info security & pci(original)
TRANSCRIPT
Skeletal Elements of your Organization’s IT Systems
Deter, Detect and Defend Against Data Breaches
Information Security Program &
Payment Card Industry Data Security(PCI DSS)
Compliance for Your Business
Security and ComplianceNot Synonymous
• Regulatory Compliance helps to improve Security
• Improved Security helps to achieve Compliance
77 Million Users10 Million Credit Card Compromised
Accounts
Losses ???
Millions of Names and Email Addresses of over 2,500 Major
Companies
Consequences??
94 Million Compromised Accounts
83 Million Dollars in Losses
4 Million Compromised Accounts
100’s of Compromised Accounts
50,000+ Credit Card Transactions Processed Yearly
20,000+ Credit Cards Numbers
The High Cost of Data Breaches
Average Cost Per Record Breached $204
Average Cost Per Breach $6.75 million
Range of Total Cost Per Breach$750,000 to almost $31 million
Source: Ponemon Institute, Fourth Annual Cost of Data Breach Study, January 2009
Essentials Elements of a Successful Information Technology Security
Program
COBIT Standards Risk Assessment
• Control Objectives for Information and related Technology (COBIT) is a set of best practices (framework) for information (IT) management created by the Information Systems Audit and Control Association (ISACA), and the IT Governance Institute (ITGI) in 1996.
• Proactively identify IT related risks that require mitigation strategies, including anticipating future regulatory and external reporting expectations.
• Aid in the overall IT Governance Activities and support the business’s operational risk initiatives.
• Sound business decisions are based on timely, relevant and concise information.
• Decision making is more effective because COBIT aids management in: o Defining a Strategic IT Plano Defining the Information Architecture o Acquiring the necessary IT hardware and software to execute an
IT strategyo Ensuring Continuous Service (BCP/DR)o Monitoring the Performance of the IT systemso Provides a foundation upon which IT related Decisions and
Investments can be based• COBIT Executive Summary consists of an Executive
Overview which provides a thorough awareness and understanding of COBIT's key concepts and principles.
Management Benefits
• Helps identify IT control issues within a company’s IT infrastructure
• Corroborate their audit findings• COBIT is the framework used by most
companies to comply with Sarbanes-Oxley.
Auditors Benefits
• Assurance that the IT applications that aid in the gathering, processing, and reporting of information comply with a recognized standard
• Implies controls and security are in place to govern the IT processes
End Users Benefits
COBIT's Four Domains
• Planning and Organization• Acquisition and Implementation• Delivery and Support• Monitoring
Plan and Organize
• Covers the use of technology and how best it can be used in a company to help achieve the company’s goals and objectives.
• Highlights the organizational and infrastructural form IT is to take in order to achieve the optimal results and to generate the most benefits from the use of IT.
Control Objectives for the Planning & Organization Domain
PO1 Define a Strategic IT PlanPO2 Define the Information ArchitecturePO3 Determine Technological DirectionPO4 Define the IT Processes, Organization & RelationshipsPO5 Manage the IT InvestmentPO6 Communicate Management Aims & DirectionPO7 Manage IT Human ResourcesPO8 Manage QualityPO9 Assess and Manage IT RisksPO10 Manage Projects
Acquire and Implement
• Identifying IT requirements, Acquiring the Technology, and Implementing it within the company’s current business processes.
• Addresses the development of a maintenance plan that a company should adopt in order to prolong the life of an IT system and its components.
Control Objectives for the Acquire & Implement Domain
AI1 Identify Automated SolutionsAI2 Acquire and Maintain Application SoftwareAI3 Acquire and Maintain Technology InfrastructureAI4 Enable Operation and UseAI5 Procure IT ResourcesAI6 Manage ChangesAI7 Install and Accredit Solutions and Changes
Delivery and Support
• Execution of the applications within the IT system
• The support processes that enable the effective and efficient execution of the IT systems
• Support processes include security issues and training
Control Objectives for the Delivery & Support Domain
DS1 Define and Manage Service LevelsDS2 Manage Third-party ServicesDS3 Manage Performance and CapacityDS4 Ensure Continuous ServiceDS5 Ensure Systems SecurityDS6 Identify and Allocate CostsDS7 Educate and Train UsersDS8 Manage Service Desk and IncidentsDS9 Manage the ConfigurationDS10 Manage ProblemsDS11 Manage DataDS12 Manage the Physical EnvironmentDS13 Manage Operations
Monitor and Evaulate
• Deals with a company’s strategy in assessing the needs of the company and whether or not the current IT system still meets the objectives for which it was designed and the controls necessary to comply with regulatory requirements
• Covers the issue of an independent assessment of the effectiveness of IT system in its ability to meet business objectives and the company’s control processes by internal and external auditors.
Control Objectives for the Monitor & Evaluate Domain
ME1 Monitor and Evaluate IT ProcessesME2 Monitor and Evaluate Internal ControlME3 Ensure Regulatory ComplianceME4 Provide IT Governance
Further Information:
Information Systems Audit and Control Association
(ISACA)
http://www.isaca.org
Annual Security Reporting
• Introduction o Brief Synopsis of IT Security Yearly Activities
• IT Security Activities o Policy/Standards Developmentso Security Hardware and/or Software
Implementations• Next Year’s IT Security Goals• COBIT Internal Risk Assessment
Information Security Policy
• Purpose • Objectives• Development and Implementation• Responsibility • Assessment and Management of Risk • Protection and Destruction of Sensitive Information• Monitoring, Testing & Updating of the Information
Security Program• Monitoring of the Information Security Program• Overseeing Service Provider Arrangements • Annual Status Reporting and Policy Review
Safeguarding Customer Information Policy
• Policy Statement • Statement of Responsibilities • Computer Security• Physical Security • Copyrights and License • Monitoring • Violations
Access Control Policy
• User Access Management• Access Control Rules • Access Control Request Form • File System Control • Login Banner Notices
Data Classification, Retention and Disposal Policy
• Sensitivity Guidelines • Sensitive Information Retention & Disposal
Guidelines • Credit Card Information Retention & Disposal
Guidelines
Intrusion Response Plan • Incident Severity • Incident Declaration • Document Recovery Steps • Analyze the Intrusion • Recover from the Intrusion • Intrusion Response Checklist
• Customer Notice• Incident Declaration • Response Program• Recovery Steps • Sample Call Staff Instructions• Sample Call Staff Telephone Script Instructions• Customer Call Record Form • Suggested Communication to Regulators• Sample Customer Notification Letter • Identity Theft Bureaus & Agencies• Assessment of Unauthorized Access to Sensitive • Customer Information • Incident Response Log
Unauthorized Access to Customer Information Plan
Additional Items
• Password Policyo Compliance Requirementso Password Integrity Guidelineso Password Protection Standardso Employee Acknowledgment
• Vendor Management Programo Risk Assessment & Mitigationo Request for Proposalo Due Diligence o Implementation
Further Information & Sample Polices/Guidelines:
Systems And Network Security
http://www.sans.org
National Institute of Standards and Technology(NIST)
www.nist.gov
Payment Card Industry Data Security(PCI DSS)
Compliance for Your Business
A Security Breach and Subsequent Compromise of Cardholder Data could have far-reaching Consequences
for Your Business including:
• Regulatory Notification Requirements• Loss of Reputation• Loss of Customers• Potential Financial Liabilities (Regulatory
and Other Fines and Fees)• Litigation
Compliant Organizations Experience Fewer Breaches
• 32% of Compliant Organizations Never Had a Breach vs. 12% of Non Compliant Organizations
• 69% of Compliant Organizations Reported at Least One Breach vs. 88% of Non Compliant Organizations
We all can help to Deter, Detect and Defend
against ID Theft with these 5 easy steps:Take Stock – Know Where the Info Is
Scale Down – Keep Only What is Needed
Lock It – Protect the Info We Do Keep
Pitch It – Properly Dispose of What We Don’t
Plan Ahead – Create a Plan to Response to a Breach
does not manage compliance programs and does not impose
any consequences for non-compliance.
may have their own compliance initiatives, including financial or operational consequences to certain
businesses that are not compliant.
The Road to PCI DSS Compliance
is dependent on the
Merchant Level &
Self Assessment Questionnaire (SAQ)
Validation Types
Merchant Levels based on
Credit Card Transactions Processed
• Level 1 – Over 6,000,000 per year• Level 2 – 1,000,000 to 6,000,000 per
year• Level 3 – 20,000 to 1,000,000 per
year• Level 4 – Fewer than 20,000 per year
Self Assessment Questionnaire (SAQ) Validation Types
SAQ A
• Card Not Present Merchants• All cardholder data functions
outsourced• Never applies to face to face
merchants• 13 Questions & Attestation
SAQ B
• Imprint Only Merchants• No electronic cardholder data
storage• Standalone dialout terminal
merchant with no date storage• 29 Questions & Attestation
SAQ C-VT
• Merchants with web based virtual terminals
• No electronic cardholder data storage
• 51 Questions & Attestation
SAQ C
• Merchants with Payment Applications connected to Internet
• No electronic cardholder data storage
• 40 Questions & Attestation
SAQ D
• All Merchants not included in other SAQ descriptions
• All service providers defined by payment brand as eligible to complete a SAQ
• 288 Questions & Attestation
Maintain Information Security PolicyRequirement
12SAQ A,B,C,D
Regularly Test Security
Systems/ProcessesRequirement
11SAQ C,D
Track & Monitor Access to Network Resources & CHD
Requirement10
SAQ C,D
Restrict Physical Access to CHDRequirement
9SAQ A,B,C,D
Assign Unique ID for each person w/computer access
to CHDRequirement
8 SAQ C,D
Restrict CHD Access to Business Need-to-Know
Requirement 7
SAQ B,C,D
Develop & Maintain Secure
Systems/ApplicationsRequirement
6SAQ C,D
Use & Regularly Update Anti-Virus Software
Requirement5
SAQ C,D
Encrypt Transmission of CHD
across Public NetworksRequirement
4SAQ B,C,D
Protect Stored CHD Requirement
3SAQ B,C,D
Change All Defaults Passwords
& Security ParametersRequirement
2SAQ C,D
Install & Maintain Firewall Configuration
to protect CHDRequirement
1 SAQ C,D
Security Requirements
for PCI DSS
Compliance
Prioritized Approach to Pursue PCI DSS Compliance
• 1. Remove Sensitive Authentication Data and Limit Data Retention (Requirements 1,3,9)
• 2. Protect the Perimeter, Internal and Wireless Networks (Requirements 1,2,4,5,11,12)
• 3. Secure Payment Card Applications (Requirements 2,6)
• 4. Monitor and Control Access to Systems(Requirements 7,8,10,11)
• 5. Protect Stored Cardholder Data (Requirements 3,9)
• 6. Finalize remaining Compliance Efforts and Ensure all Controls are in Place (Requirements 1,6,10,11,12)
https://www.pcisecuritystandards.org/documents/Prioritized_Approach_PCI_DSS_version1_2.xls
Prioritized Approach to Pursue PCI DSS Compliance Tool
PCI Compliance in its simplest form is; if you don’t need the cardholder data - then don’t store it, if you store it, you must protect it.
Further Information on
• Complete PCI DSS Specification• Prioritized Approach Guidance & Tool• Other Supporting Tools and
Documentation
http://www.pcisecuritystandards.org
Questions??