5.2 Regulations and Standards Flashcards
GDRP
General data protection regulation- strengthens the regulation of users data in the uk or company’s processing uk data
DPO
Data protection officer ensures company compliance with GDPR
PCI DSS
Payment card industry data security standard- standard for protecting credit card processing
It is a global standard
PCI DSS level 1
Company processes over 6 million credit cards a year
Validation requirement- annual on-site assessment for compliance by a qualified exit security assessor (QSA)
Compliance validation- submission of annual report on compliance and quarterly net scans
PCI DSS Level 2
Company processes 1 to 6 million transactions
Validation-annual self-assessment questionnaire(SAQ) or onsite audit from a QSA
Compliance-quarterly net scans
PCI DSS Level 3
20,000 to 1 million transactions
Validation-Annual SQA or onsite by QSA
Compliance- quarterly net scans
PCI DSS Level 4
Processes u under 20,000 transactions
Validation- annual SQA or on-site by QSA
Compliance-maybe quarterly net scans
Security frameworks
Help you to secure a company network with guidelines and best practices
CIS framework
Center for internet security- framework to improve security posture designed to address high priority security issues.
3 implementation groups:
Basic cyber hygiene-first basic control steps
Foundational cyber hygiene-builds on basic
Advanced cyber hygiene-most advanced cyber tools setting up detecting and alerting security events
NIST RMF
National Institute of standards and technology risk management framework-mandatory framework for us federal agencies and companies handling federal data.
Six step process-
1.)categorize(classify data processed stored and transmitted by systems based on cia triad)
2.)select- identify and choose security controls based on determined security levels
3.)implement-implement controls
4.)Asses- check if controls working properly
5.)Authorize-Decide if systems and controls will be put into production environment
6.)monitor-Regularly monitor
NIST Csf
NIST cyber security framework-Commercial company NIST framework
3 areas in framework-
1.) Framework core-
Identify-risks,processes,assests
Protect-assets
Detect-threats
Respond
Recover
2.)framework implementation-Tiers used to describe organization security posture 4 tiers
Tier 1-partial-company has as hoc approach and little knowledge of risk and strategy
Tier 2-risk informed- aware of risks and may have a documented approach to events
Tier 3-Repeatable-well document and repeatable approaches to events
Tier 4- company had repeatable and well documented approaches to event and is very adaptive to new events
3.) framework profile alignment of standard, guideline and regulations to framework core
ISO/IEC
International organization for standardization/International electrotechnical commission
4 important standards
ISO/IEC 27001
ISO/IEC 27002
ISO/IEC 27701
ISO/IEC 3100
ISO/IEC 27001
International organization for standardization/ International electrotechnical commission 27001-Concerned with Information security management systems (isms) which protect sensitive data with processes, policies and procedures
Uses plan-do-check-act
Plan-establish isms and define objectives
Do- implement isms
Check-monitor isms
Act-Take corrective and preventative actions to improve isms
ISO/IEC 27002
Provides guidance of best practices for implementing controls on isms , this acts as more of a guide for bettering isms while 27001 is set of requirements and structure for isms for a company to get the 27001 certification.
ISO/IEC 27701
Provides guidelines and a framework for establishing,implementing and maintaining a privacy information management system (PIMS)-focused mainly on jsut privacy for data rather then informations security as a whole
