New York Department of Financial Services ( DFS ) Regulation 23 NYCRR 500 requires that entities
More informationAltius IT Policy Collection Compliance and Standards Matrix
Governance Context and Alignment Policy 4.1 4.4 800-26 164.308 12.4 EDM01 IT Governance Policy 5.1 800-30 12.5 EDM02 Leadership Mergers and Acquisitions Policy A.6.1.1 800-33 EDM03 Context Terms and Definitions
More informationPerforming a Vendor Security Review TCTC 2017 FALL EVENT PRESENTER: KATIE MCINTOSH
Performing a Vendor Security Review TCTC 2017 FALL EVENT PRESENTER: KATIE MCINTOSH 1 Speaker Bio Katie McIntosh, CISM, CRISC, CISA, CIA, CRMA, is the Cyber Security Specialist for Central Hudson Gas &
More informationAltius IT Policy Collection Compliance and Standards Matrix
Governance Context and Alignment Policy 4.1 4.4 800-26 164.308 12.4 EDM01 IT Governance Policy 5.1 800-30 12.5 EDM02 Leadership Mergers and Acquisitions Policy A.6.1.1 800-33 EDM03 Context Terms and Definitions
More informationVirginia Commonwealth University School of Medicine Information Security Standard
Virginia Commonwealth University School of Medicine Information Security Standard Title: Scope: Personnel Security Standard This standard is applicable to all VCU School of Medicine personnel. Approval
More informationProtecting your data. EY s approach to data privacy and information security
Protecting your data EY s approach to data privacy and information security Digital networks are a key enabler in the globalization of business. They dramatically enhance our ability to communicate, share
More informationInformation Security Risk Strategies. By
Information Security Risk Strategies By Larry.Boettger@Berbee.com Meeting Agenda Challenges Faced By IT Importance of ISO-17799 & NIST The Security Pyramid Benefits of Identifying Risks Dealing or Not
More informationORA HIPAA Security. All Affiliate Research Policy Subject: HIPAA Security File Under: For Researchers
All Affiliate Research Policy Subject: HIPAA File Under: For Researchers ORA HIPAA Issuing Department: Office of Research Administration Original Policy Date Page 1 of 5 Approved by: May 9,2005 Revision
More informationISSMP is in compliance with the stringent requirements of ANSI/ISO/IEC Standard
Certification Exam Outline Effective Date: April 2013 About CISSP-ISSMP The Information Systems Security Management Professional (ISSMP) is a CISSP who specializes in establishing, presenting, and governing
More informationISO / IEC 27001:2005. A brief introduction. Dimitris Petropoulos Managing Director ENCODE Middle East September 2006
ISO / IEC 27001:2005 A brief introduction Dimitris Petropoulos Managing Director ENCODE Middle East September 2006 Information Information is an asset which, like other important business assets, has value
More informationCyber Risks in the Boardroom Conference
Cyber Risks in the Boardroom Conference Managing Business, Legal and Reputational Risks Perspectives for Directors and Executive Officers Preparing Your Company to Identify, Mitigate and Respond to Risks
More informationUT HEALTH SAN ANTONIO HANDBOOK OF OPERATING PROCEDURES
ACCESS MANAGEMENT Policy UT Health San Antonio shall adopt access management processes to ensure that access to Information Resources is restricted to authorized users with minimal access rights necessary
More informationExternal Supplier Control Obligations. Cyber Security
External Supplier Control Obligations Cyber Security Control Title Control Description Why this is important 1. Cyber Security Governance The Supplier must have cyber risk governance processes in place
More informationSubject: University Information Technology Resource Security Policy: OUTDATED
Policy 1-18 Rev. 2 Date: September 7, 2006 Back to Index Subject: University Information Technology Resource Security Policy: I. PURPOSE II. University Information Technology Resources are at risk from
More informationCybersecurity in Higher Ed
Cybersecurity in Higher Ed 1 Overview Universities are a treasure trove of information. With cyber threats constantly changing, there is a need to be vigilant in protecting information related to students,
More informationCyber Security Program
Cyber Security Program Cyber Security Program Goals and Objectives Goals Provide comprehensive Security Education and Awareness to the University community Build trust with the University community by
More informationSecurity Policies and Procedures Principles and Practices
Security Policies and Procedures Principles and Practices by Sari Stern Greene Chapter 3: Information Security Framework Objectives Plan the protection of the confidentiality, integrity and availability
More informationBalancing Between Risk and Compliance
Balancing Between Risk and Compliance Dave Mann, Ph.D. Senior Security Strategist BindView Development Business is risky! Want low risk? Get a savings account Risk Appetite = Organizational need for risk
More informationDETAILED POLICY STATEMENT
Applies To: HSC Responsible Office: HSC Information Security Office Revised: New 12/2010 Title: HSC-200 Security and Management of HSC IT Resources Policy POLICY STATEMENT The University of New Mexico
More informationINTELLIGENCE DRIVEN GRC FOR SECURITY
INTELLIGENCE DRIVEN GRC FOR SECURITY OVERVIEW Organizations today strive to keep their business and technology infrastructure organized, controllable, and understandable, not only to have the ability to
More informationCertified Information Systems Auditor (CISA)
Certified Information Systems Auditor (CISA) 1. Domain 1 The Process of Auditing Information Systems Provide audit services in accordance with IT audit standards to assist the organization in protecting
More informationEC-Council Certified Network Defender (CND) Duration: 5 Days Method: Instructor-Led
EC-Council Certified Network Defender (CND) Duration: 5 Days Method: Instructor-Led Certification: Certified Network Defender Exam: 312-38 Course Description This course is a vendor-neutral, hands-on,
More informationCyber Security in M&A. Joshua Stone, CIA, CFE, CISA
Cyber Security in M&A Joshua Stone, CIA, CFE, CISA Agenda About Whitley Penn, LLP The Threat Landscape Changed Cybersecurity Due Diligence Privacy Practices Cybersecurity Practices Costs of a Data Breach
More informationPutting It All Together:
Putting It All Together: The Interplay of Privacy & Security Regina Verde, MS, MBA, CHC Chief Corporate Compliance & Privacy Officer University of Virginia Health System 2017 ISPRO Conference October 24,
More informationHIPAA Security and Privacy Policies & Procedures
Component of HIPAA Security Policy and Procedures Templates (Updated for HITECH) Total Cost: $495 Our HIPAA Security policy and procedures template suite have 71 policies and will save you at least 400
More informationEXAM PREPARATION GUIDE
When Recognition Matters EXAM PREPARATION GUIDE PECB Certified ISO 22301 Lead Implementer www.pecb.com The objective of the Certified ISO 22301 Lead Implementer examination is to ensure that the candidate
More informationDeMystifying Data Breaches and Information Security Compliance
May 22-25, 2016 Los Angeles Convention Center Los Angeles, California DeMystifying Data Breaches and Information Security Compliance Presented by James Harrison OM32 5/25/2016 3:00 PM - 4:15 PM The handouts
More informationEXAM PREPARATION GUIDE
EXAM PREPARATION GUIDE PECB Certified ISO/IEC 38500 Lead IT Corporate Governance Manager The objective of the PECB Certified ISO/IEC 38500 Lead IT Corporate Governance Manager examination is to ensure
More informationCSE 3482 Introduction to Computer Security. Security Risk Management Cost-Benefit Analysis
CSE 3482 Introduction to Computer Security Security Risk Management Cost-Benefit Analysis Instrutor: N. Vlajic, Winter 2017 Security Risk Management Risk Management Risk Identification Risk Control Identify
More informationCOBIT 5 With COSO 2013
Integrating COBIT 5 With COSO 2013 Stephen Head Senior Manager, IT Risk Advisory Services 1 Our Time This Evening Importance of Governance COBIT 5 Overview COSO Overview Mapping These Frameworks Stakeholder
More informationStandard for Security of Information Technology Resources
MARSHALL UNIVERSITY INFORMATION TECHNOLOGY COUNCIL Standard ITP-44 Standard for Security of Information Technology Resources 1 General Information: Marshall University expects all individuals using information
More informationMANUAL OF UNIVERSITY POLICIES PROCEDURES AND GUIDELINES. Applies to: faculty staff students student employees visitors contractors
Page 1 of 6 Applies to: faculty staff students student employees visitors contractors Effective Date of This Revision: June 1, 2018 Contact for More Information: HIPAA Privacy Officer Board Policy Administrative
More informationPost-Secondary Institution Data-Security Overview and Requirements
Post-Secondary Institution Data-Security Overview and Tiina K.O. Rodrigue, EdDc, CISSP, CISM, PMP, CSM, CEA, ITIL, ISC2 Compliance Mapper, A+ Senior Advisor Cybersecurity - 2017 Agenda Who needs to worry
More informationPCI Policy Compliance Using Information Security Policies Made Easy. PCI Policy Compliance Information Shield Page 1
PCI Policy Compliance Using Information Security Policies Made Easy PCI Policy Compliance Information Shield Page 1 PCI Policy Compliance Using Information Security Policies Made Easy By David J Lineman
More information<< Practice Test Demo - 2PassEasy >> Exam Questions CISM. Certified Information Security Manager. https://www.2passeasy.
Exam Questions CISM Certified Information Security Manager https://www.2passeasy.com/dumps/cism/ 1.Senior management commitment and support for information security can BEST be obtained through presentations
More informationBusiness continuity management and cyber resiliency
Baker Tilly refers to Baker Tilly Virchow Krause, LLP, an independently owned and managed member of Baker Tilly International. Business continuity management and cyber resiliency Introductions Eric Wunderlich,
More informationInformation Security Policy
April 2016 Table of Contents PURPOSE AND SCOPE 5 I. CONFIDENTIAL INFORMATION 5 II. SCOPE 6 ORGANIZATION OF INFORMATION SECURITY 6 I. RESPONSIBILITY FOR INFORMATION SECURITY 6 II. COMMUNICATIONS REGARDING
More informationApplication for Certification
Application for Certification Requirements to Become a Certified Information Security Manager To become a Certified Information Security Manager (CISM), an applicant must: 1. Score a passing grade on the
More informationDEFINITIONS AND REFERENCES
DEFINITIONS AND REFERENCES Definitions: Insider. Cleared contractor personnel with authorized access to any Government or contractor resource, including personnel, facilities, information, equipment, networks,
More informationInformation Security Data Classification Procedure
Information Security Data Classification Procedure A. Procedure 1. Audience 1.1 All University staff, vendors, students, volunteers, and members of advisory and governing bodies, in all campuses and locations
More informationVirginia State University Policies Manual. Title: Information Security Program Policy: 6110
Purpose Virginia State University (VSU) uses information to perform the business services and functions necessary to fulfill its mission. VSU information is contained in many different mediums including
More informationChecklist: Credit Union Information Security and Privacy Policies
Checklist: Credit Union Information Security and Privacy Policies Acceptable Use Access Control and Password Management Background Check Backup and Recovery Bank Secrecy Act/Anti-Money Laundering/OFAC
More informationPosition Description IT Auditor
Position Title IT Auditor Position Number Portfolio Performance and IT Audit Location Victoria Supervisor s Title IT Audit Director Travel Required Yes FOR OAG HR USE ONLY: Approved Classification or Leadership
More informationManagement Update: Information Security Risk Best Practices
IGG-07022003-01 R. Witty Article 2 July 2003 Management Update: Information Security Risk Best Practices The growing focus on managing information security risk is challenging most enterprises to determine
More informationCOPYRIGHTED MATERIAL. Index
Index 2014 revised COSO framework. See COSO internal control framework Association of Certified Fraud Examiners (ACFE), 666 Administrative files workpaper document organization, 402 AICPA fraud standards
More informationHIPAA Compliance: What it is, what it means, and what to do about it. Adam Carlson, Security Solutions Consultant Intapp
HIPAA Compliance: What it is, what it means, and what to do about it. Adam Carlson, Security Solutions Consultant Intapp Agenda Introductions HIPAA Background and History Overview of HIPAA Requirements
More informationEXAM PREPARATION GUIDE
When Recognition Matters EXAM PREPARATION GUIDE PECB Certified ISO/IEC 20000 Lead Auditor www.pecb.com The objective of the Certified ISO/IEC 20000 Lead Auditor examination is to ensure that the candidate
More informationNo IT Audit Staff? How to Hack an IT Audit. Presenters. Mark Bednarz, Partner-In-Charge, Risk Advisory PKF O Connor Davies, LLP
No IT Audit Staff? How to Hack an IT Audit Presenters Mark Bednarz, Partner-In-Charge, Risk Advisory PKF O Connor Davies, LLP Learning Objectives After this session, participants will be able to: Devise
More informationPROCEDURE COMPREHENSIVE HEALTH SERVICES, INC
PROCEDURE COMPREHENSIVE HEALTH SERVICES, INC APPROVAL AUTHORITY: President, CHSi GARY G. PALMER /s/ OPR: Director, Information Security NUMBER: ISSUED: VERSION: APRIL 2015 2 THOMAS P. DELAINE JR. /s/ 1.0
More informationHow to implement NIST Cybersecurity Framework using ISO WHITE PAPER. Copyright 2017 Advisera Expert Solutions Ltd. All rights reserved.
How to implement NIST Cybersecurity Framework using ISO 27001 WHITE PAPER Copyright 2017 Advisera Expert Solutions Ltd. All rights reserved. Copyright 2017 Advisera Expert Solutions Ltd. All rights reserved.
More informationLakeshore Technical College Official Policy
Policy Title Original Adoption Date Policy Number Information Security 05/12/2015 IT-720 Responsible College Division/Department Responsible College Manager Title Information Technology Services Director
More informationEmployee Security Awareness Training Program
Employee Security Awareness Training Program Date: September 15, 2015 Version: 2015 1. Scope This Employee Security Awareness Training Program is designed to educate any InComm employee, independent contractor,
More informationMay 14, :30PM to 2:30PM CST. In Plain English: Cybersecurity and IT Exam Expectations
May 14, 2018 1:30PM to 2:30PM CST In Plain English: Cybersecurity and IT Exam Expectations Options to Join Webinar and audio Click on the link: https://www.webcaster4.com/webcast/page/584/24606 Choose
More informationADIENT VENDOR SECURITY STANDARD
Contents 1. Scope and General Considerations... 1 2. Definitions... 1 3. Governance... 2 3.1 Personnel... 2 3.2 Sub-Contractors... 2 3.3. Development of Applications... 2 4. Technical and Organizational
More informationCriminal Justice Information Security (CJIS) Guide for ShareBase in the Hyland Cloud
Criminal Justice Information Security (CJIS) Guide for ShareBase in the Hyland Cloud Introduction The Criminal Justice Information Security (CJIS) Policy is a publically accessible document that contains
More informationEducation Network Security
Education Network Security RECOMMENDATIONS CHECKLIST Learn INSTITUTE Education Network Security Recommendations Checklist This checklist is designed to assist in a quick review of your K-12 district or
More informationCYBERSECURITY HOW IT IS TRANSFORMING THE IT ASSURANCE FIELD
CYBERSECURITY HOW IT IS TRANSFORMING THE IT ASSURANCE FIELD December 2014 KEVIN GROOM ISACA Involvement (Middle Tennessee Chapter) Treasurer (2009 2011) Vice President (2011 2013) President (2013 present)
More informationSOLUTION BRIEF RSA ARCHER IT & SECURITY RISK MANAGEMENT
RSA ARCHER IT & SECURITY RISK MANAGEMENT INTRODUCTION Organizations battle growing security challenges by building layer upon layer of defenses: firewalls, antivirus, intrusion prevention systems, intrusion
More informationIT SECURITY OFFICER. Department: Information Technology. Pay Range: Professional 18
Pierce County Classification Description IT SECURITY OFFICER Department: Information Technology Job Class #: 634900 Pay Range: Professional 18 FLSA: Exempt Represented: No Classification descriptions are
More informationAuditing and Monitoring for HIPAA Compliance. HCCA COMPLIANCE INSTITUTE 2003 April, Presented by: Suzie Draper Sheryl Vacca, CHC
Auditing and Monitoring for HIPAA Compliance HCCA COMPLIANCE INSTITUTE 2003 April, 2003 Presented by: Suzie Draper Sheryl Vacca, CHC 1 The Elements of Corporate Compliance Program There are seven key elements
More informationCanada Life Cyber Security Statement 2018
Canada Life Cyber Security Statement 2018 Governance Canada Life has implemented an Information Security framework which supports standards designed to establish a system of internal controls and accountability
More informationVal-EdTM. Valiant Technologies Education & Training Services. Workshop for CISM aspirants. All Trademarks and Copyrights recognized.
Val-EdTM Valiant Technologies Education & Training Services Workshop for CISM aspirants All Trademarks and Copyrights recognized Page 1 of 8 Welcome to Valiant Technologies. We are a specialty consulting
More informationNYDFS Cybersecurity Regulations: What do they mean? What is their impact?
June 13, 2017 NYDFS Cybersecurity Regulations: What do they mean? What is their impact? Gus Coldebella Principal, Boston Caroline Simons Principal, Boston Agenda 1) Overview of the new regulations 2) Assessing
More informationBUILDING CYBERSECURITY CAPABILITY, MATURITY, RESILIENCE
BUILDING CYBERSECURITY CAPABILITY, MATURITY, RESILIENCE 1 WHAT IS YOUR SITUATION? Excel spreadsheets Manually intensive Too many competing priorities Lack of effective reporting Too many consultants Not
More informationDoes a SAS 70 Audit Leave you at Risk of a Security Exposure or Failure to Comply with FISMA?
Does a SAS 70 Audit Leave you at Risk of a Security Exposure or Failure to Comply with FISMA? A brief overview of security requirements for Federal government agencies applicable to contracted IT services,
More informationWITH ACTIVEWATCH EXPERT BACKED, DETECTION AND THREAT RESPONSE BENEFITS HOW THREAT MANAGER WORKS SOLUTION OVERVIEW:
SOLUTION OVERVIEW: ALERT LOGIC THREAT MANAGER WITH ACTIVEWATCH EXPERT BACKED, DETECTION AND THREAT RESPONSE Protecting your business assets and sensitive data requires regular vulnerability assessment,
More informationApex Information Security Policy
Apex Information Security Policy Table of Contents Sr.No Contents Page No 1. Objective 4 2. Policy 4 3. Scope 4 4. Approval Authority 5 5. Purpose 5 6. General Guidelines 7 7. Sub policies exist for 8
More informationNext Generation Policy & Compliance
Next Generation Policy & Compliance Mason Karrer, CISSP, CISA GRC Strategist - Policy and Compliance, RSA Core Competencies C33 2013 Fall Conference Sail to Success CRISC CGEIT CISM CISA Introductions...
More informationEXAM PREPARATION GUIDE
When Recognition Matters EXAM PREPARATION GUIDE PECB Certified ISO/IEC 27001 Lead Auditor www.pecb.com The objective of the Certified ISO/IEC 27001 Lead Auditor examination is to ensure that the candidate
More informationCybersecurity: Considerations for Internal Audit. Gina Gondron Senior Manager Frazier & Deeter Geek Week August 10, 2016
Cybersecurity: Considerations for Internal Audit Gina Gondron Senior Manager Frazier & Deeter Geek Week August 10, 2016 Agenda Key Risks Incorporating Internal Audit Resources Questions 2 San Francisco
More informationProtect Your Institution with Effective Cybersecurity Governance. Baker Tilly Virchow Krause, LLP
Protect Your Institution with Effective Cybersecurity Governance 1 Your presenter Mike Cullen, Senior Manager, Baker Tilly CISA, CISSP, CIPP/US > Leads the firm s Higher Education Technology Risk Services
More information354 & Index Board of Directors Responsibilities Audit Committee and Risk Committee Coordination, 244 Audit Committee Functions and Responsibilities, 2
Index Accounts Payable Process Review Procedures Assessments, 191 Actions to Resolve Risks COSO ERM Control Activities, 97 Activity Management COSO ERM Control Activities, 81 AICPA SAS No. 1 Internal Controls
More informationUSER CORPORATE RULES. These User Corporate Rules are available to Users at any time via a link accessible in the applicable Service Privacy Policy.
These User Corporate Rules are available to Users at any time via a link accessible in the applicable Service Privacy Policy. I. OBJECTIVE ebay s goal is to apply uniform, adequate and global data protection
More informationChecklist for Applying ISO 27000, PCI DSS v2 & NIST to Address HIPAA & HITECH Mandates. Ali Pabrai, MSEE, CISSP (ISSAP, ISSMP)
Checklist for Applying ISO 27000, PCI DSS v2 & NIST to Address HIPAA & HITECH Mandates Ali Pabrai, MSEE, CISSP (ISSAP, ISSMP) ecfirst, chief executive Member, InfraGard Compliance Mandates Key Regulations
More informationAnnual Report on the Status of the Information Security Program
October 2, 2014 San Bernardino County Employees Retirement Association 348 W. Hospitality Lane, Third Floor San Bernardino, CA 92415-0014 1 Table of Contents I. Executive Summary... 3 A. Overview... 3
More informationSeven Requirements for Successfully Implementing Information Security Policies and Standards
Seven Requirements for Successfully Implementing and Standards A guide for executives Stan Stahl, Ph.D., President, Citadel Information Group Kimberly A. Pease, CISSP, Vice President, Citadel Information
More informationITSM20F_Umang. Number: ITSM20F Passing Score: 800 Time Limit: 120 min File Version: 4.0. Exin ITSM20F
ITSM20F_Umang Number: ITSM20F Passing Score: 800 Time Limit: 120 min File Version: 4.0 http://www.gratisexam.com/ Exin ITSM20F IT Service Management Foundation based on ISO/IEC 20000 (ITSM20F.EN) Version:
More informationlocuz.com SOC Services
locuz.com SOC Services 1 Locuz IT Security Lifecycle services combine people, processes and technologies to provide secure access to business applications, over any network and from any device. Our security
More informationRisk Assessment. The Heart of Information Security
Risk Assessment The Heart of Information Security Overview Warm-up Quiz Why do we perform risk assessments? The language of risk - definitions The process of risk assessment Risk Mitigation Triangle Lessons
More information