John R. Robles CISA, CISM, CRISC

Size: px

Start display at page:

Download "John R. Robles CISA, CISM, CRISC"

Michael Stevens
5 years ago
Views:

1 Jhn R. Rbles CISA, CISM, CRISC

2 What is Security as a Service (SecaaS)? Security as a Service is a clud cmputing mdel that Delivers Managed Security Services ver the Internet.

3 SecaaS, is a Clud Service. It is available: On-demand, and Over the Netwrk. SecaaS-prvider resurces are pled in rder t be made available t many custmers at the same time. SecaaS availability is prvided elastically Need mre?, SecaaS prvides mre Need less?, SecaaS prvides less SecaaS is prvided as a measured Service Use mre, Pay mre Use less, Pay less The Clud Prvider Prvides the Clud Services

4 Accrding t Clud Security Alliance (CSA) SecaaS services include: Identity and Access Management (IAM) Data Lss Preventin Web Security Security Security Assessments Intrusin Management Security Infrmatin and Event Management (SIEM) Encryptin Business Cntinuity and Disaster Recvery Netwrk Security

5 Infrmatin Security is a critical functin in tday s cmputer envirnments (in private enterprises, as well as, gvernment, and NGOs-Nn Gvernment Organizatins). Infrmatin Security is cmplex. Nt having adequate & apprpriate security can be devastating t rganizatins Lss f rganizatinal mney Lss f rganizatinal credibility Lss f critical infrmatin t cmpetitrs and natinal enemies Lss f persnal identity and the abuse f stlen identities Lss f cmpliance with gvernment regulatins and cntractual bligatins

6 When using SecaaS, rganizatins shuld cnstantly ask their Clud Security Service Prvider: Wh is respnsible fr securing what? Wh has access t what data? Where are imprtant security data (audit lgs, user credentials, etc.) stred and can they be accessed when needed? What are the destructin and archival prcedures? What legal and jurisdictinal issues d crss-brder SecaaS fferings raise? What new data privacy and access management issues are raised by SecaaS? As SecaaS grws in ppularity will mre regulatins be created t deal specifically with sme f these ptential issues? An rganizatin can utsurce Security Respnsibility but nt Security Accuntability

7 Organizatinal Benefits f SecaaS include: Cst Ease f management and peratins Prvider is respnsible Fcus n cre cmpetencies N lg management Eliminate r reduce Help Desk calls Scalability Fast prvisining Best f breed Expertise Access t specialized security expertise Cntinuus updates Cst effective cmpliance

8 Service Mdel SaaS: the rganizatin pushes almst all security cncerns t the Clud PaaS: the rganizatins have sme cntrl ver the security pushed t the Clud IaaS: the rganizatins has even greater cntrl ver security pushed t the Clud Cnfidential Data Data Classificatin: High Risk, Medium Risk, Lw Risk Ensure security is apprpriate fr the classified data Data Prtectin Is SecaaS security in line with rganizatinal requirements? Is access granted based n least privilege? Are there cuntry-specific regulatins that restrict lcatins fr transfer, prcessing, r strage f data?

9 Cntract High risk! Must be strictly scrutinized. Cntracted security services, settings and ptins must meet rganizatin's needs and regulatr cmpliance. The enterprise is ultimately respnsible fr the security f its assets Gaps High risk! Hw t determine that cntracted security services, settings and ptins are prvided as cntracted (Gaps). Must get attestatins via SSAE-16, ISAE 3402, ISO 27001, r PCI DSS reviews. Identified gaps must be managed as risks.

10 Risk Management Strategies Acceptance Accept rather than mitigate because f high implementatin csts Mitigatin Establish physical, administrative and/r technical cntrls r systems the ptential fr prblems Avidance Make changes t avid the risk Transfer Transfer the risk t anther party Buy insurance t cver cnsequences f risk ccurrence. Gvernance and Risk Management Cnstantly Detect, Manage, and Review Risk Establish Risk appetite

11 COBIT 5 frm ISACA Prvides a cmprehensive framewrk Assists rganizatins in achieving their bjectives in using SecaaS Gvernance cnsideratins fr SecaaS Fr whm are the benefits? Wh bears the Risk? What resurces are required? Management: Knws & understands the benefits f SecaaS Evaluates and mnitrs benefits realizatin Understands clud cmputing risk Can quickly respnd t changing risks Seeks peridic assurance t ensure SecaaS effectiveness Has established acquisitin, deplyment and peratins rles and respnsibilities

12 Ensure that the SecaaS prvided by the Clud Service Prvider has: Availability 24/7 peratins must have 24/7 security Privacy Ensure that prvider has effective cntrls t ensure privacy f data Data security Security Infrmatin and Event Management Prtect CIA (Cnfidentiality, Integrity, and Availability) f infrmatin. Lcatin Lcatins requirements fr jurisdictin and legal bligatins that must be ensured. Cmpliance Ensure prvider cmplies with all relevant infrmatin security laws and regulatins

13 Mnitring Cntrls Apprpriate use f SLAs t mnitr and assess perfrmance Reprting Cntrls Independent security reviews r certificatin reprts issued by 3 rd parties Cmpensatry Cntrls Implement if If Gaps arise New risks are intrduced Gvernance Cntrls Physical Cntrls Lgical Cntrls

14 SecaaS may be an apprpriate IT Slutin Increase security while reducing csts and resurces The rganizatin is always respnsible fr infrmatin security assurance Use Cbit 5 as a assurance framewrk t test cntrls that prtect infrmatin assets Maintain partnership with SecaaS prvider Transparency f security cntrls

15 And Answers! Jhn R. Rbles CISA, CISM, CRISC

General Data Protection Regulation (GDPR) for CEO s Quick overview & impact

General Data Protection Regulation (GDPR) for CEO s Quick overview & impact General Data Prtectin Regulatin (GDPR) fr CEO s Quick verview & impact ISSE, Nvember 14th 2017 Erik Luysterbrg EMEA Data Prtectin & Privacy Leader Why is GDPR n the agenda? Cllectin, analysis and internatinal