March 13, 2015 – Dr. Philip Cao

CISSP and other security domain “paper” knowledge and testing of the core cybersecurity domains is helpful. But with the rapid change in adversary tactics and new technologies, exercising against that knowledge is critical. We must exercise our skillset to maintain vigilance on our networks day-to-day.

Both government and industry cyber readiness is critical. Often there are unanticipated vulnerabilities – in our platforms, in our behaviors – that don’t rise to the surface until we exercise and learn about the strengths and gaps in our skillset. You’ve heard it before: What you don’t know, you don’t know. Many agencies have red teams who run such ongoing testing – of systems and of people. Both are important as either systems or people can be the weakest link when protecting your networks.

Palo Alto Networks strongly believes in and supports such testing for cyber readiness. Each year, we put our money where our mouth is and participate in critical exercises and related activities – two of which are going on this week. We’re excited to be participating in two events – one in the UK and one in the U.S. – where we help arm professionals on the American and European coasts:

In the UK, Palo Alto Networks is excited to be participating in this year’s Cyber Security Challenge UK. On the HMS Belfast in London, teams compete to test their cyber savviness. While this is fun stuff, it’s serious as well. The UK is prioritizing cyber, ensuring not only government but businesses throughout the UK can maintain the security of their infrastructure. Backed by GCHQ, the #CyberMasterClass15 on these last 2 days are the 48-hour culmination of more than 10 months of qualifying rounds. Thousands of participants are now just a few dozen of the UK’s most talented amateur cyber defenders. Read more about our role in the Challenge here.
In the U.S., hosted by immixGroup, “Cyber Operations Tools: Stemming the Threat through I.T.” enables U.S. government agencies to train on the current and cutting edge cyber security tools available. With the need to identify and thwart intrusive attacks, training on what is already available to help them do just that is critical. Cybersecurity professionals choose to spend anywhere from an hour to a whole day with industry experts reviewing in-depth demonstrations and otherwise gaining insight into what is available to them. See full details here.

Pacific Endeavour and Combined Endeavor, which exercise the world’s militaries for communications’ readiness, also include a cybersecurity component to understand where we’re vulnerable – across the world’s defenses – and address the issues. While Combined Endeavor will return in 2016, we are quickly getting ready for the 2015 Pacific Endeavor.

We can’t stop here. As security professionals, we know the world of cyber and the threat landscape changes literally by the minute. One exercise is insufficient – we must maintain our cyber readiness skills in meaningful ways, from ongoing education plans to testing. If you’re a CIO or CISO, what are you doing to ensure that all of your teams who have an impact on the security of your network and data have the skills that they need? And are you ensuring those skills are in place across host, data center and cloud, SCADA infrastructure and the entire network that potentially touches the public domain? How do your professionals maintain that skillset on an ongoing basis? Don’t forget the people component to your programs. (Our CSO, Rick Howard, recommends some good reading on how to keep your teams trained and ready;see one of his recent nominations to the Cybersecurity Canon.)

Don’t forget, we also arm our existing customers with the very latest cutting-edge technology they can use today – as well as Ultimate Test Drive (UTD) sessions and labs for hands-on activities, at our annual user conference, Ignite 2015, coming up in just a few short weeks. This year, we’re adding luncheon roundtables where some of the brightest minds come together to discuss their challenges with the experts who have helped numerous other customers overcome the same.

Take a minute this week to think about your own team of cybersecurity professionals – and those within your organization who don’t touch security day-to-day but need to be armed with critical baseline knowledge to keep all of your network assets protected. Make it a priority to consider career development plans and training that help them to help you and your agency or company. We are all better off for it.

[Palo Alto Networks Blog]

Internal security audits are a valuable source of information and highlight the areas that require attention, but do not be overly driven by their findings and recommendations.

Excessively strengthened security controls can impact business negatively. Security-related audit findings must be viewed in context of the relationship between business goals, the threat profile and the security controls. Security management and internal audit are two separate streams, but are driven by similar goals and fundamentally can be two sides of the same coin.

Sometimes, security controls are relevant to/appropriate for the infrastructure, but not relevant for the business itself. This results in the organization’s internal audit team finding weaker security controls within the infrastructure. In such situations, collaboration between security management, internal auditors and business must resolve the trade-off between compliance and noncompliance to the organizational security policies. Security management must be able to explain the business rationale for weaker controls to the auditors and simultaneously communicate the risks clearly to the enterprise’s management of not being compliant to the strengthened security policies. By doing so, security management ensures that the risk is understood and accepted by management.

Utilizing a risk-based approach to security management practice and internal audit can enable both streams to add value to the organization. It can help security management to identify and prioritize the more vulnerable components of the infrastructure and address those exposures appropriately. Similarly, a risk-based audit approach can help auditors to perform audits on the more critical parts of the infrastructure, understand the business requirements properly, and, reduce time and cost by conducting a more focused audit.

Enterprises’ organizational data centers increasingly are being managed by outsourcing partners. When it comes to partners’ compliance with an organization’s security policies, outsourced contracts that are poorly defined with regards to security can raise financial and fulfillment issues, putting the whole business at risk. Therefore, security management must be involved in every stage of the outsourcing lifecycle—from initial negotiations through to sign-off and maintenance of the contract. Additionally, security management must convince management, internal auditors and outsourcing partners to reach an agreement on the best solution and the way forward for the organization while mitigating the risks highlighted by the audit team.

Well-defined security management practices and their alignment with the business and internal security audit ensure the protection of organization’s information, data and IT services, and helps the organization to meet its objectives. As larger organizations increasingly adopt outsourcing strategies, the onus on the security management practitioner is growing too. With new threats emerging and technologies evolving, ensuring overall security of the organization can become a challenge from cost, process and effort standpoints if outsourcing contracts do not accommodate security policy updates too. Hence, it is critical that business management involves its security management practice when outsourcing its infrastructure.

Depending on organization’s business goals, resources and threat profile, security management can take a risk-based approach to advise which components of the infrastructure should be outsourced and yet be compliant with policies while mitigating the findings of the internal audit team. Security management and internal audit must work hand in hand to effectively secure the business. Otherwise, the two streams can become counterproductive to the cause.

Muhammad Waheed Qureshi, CISA, CIPP/IT, CISSP, ITIL V3 Foundation
IT Security Analyst, Accenture -Sweden

[ISACA]

Day: March 13, 2015

Why Cyber Readiness Activities Are Important

Security Management and Internal Audit: Becoming Two Sides of the Same Coin

Share this:

Share this: