Security Governance Flashcards
AAA
Five elements = foundational concepts for any security program:
Identification Authentication Authorization Auditing Accounting
Governance vs Management
- Governance = C Level Execs (not me!)»_space; Ultimately Liable
- Set company objectives
- Set risk appetite (aggressive - neutral - adverse)
- Monitor performance and compliance
- Management (this is me!)
- Plans, builds, runs, monitors objectives set by Governance
- Risk tolerance (how are we going to work with the set Risk Appetite..)
4 elements of a corporate security policy:
- [ ] Policy = broad security statements - Mandatory
- [ ] Standards (Baseline) = specific use of technology (all laptop are Win10, 64Gbit, 8gig RAM, etc) - Mandatory
- [ ] Guidelines = recommendations > used then there is not a Procedure – Non Mandatory
- [ ] Procedures = step by step instructions. – Mandatory
Baselines (Benchmarks) = Mandatory – minimum requirements / server hardening, etc.
IAAA
- Identification
- Authentication
- Type I = password
- Type II = ID, smart card, PIN, cookie on PC, etc.
- Type III = biometric
- Authorization
- What are you allowed to access?
- DAC, MAC, RBAC, ABAC
- What are you allowed to access?
- Accountability
- Link activity to subject identity (non-repudiation)
OCTAVE
Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE)
A comprehensive evaluation method that allows an organization (i.e., self directed) to identify the information assets that are important to the mission of the organization, the threats to those assets, and the vulnerabilities that may expose those assets to the threats.
COBIT
Control
OBjectives for
Information
and related Technologies (COBIT)
GOALS FOR IT — stakeholder needs are mapped down to IT related goals.
The goal of the COBIT framework is to provide a common language for IT professionals, business executives and compliance auditors to communicate with each other about IT controls, goals, objectives and outcomes.
TIP: is the most commonly used framework for achieving compliance with the Sarbanes-Oxley Act (SOX).
COSO
Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Goals for ENTIRE ORG - Outlines how you can can develop a strong, effective internal control system.
The original COSO framework was developed in 1992, with the most recent version published in 2013. To understand the framework, you must understand what it covers. According to COSO, internal control:
Focuses on achieving objectives in operations, reporting and/or compliance
Is an ongoing process
Depends on people’s actions, not merely written policies and procedures
Provides assurance senior management of security to a reasonable degree
Can be adapted to the needs of the whole organization as well as each department, unit or process
ITIL
Information Technology Infrastructure Library
IT Services Management (ITSM).
ITIL describes processes, procedures, tasks, and checklists which are neither organization-specific nor technology-specific, but can be applied by an organization toward strategy, delivering value, and maintaining a minimum level of competency.
FRAP
Facilitated Risk Analysis Process
a qualitative approach, using brainstorming techniques to identify risks. Estimated risk assessments are then made (probability x impact) and appropriate measures determined.
Analyzed one business unit, application or system at a time in a roundtable brainstorm with INTERNAL employees. The impact is analyzed and the threats and the risks are prioritized.
ISO 27001
The objective of the standard itself is to “provide requirements for establishing, implementing, maintaining and continuously improving an Information Security Management System (ISMS)”
ISO 27002
It basically outlines hundreds of potential controls and control mechanisms, which may be implemented via ISO 27001, in theory, subject to the guidance provided within ISO 27001.
The standard “established guidelines and general principles for initiating, implementing, maintaining, and improving information security management within an organization”. The actual controls listed in the standard are intended to address the specific requirements identified via a formal risk assessment.
ISO 27004
Provides metrics for measuring the success of your ISMS.
provides guidance on the development and use of measures and measurement for the assessment of the effectiveness of an implemented information security management system and controls, as specified in ISO 27001.
It is intended to help an organization establish the effectiveness of its ISMS implementation, embracing benchmarking and performance targeting within the PDCA cycle.
ISO 27005
The standard provides guidelines for information security risk management (ISRM) in an organization, specifically supporting the requirements of an information security management system defined by ISO 27001 (a standards based approach).
The ISO 27005 standard comprises 55 pages, and is applicable to all types of organization. It does not provide or recommend a specific methodology. This will depend upon a number of factors, such as the actual scope of the Information Security Management System (ISMS), or perhaps the industry/commercial sector.
ISO 27799
Directives on how to protect PHI (protected health info)
By implementing ISO 27799:2016, healthcare organizations and other custodians of health information will be able to ensure a minimum requisite level of security that is appropriate to their organization’s circumstances and that will maintain the confidentiality, integrity and availability of personal health information in their care.
Seven steps to implement a data classification scheme:
- Identify the custodian & define their responsibilities
- Specify the evaluation criteria for how the data will be classified and labeled
- Classify and label each resource (the owner usually does this with a reviewer)
- Document any exceptions discovered, and then integrate them
- Select security controls that will be applied to each classification level
- Specify the procedures for Declassifying resources and how to transfer custody
- Create enterprise=wide training on the classification system created
