cybersecurity - cdn.ymaws.com€¦ · what if we add the word cyber? cyber risk assessment cyber...
TRANSCRIPT
CybersecurityA Common Sense Approach Leveraging
Frameworks
Weaver
Raveen Bhasin
• CISM, CISA, ITIL, CSM• Manager with Weaver’s IT Advisory Services
practice
• A decade of experience in IT risk advisory
services and attestation engagements
including two years each with Deloitte &
Touche and KPMG
• Extensive experience in software selection,
platform design and implementation reviews,
including SDLC process assessments focused on
Agile, Scrum, Kanban and traditional Waterfall
methodologies
Trip Hillman• CISSP, CISA, CEH, GPEN, GCFE, GSNA • Senior Manager with Weaver’s IT Advisory
Services practice
• Focused on Cyber Security
• Strategy and Transformation• Risk Assessments
• Gap Analysis
• Strategy Roadmaps
• Compliance (PCI, FISMA, HIPPA, EI3PA)
• Cyber Ops• Vulnerability Assessment
• Penetration Testing
• Social Engineering
• Incident Response
• The comments and statements in this presentation are the opinions of
the speakers and do not necessarily reflect the opinions or positions
of Weaver and Tidwell, LLP.
• This presentation is the property of Weaver and Tidwell, LLP. All rights
reserved. No part of this document may be reproduced, transmitted
or otherwise distributed in any form without written permission from
Weaver and Tidwell, LLP.
• Weaver and Tidwell, LLP expressly disclaims any liability in connection
with the use of this presentation or its contents by any third party.
Disclaimer
Some organizations will be a target
regardless of what they do,
but most become a target
because of what they do.
Background
The Other Security TriangleSecurity
UsabilityFunctionality
“The user’s going to pick dancing pigs over
security every time.
-Bruce Schneier
Depends on what information assets or systems you have. Could
be:
• Credentials for wire fraud
• Disruption of critical infrastructure
• Confidential information about your organization, your business
dealings, or your customers
• Exploitable consumer financial information
• Network access credentials
• Trade secrets and intellectual property
What do they want?
Question: What are the three
lines of defense?
• Operational Management
• Risk Management and Compliance Function
• Internal Audit
Three Lines of Defense
Question: What do IT Auditors do?
IT General Controls (ITGCs)
Governance
Policy & Procedure (P&P)
Access Control
Logical
Physical
Change Management
Monitoring
Backup & Recovery
Vendor Management
Plan
Scope
Test of Design
Test of Effectiveness
Findings / Observations
Reporting
Process Areas Phases
What if we add the word cyber?
Cyber Risk Assessment
Cyber Gap Assessment
Cyber Roadmap / Action Plan
Cyber Security Posture Evaluation
Vulnerability Assessment
Penetration Test (Red Team)
Social Engineering
Incident Response Table Top Exercise
Industrial Control Systems (ICS) Testing
OSINT / Dark Web Review
Mobile Device
PCI-DSS
ROC/AOC
SOC for Cyber
FFIEC
CSA STAR
FedRAMP / FISMA
Cyber Strategy and Transformation
Cyber ComplianceCyber Technical
Procedures
Question: What is cyber security and how is it different than information security?
• Information security is about securing
information
• Cyber security is about securing
information and communication
technologies (ICT)
– Some of those concerns are relating to
securing the information in ICT
– Some of those concerns relate to the
disruption of critical systems
– Other concerns could relate to misuse
of those systems
Information Security vs. Cyber Security
Adopt a cyber security framework
Ensure the program has the appropriate elements
Develop a roadmap of critical cyber security controls to
implement
Develop policies to support the implementation of controls
A method to evaluate the effectiveness of the cyber security
program
Requirements of a Cyber Security
Program
Frameworks
• ISO 27001:2013
• NIST SP 800-53
• COBIT 5 Security
• CIS Critical 20 CSC
• NIST-CSF
• DIR
Frameworks
• A.5: Information security policies
• A.6: Organization of information security
• A.7: Human resource security
• A.8: Asset management
• A.9: Access control
• A.10: Cryptography
• A.11: Physical and environmental security
• A.12: Operations security
• A.13: Communications security
• A.14: System acquisition, development and maintenance
• A.15: Supplier relationships
• A.16: Information security incident management
• A.17: Information security aspects of business continuity management
• A.18: Compliance; with internal requirements, such as policies, and with external requirements, such as laws
ISO 27001:2013
NIST SP 800-53
COBIT 5 Security
CIS (SANS) Critical 20
NIST CSF
Texas DIR
https://dir.texas.gov/View-About-DIR/Information-Security/Landing.aspx
Implementation Roadmap
• Assess the current state of the organization
• Determine the objectives of the organization with
respect to cyber security
• Develop and appropriate timeline based on current
state, objectives and available resources for
implementing the cyber security program
– Some elements are more easily addressed with tools
– Some elements are more difficult because they require
someone to do something
– Some components of a cyber program are more
complicated to implement because they require the
organization to do things differently
Considerations for a Cyber
Roadmap
Risk Management &
Implementation
Cyber Security Risk Assessment
Gap Assessment
Maturity of the Cyber Security
Program
Policies
Cyber Security Policy
Policies – ISO 27001
The following list of relevant policies is illustrative and not exhaustive:
• Information security policy
• Access control policy
• Personnel information security policy
• Physical and environmental information security policy
• Incident management policy
• Business continuity and disaster recovery policy
• Asset management policy
• Rules of behavior (acceptable use)
• Information systems acquisition, software development and maintenance policy
• Vendor management policy
• Communications and operation management policy
• Compliance policy
• Risk management policy
Policies – COBIT 5
• The appearance and length of an information security policy varies greatly
amongst enterprises. Some enterprises consider a one-page overview to be a
sufficient information security policy. In this case, the policy could be
considered a directive statement, and it should clearly describe links to other
specific policies.
• Regardless of its size or degree of detail, the information security policy needs
a clearly defined scope. This involves:• A definition of information security for the enterprise
• The responsibilities associated with information security
• The vision regarding information security, accompanied by appropriate goals and metrics and an explanation of how the vision is supported by the information security culture and awareness
• Explanation of how the information security policy aligns with other high-level policies
• Elaboration on specific information security topics such as data management; information risk assessment; and compliance with legal, regulatory and contractual obligations
• Potentially, the information security life cycle budget and cost management. Information security strategic plans and portfolio management can be added as well.
Information Security Policy
• The access control policy should cover the
following topics, amongst others:
– Physical and logical access provisioning life cycle
– Least privilege/need to know
– Segregation of duties
– Emergency access
Access Control Policy
Who should we run background checks
on?
Question
• The personnel information security policy objective includes, amongst others,
the following goals:
• Execute regular background checks of all employees and people at key positions. This goal can be measured by counting the number of completed background checks for key personnel. This can be amplified with the number of overdue background check renewals based on a predetermined frequency.
• Acquire information about key personnel in information security positions. This can be followed up by counting the number of personnel in key positions that have not rotated according to a predefined frequency.
• Develop a succession plan for all key information security positions. A possible measure is to list all the critical information security positions that lack backup personnel.
• Verify whether all information security personnel have the necessary current and pertinent skills, and related certifications. A shortage in the number of critical information security positions with proper or qualified staffing could reflect the status of the goal.
Personnel Information Security
Policy
• The objective of this policy is to provide direction regarding:
• Securing physical locations
• Environmental controls that provide capabilities to support
operations
• The scope of the policy can include:
• Facility selection:
• Criteria for selection
• Construction attributes
• Environmental control standards
• Physical access control standards (employee, vendor, visitor)
• Information security monitoring and physical intrusion detection
Physical and Environmental
Information Security Policy
• The scope of this policy covers the need to respond to incidents in a timely manner to recover
business activities. The policy should include:
• A definition of an information security incident
• A statement of how incidents will be handled
• Requirements for the establishment of the incident response team, with organizational roles
and responsibilities
• Requirements for the creation of a tested incident response plan, which will provide
documented procedures and guidelines for:
• Criticality of incidents
• Reporting and escalation process
• Recovery (including):
• Recovery time objectives (RTOs) for return to the trusted state
• Investigation and preservation of process
• Testing and training
• Post-incident meetings to document root cause analysis and document enhancements
of information security practices to prevent future similar events
• Incident documentation and closing
Security Incident Response
Policy
• Policies should take into account the specific situation in which the
enterprise exists. The content of the enterprise policies will change
depending on the context of the organization and the environment
in which it operates. This specific situation is made up by factors such
as:
• Applicable regulations unique to the enterprise
• Business operational and functional requirements
• Intellectual property and competitive data protection needs
• Existing high-level policies and the corporate culture
• Unique IT enterprise architecture designs
• Governmental regulations such as the Federal Information Security
Management Act (FISMA) in the United States
• Industry standards (PCI DSS)
Considerations When Implementing
Cyber Security Policies
Policy Lifecycle
“If you want total security, go to
prison. There you're fed, clothed,
given medical care and so on. The
only thing lacking... is freedom. ”
Dwight D. Eisenhower
How long would it take you to produce
an inventory of all assets?
Question
Inventory
What do you have?
How do you inventory?
Types of Assessments
Risk Assessment & Security Governance
Policy & Procedure, Org & Training, Network Topology
Security Access Reviews
Infrastructure & Configuration – Review & Validation
Firewalls, Wireless Networks, Virtualized (Hypervisor),
Mobile Device Management, Application
Vulnerability Assessment (Scanning)
Penetration Test (Pen Test)
Social Engineering & Security Awareness Training
Caution! Proceed with Skepticism
Unstructured technical procedures masquerading as a security
assessment
What _____ (standard, framework, requirement, guidance, etc.)are
you basing this against?
“Proprietary technology”
Compliance = best practices?
Vulnerability Assessment vs Pentest
Vulnerability Mgmt.
Asset
Identification
Vulnerability
Scan
Assess
Risk
Remediate
&
Response
Patch
Mgmt.
Monitor for Release/
Advisory
Prioritize
&
Schedule
Create
&
Test
Confirm
Deployment
Document &
Update Standards
Security
Asmt.
Identify
Threats
Assess
Exploits
Establish
Controls
Corrective Action
Plan
Monitor &
Review
• Action Plan
• Risk Acceptance Approval
• Review & Follow-up
• Identify Active
Devices/In-Scope
• Identify Open
Ports & Services
• OS Fingerprinting
• Vulnerability
Identification
• Evaluate Vulnerability
• Determine Impact
Vulnerability Assessment
Vulnerability Scan vs Assessment?
What does the deliverable look
like?
Value is in Analysis and
Assessment of Results for
Applicable Business Risk
Vulnerability Assessment
Considerations
Perspective
Internal (on-site) vs External (remote)
Credentialed?
Timing?
Announced?
Entire network or sample? Sensitive systems?
Pro Tip: Setup a Line of Communication
Why do it?
Inform: Baselining & Inventory of Issues
Assess: Good Indicator of Security Posture and Patch Mgmt.
Penetration Test
What is it?
Methodology & Approach
Personnel - Contractor
Why do it?
Best way to test the locks is to try them
Verify: Blueprint from an attacker’s perspective
More accurate assessment of risk to organization
Also a test of Detection & Response
Should we do it?
Jump in vs ease in
Evaluate Dollar Spend
Pentest Considerations
Scope
What is being tested? Int/Ext
What is winning?
May not be domain admin
Availability may be enough
Pivot Attacks – How far is far enough?
Rules of Engagement
Authorization, Timing, Shunning
PoC – “Batphone”
Limitations
DoS – Oh, you want every thing?
Social Engineering
E-mail Phishing
Baiting (Media/USB Drops)
Phishing Calls (Vishing)
Tailgating (Physical Access)
Methods Allowed
Spear Phishing, prohibited premises / schemes
Sampling
Metrics
Data Capture, Storage, Retention
Table Top Exercises
Questions?
Trip Hillman,
CISSP, CISA, CEH, GPEN, GCFE, GSNA| Senior Manager, IT Advisory Services
972.448.9276| [email protected]
Raveen Bhasin
CISM, CISA, ITIL, CSM| Manager, IT Advisory Services
972.448.9243| [email protected]