Information assurance /Information security

Information assurance /Information security

• 1.
  Information Assurance/Information Security JohnW. Lainhart IV presentation for the Computer System Security and Privacy Advisory Meeting June 13, 2002 p c P w C A business of
• 2.
  2 p c Agenda •Information Assurance • COBIT & the Management Guidelines • IT Governance • SysTrustSM Assurance Service • Managing Security of Information • Board Briefing on IT Governance • Information Security Governance • Center for Internet Security Benchmarks
• 3.
  Information Assurance p c 3
• 4.
  4 p c InformationAssurance Conducting those Conducting those operations that protect that protect and defend information and information and defend information and information systems by ensuring systems by ensuring confidentiality, , integrity, , availability and and accountability. . This includes providing for This includes providing for restoration of of information systems by incorporating information systems by incorporating protection, , detection and and reaction capabilities. capabilities. NIAP Definition
• 5.
  5 p c StrategicVision: Holistic Understanding Security is a Function of Business Successful Implementation of Any Sensitive Security Program Requires An Understanding of the Mission, Operations, Resources, and the Business Impact Caused by Vulnerabilities Implement Control Protective Measures to Mitigate Exploitable Risks and Minimize Operational Impacts Caused by Physical And IT Vulnerabilities… Threats Will Continue to Exist… Traditional Security Must be Integrated And Active for OPSEC and Business Continuity to be Effective Architecture Services
• 6.
  6 p c IA:A Functional Spectrum IA Program Objectives: Moving Beyond Information Security Integrity, Confidentiality, Availability, Accountability Successful programs contain both proactive and reactive functions to be effective. Proactive Measures Event Reactive Functions Protect Detect React Policies Procedures Intrusion Detection Firewall Management Password Management Configuration Biometrics Management Encryption Threat Analysis Vulnerability Assessment Risk Analysis Training & Education Document Control Classification Smart Cards Management C&A (NIACAP, DITSCAP) SW Patches Anti-Virus Data Storage Contingency Plans Personnel Security Physical Security Counter Competitor Intelligence Penetration Testing Networks Social Engineering Open Source Exploitation CIRT (CERT) COOP Investigations Disaster Recovery Computer Forensics Continuity of Government Business Continuity Incident Reporting Process Network Scty Intell Business Environment Monitoring Managed Security Services (Examples) p c 6
• 7.
  7 p c ConcentricBarriers: Rings of Security Protecting Critical Assets in the Virtual World Mirrors the Physical Monitoring CIRT Forensics BCP/COOP Proactive Measures Event Reactive Functions Protect Detect React Deter e.g. Warning Banner Detect e.g. Intrusion Detection Delay e.g. Firewall Defend e.g Encryption Deny e.g. Honey Pots Defeat e.g. Arrest Defense in Depth Escalation by Severity Critical Data & Essential Information (Examples) p c 7
• 8.
  8 p c PDD63 PDD 63 responds to the Interdependence of Infrastructures and Technologies Telecommunications Power Gas/Oil Finance/Banking Transportation Water Government Services Emergency Services What the Public Sees/Reads Determines their Confidence What the Public Does Not See Involves Detailed Integration Of the Infrastructure: Plans/Compliance/Actions p c What We Can Do: •Threat Analysis •Vulnerability Studies •Protective Measures •Impact Analysis 8
• 9.
  9 p c InformationAssurance Program Management Services Information Assurance Program Develop a cross functional (technical, physical, personnel and environmental) matrix team consisting of empowered management and staff who are tasked to develop and manage long-term strategic direction for the organization Information Assurance Program incorporating: - Security Vision & Strategy - Senior Management Commitment - Training & Awareness Programs - Information Assurance Management Structure Chair CIO Co-Chair PM Secretariat Working Groups Technical Management Operations Policy Personnel Individual Stand Up As-Necessary - Steering Committee Public Relations Technical Sub Agencies Org. Security Operations H R Budget - Members at large Sub Agency I Sub Agency III Sub Agency I Sub Agency IV
• 10.
  10 p c InformationAssurance Program Assessment and Diagnostic Service • Risk Assessment (incorporating Asset Inventory, Mission Requirements Driven Policy, Threats, Vulnerabilities, associated Risk, Countermeasures, ROI, and strategic action implementation plan) • Penetration Testing and Analysis • Financial (budget) Assessment • Diagnostics Security Reviews of specific platforms • Asset Inventory Analysis • Security Readiness Reviews • Security Testing and Evaluation (documentation, testing and Evaluation) • Government Information Security Reform Act (GISRA) Review • Critical Infrastructure Protection Analysis • Certification and Accreditation (System Security Authorization Agreement) • Data/Information Integrity Assessment • Site Surveys and Analysis • Tools (i.e., EMM@, ESAS, Buddy System)
• 11.
  11 p c InformationAssurance Program Management Services • Policy Development • Technical Writing • Standards • Management Infrastructure • Education Training and Awareness • Business & Technical Disaster Recovery (documentation, training and testing) • Management Training • Continuity Of Operations (COOP) Development • Capacity Management • Configuration Management • IAP Metrics • Knowledge Management • Distance Learning • Strategic Management Consulting • Economic Security
• 12.
  12 p c InformationAssurance Program Architecture Services • Enterprise-Wide Architecture • Network Security architecture and Specialized Architectures • Security Product Review & Analysis • Security Program Review & Analysis • Life Cycle Methodology Development • Configuration • Security Architecture and Design Architecture Services
• 13.
  13 p c InformationAssurance Program Implementation Services • Commercial security products (COTS) • Encryption • Single Sign On • Firewalls • Servers • Routers • Web/Internet Services • VPNs • Public Key Infrastructure (PKI) • Secured Electronic Transaction (SET) • Digital Certificates • Certificate Authority Design • Authentication • Directory Services • Smart Cards • Biometrics • Wireless
• 14.
  14 p c InformationAssurance Program Incident Investigation and Assurance Services • Investigation and recovery from computer security incidents • Data Forensics • Incident Reporting and response services • CERT/NOC capabilities • Vulnerability Alerts • Virus Alerts • Unauthorized intrusion detection
• 15.
  15 p c InformationAssurance Program How To Get There! Where You Want To Be! Where You Are! Information Assurance Program Recommendations Current IT Program Building on the strengths of your current Y2K Infrastructure, the next step is to move to a world class Information Assurance Program.
• 16.
  COBIT Information Technology GovernanceInstitute Control Objectives for Information and related Technology p c 16
• 17.
  17 p c COBIT:An IT control framework XStarts from the premise that IT needs to deliver the information that the enterprise needs to achieve its objectives XPromotes process focus and process ownership XDivides IT into 34 processes belonging to four domains XLooks at fiduciary, quality and security needs of enterprises and provides for seven information criteria that can be used to generically define what the business requires from IT XPlanning XAcquiring & Implementing XDelivery & Support XMonitoring XEffectiveness XEfficiency XAvailability, XIntegrity XConfidentiality XReliability XCompliance
• 18.
  18 p c COBIT: An IT control framework X A high-level control objective for each process identifying which information criteria are most important in that IT process stating which resources will usually be leveraged providing considerations on what is important for controlling that IT process X 318 detailed control objectives for management and IT practitioners X Extensive audit guidelines building on these objectives
• 19.
  19 p c COBITManagement Guidelines Answers Key Management Questions Through the use of: Maturity Models Critical Success Factors Key Goal Indicators Key Performance Indicators
• 20.
  20 p c COBITManagement Guidelines Generic Maturity Model 0 Non-Existent. Complete lack of any recognizable processes. The organization has not even recognized that there is an issue to be addressed. 1 Initial. There is evidence that the organization has recognized that the issues exist and need to be addressed. There are however no standardized processes but instead there are ad hoc approaches that tend to be applied on an individual or case by case basis. The overall approach to management is disorganised. 2 Repeatable. Processes have developed to the stage where similar procedures are followed by different people undertaking the same task. There is no formal training or communication of standard procedures and responsibility is left to the individual. There is a high degree of reliance on the knowledge of individuals and therefore errors are likely. 3 Defined. Procedures have been standardized and documented, and communicated through training. It is however left to the individual to follow these processes, and it is unlikely that deviations will be detected. The procedures themselves are not sophisticated but are the formalization of existing practices. 4 Managed. It is possible to monitor and measure compliance with procedures and to take action where processes appear not to be working effectively. Processes are under constant improvement and provide good practice. Automation and tools are used in a limited or fragmented way. 5 Optimized. Processes have been refined to a level of best practice, based on the results of continuous improvement and maturity modeling with other organizations. IT is used in an integrated way to automate the workflow, providing tools to improve quality and effectiveness, making the enterprise quick to adapt. p c 20
• 21.
  21 p c COBITManagement Guidelines Maturity Models for Self-Assessment
• 22.
  22 p c ITGovernance PO AI DS MO
• 23.
  SysTrustSM American Institute ofCertified Public Accountants/Canadian Institute of Chartered Accountants Systems Reliability Assurance Service p c 23
• 24.
  24 p c SysTrust Opinionon controls – Based on a framework of principles criteria – Identify and assess the operating effectiveness of controls that support the criteria A system must meet all principles all criteria to be considered “Reliable” – Reporting on less than 4 principles is permitted – All criteria related to the principle must be met
• 25.
  25 p c SysTrust SysTrustas an Assurance Service SysTrust used to manage internal risk – New applications being developed and/or implemented – Applications already in use SysTrust use to manage 3rd party risk Partner systems – 3rd party service-bureau systems – Online marketplaces/exchanges
• 26.
  26 p c SysTrust SysTrustas Consulting Engagement SysTrust is a benchmark on controls Opportunity to identify control weaknesses Current engagements started as consulting Greater market for Consulting or Assurance?
• 27.
  27 p c SysTrust Systemreliability is defined as: “A system that operates without material error, fault or failure during a specified time in a specified environment.” Four Principles: - Availability - Security - Integrity - Maintainability
• 28.
  Managing Security ofInformation International Federation of Accountants International Information Technology Guideline p c 28
• 29.
  29 p c ManagingSecurity of Information Core Principles Accountability - Responsibility and accountability must be explicit Awareness - Awareness of risks and security initiatives must be disseminated Multidisciplinary - Security must be addressed taking into consideration both technological and non-technological issues Cost Effectiveness - Security must be cost-effective
• 30.
  30 p c ManagingSecurity of Information Core Principles Integration - Security must be coordinated and integrated Reassessment - Security must be reassessed periodically Timeliness - Security procedures must provide for monitoring and timely response Societal Factors - Ethics must be promoted by respecting the rights and interests of others
• 31.
  31 p c ManagingSecurity of Information Implementation Approach Policy Development Roles and Responsibilities Design Implementation Monitoring Awareness, Training, and Education INFORMATION SECURITY POLICY STATEMENT EXAMPLE
• 32.
  Board Briefing onInformation Technology Governance Information Security Governance Co-Badged by a Number of Leading Organizations p c 32
• 33.
  33 p c InformationTechnology Governance “IT governance is the term used to describe how those persons entrusted with governance of an entity will consider IT in their supervision, monitoring, control and direction of the entity. How IT is applied within the entity will have an immense impact on whether the entity will attain its vision, mission or strategic goals.” ITGI document: Board Briefing on Information Technology Governance
• 34.
  34 p c InformationSecurity Governance “Executive management has a responsibility to ensure that the organization provides all users with a secure information systems environment. Furthermore, organizations need to protect themselves against the risks inherent in the use of information systems while simultaneously recognising the benefits that can accrue from having secure information systems.” ITGI document: Information Security Governance
• 35.
  Center for InternetSecurity p c 35
• 36.
  36 p c Centerfor Internet Security is developing: • best-practice benchmarks that define the specific technical settings that will provide increased security for Internet-connected systems • a security ruler that defines which of those specific settings will increase the relative security of your systems • automated tools to continuously monitor the security status of your systems
• 37.
  37 p c WebSites • COBIT -- www.itgi.org • SysTrustSM -- www.aicpa.org • Managing Security of Information -- www.ifac.org • Board Briefing on Information Technology Governance -- www.itgi.org • Information Security Governance – www.itgi.org • Center for Internet Security – www.cisecurity.org
• 38.
  QUESTIONS? QUESTIONS? p c 38
• 39.
  Contact Information: Contact Information: JohnW. Lainhart IV 703/741-1647 john.w.lainhart@us.pwcglobal.com p c 39