Year: 2016

Posted on

New E-book Spells Out GEIT Implementation

Technology can be a double-edged sword for business. On the one hand it can provide extraordinary advantages, and on the other it can present potential risks. A new ISACA e-book, Getting Started With GEIT: A Primer for Implementing Governance of Enterprise IT, spells out how to get greater efficiency and effectiveness out of IT assets and make sure their use is aligned with larger, enterprise-wide strategic aims.

The 52-page book details how implementing a Governance of Enterprise IT (GEIT) system can provide numerous benefits to a business, including lower costs, increased control, improved resource efficiency and effectiveness, and better strategic alignment and risk management.

The book (free to ISACA members, $15 for non-members) is aimed at professionals who are new to GEIT and those who are implementing a GEIT system.

GEIT For Lower Capital Costs, Greater Innovation
A strong GEIT system can translate into lower costs for capital, along with other benefits such as greater organizational innovation and entrepreneurship. It can also mean paying lower interest in the capital markets.

While a well-implemented GEIT system can bring major benefits, poorly implemented GEIT will fail to deliver those benefits while wasting the resources required for implementation. To address that concern Getting Started With GEIT spells out the specific steps needed for a successful implementation that meets enterprise goals and delivers value.

7 Steps to Implement GEIT
What is particularly helpful about the step-by-step approach is that practitioners can implement some quick-hit improvements and realize much of the value from GEIT without having to become a framework expert.

The guide includes the 7 steps to implement GEIT and supports them with examples of benefits to help gain senior leadership buy-in. It also presents specific objectives for executing technology projects and managing technology investments.

The 7 GEIT implementation steps include:

  1. Initiate the program
  2. Define problems and opportunities
  3. Define a roadmap
  4. Plan the program
  5. Execute the plan
  6. Realize benefits
  7. Review effectiveness

Every chapter includes a checklist of action items to help with the implementation of each step. An example of this comes at the end of the first chapter, which explains what GEIT is and the how-tos for creating a business case and obtaining buy-in:

“Determine which benefit(s) of GEIT are most appealing to the organization. Document why this is most appealing and what additional benefits may be realized from implementing GEIT in the enterprise.”

As a convenience, all of these action items have been gathered into a single document that is available for download below. As part of the e-book release ISACA is also offering a quick reference infographic detailing key points from each of the five chapters, which is also available below.

Getting Started With GEIT Extras
The e-book concludes with two detailed case studies on applying GEIT to two scenarios, including a manufacturing enterprise using GEIT to evaluate stakeholder requirements and determine how to best satisfy them. The other scenario has a large multinational enterprise that wants to ensure its rapid expansion and adoption of advanced IT delivers the expected value and manages significant new risk.

Finally, the book includes a section of tips for conducting effective GEIT implementation interviews for a strong starting point in the GEIT implementation work.

To download or purchase Getting Started With GEIT: A Primer for Implementing Governance of Enterprise IT e-book click here. To download the accompanying action item checklist click here. For the quick reference infographic, click here.

Peter Tessin, Technical Research Manager, ISACA

[ISACA Now Blog]

Posted on

Cloud Security Alliance Big Data Working Group Releases ‘100 Best Practices in Big Data’ Report

The Cloud Security Alliance (CSA), today announced the release of the new handbook from the CSA Big Data Working Group, outlining the 100 best practices in big data security. The Big Data Security and Privacy Handbook: 100 Best Practices in Big Data Security and Privacy strives to detail the best practices that should be followed by any big data service provider to fortify their infrastructure. The handbook presents 10 compelling considerations for each of the top 10 challenges in big data security and privacy, which the group previously outlined in the Top Ten Big Data Security and Privacy Challenges white paper.

The term “big data’” refers to the massive amounts of digital information companies and governments collect about human beings and their environment. The amount of data generated is expected to double every two years from 2500 exabytes in 2012 to 40,000 exabytes in 2020. Large-scale cloud infrastructures, diversity of data sources and formats, the streaming nature of data acquisition and high-volume, inter-cloud migration all play a role in the creation of unique security vulnerabilities.

“This is an important initiative for the cloud community as new security challenges have arisen from the coupling of big data with public cloud environments. As big data expands through streaming cloud technology, traditional security mechanisms tailored to secure small-scale, static data on firewalled and semi-isolated networks are inadequate,” said J.R. Santos, Executive Vice President of Research for the CSA. “Security and privacy issues are magnified by this volume, variety and velocity of big data. This handbook serves as a comprehensive list of best practices for companies to use when securing big data.”

The handbook provides a roster of 100 best practices, ranging from typical cybersecurity measures, such as authentication and access control, to state-of-the-art cryptographic technologies. It addresses why these security measures are needed as well as how they can be implemented.

For more information on the Cloud Security Alliance, please visit our website. To download the new best practices handbook visit https://cloudsecurityalliance.org/download/big-data-security-and-privacy-handbook/.

About Cloud Security Alliance
The Cloud Security Alliance (CSA) is the world’s leading organization dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment. CSA harnesses the subject matter expertise of industry practitioners, associations, governments, and its corporate and individual members to offer cloud security-specific research, education, certification, events and products. CSA’s activities, knowledge and extensive network benefit the entire community impacted by cloud — from providers and customers, to governments, entrepreneurs and the assurance industry — and provide a forum through which diverse parties can work together to create and maintain a trusted cloud ecosystem. For further information, visit us at www.cloudsecurityalliance.org, and follow us on Twitter @cloudsa.

Contacts
Kari Walker for the CSA
ZAG Communications
703.928.9996
kari@zagcommunictions.com

[Cloud Security Alliance Research News]

Posted on

Process Improvement for Management of IT-related Processes

Most organizations have objectives for quality and improvement. Enterprises want employees to continually look for opportunities that fuel effectiveness and strengthen the company. The improvement theme is both a nice to have and a basis to survive, providing a direction to get better and a model for personal behavior and work culture. The basic improvement model is one of common sense, similar to those used in psychology and coaching. It can be teamed with any process reference model.

The improvement model has evolved over time with influences from many thought leaders, good practices and industries, including Dr. Edwards Deming, a key influence with the Plan-Do-Check-Act (PDCA) cycle (preferred over Guess-Do-Pray-Hope); John Kotter with organizational change; international standards such as those from the International Organization for Standardization (ISO), ISO 90001 for Quality, ISO 20000 for IT Service Management, ISO 27001 for IT Security; COBIT, ITIL, the National Institute of Standards and Technology (NIST) and Project Management Body of Knowledge (PMBOK), all of which incorporate or support improvement themes; and, Six Sigma programs, which have an improvement phase and so should you.

How do you do it? You can hire a Six Sigma person or you can do it yourself. It’s not difficult. For most of you, read a book or gain some awareness. ISACA offers a book titled COBIT® 5 Implementation in the COBIT product family. While the focus is on implementing governance of enterprise IT, one could add an alternative title:  Process Improvement for Management of IT-related Processes.

The book highlights a cycle of phases and component parts, all building on good practices. The 7 phases of the COBIT® 5 Implementation lifecycle include:

  1. What Are the Drivers?
  2. Where Are We Now?
  3. Where Do We Want To Be?
  4. What Needs To Be Done?
  5. How Do We Get There?
  6. Did We Get There?
  7. How Do We Keep the Momentum Going?

Each phase is supported by 3 components:  program management (PM), change enablement (CE) and continual improvement (CI). This is a good practice approach.

As an example, the components of the first 3 phases include:

  1. What are the drivers?
    1. CI – Recognize the need to act
    2. CE -Establish a desire to change
    3. PM – Initiate a program
  2. Where we are today?
    1. CI – Assess the current state
    2. CE – Form a team
    3. PM – Define opportunities or challenges
  3. Where do we want to be?
    1. CI – Define the target state
    2. CE – Communicate the desired outcome
    3. PM – Define a roadmap

Each component has suggested or potential key activities, inputs and outputs. Warning:  If you miss addressing any of these phases or components, or get overly creative with the order, you might increase the risk of failure. Like software, avoid customization.

Where to Start?
Where to start? Pain points and triggers are obvious. To gain a quick win and show how it is done, consider focusing on one process—your favorite process.

The COBIT 5 Implementation book gives you a starting place—allowing you to move forward with confidence on a solid foundation. Think of it as a playbook or recipe. Project managers like the 3 components as they address areas of frequent challenge, such as change enablement. Copy and save this model into your head and project templates.

COBIT 5 Implementation offers all of us consistent context and structure for current or potential activities. It contributes to the success of you and your team. The focus is on people—all of us; up, down and across the organization in any business line.

Editor’s note:  John Jasinski holds all ISACA certifications and certificates and teaches COBIT. He is an ISACA member and has been an active volunteer at local and international levels since 2006. COBIT 5 Implementation is available as a free PDF download for ISACA members. The printed hard copy is available from the ISACA bookstore. John suggests you buy a bunch and share them with your team. COBIT is currently celebrating its 20th anniversary. Learn more here.

John Jasinski, CGEIT, CRISC, CISA, CISM, ITIL, Business Process Consultant

[ISACA Now Blog]

Posted on

Tech Docs: Traps v3.4 Has Arrived

Hate your antivirus (AV) solution? You are in luck! Earlier this month we announced Traps v3.4, the next step in the evolution to replace traditional antivirus software.

This release includes several major features that enable you to take the plunge to eliminate traditional antivirus.

Trusted Signers

To ensure your legitimate files are never prevented from executing on the endpoint, Traps advanced endpoint protection now evaluates whether files are signed by a trusted signer. The list of trusted signers is based on the official trusted signer list in WildFire. That means executable files that are signed by trusted signers are exempt from additional analysis and verdict evaluation. This feature is useful in situations where unknown executable files, such as new software updates for the operating system or for applications, are signed by a trusted signer but have not, yet, been analyzed by WildFire.

Local Analysis

Local analysis uses a statistical model that was developed using machine learning on WildFire threat intelligence. Traps uses local analysis to examine hundreds of characteristics associated with an unknown executable file to determine if the file is likely to be malware. With this feature, Traps quickly analyzes and assigns a local verdict to an unknown executable file when the endpoint is offline or while waiting for the official verdict from WildFire. Traps continues to use the local verdict to block or allow the execution of the unknown executable file until the agent receives an updated verdict from the ESM Server.

Malware Remediation

Traps now takes malware protection one step further with a new capability to transparentlyquarantine malicious executable files on the endpoint. To determine if an executable file is malicious and should be quarantined, Traps uses information from the following sources: WildFire threat intelligence, local analysis, and hash control policy. When malware is identified, Traps notifies the user about the quarantined file (if you enabled user alerts), removes the malware from the local folder or removable hard-drive, and stores the file in a local quarantine folder. With this feature, you can also restore a quarantined file to its original location.

Want More?

Here are a few resources to add to your Traps v3.4 reading list!

  • New Features Guide: Your go-to resource for all the new features in Traps v3.4.
  • Administrator’s Guide: Contains installation procedures and configuration workflows to get you up and running quickly.
  • Release Notes: Provides important information about the Traps advanced endpoint protection v3.4 software including known issues and limitations.

Pro tip: On the documentation search, use the facet to filter results for only documentation about Traps v3.4.

[Palo Alto Networks Research Center]

Posted on

AutoFocus: Your Answer to Actionable Threat Intelligence

Threat intelligence involves learning about new attacks, adversaries, campaigns, and malware families through distinct pieces of information often referred to as indicators of compromise, or IOCs. The more we make relevant information available to network defenders, the better the odds are that they will find answers to their questions. One key consideration for leveraging threat intelligence to improve an organization’s security posture is that it must be readily able to enforce new prevention-based controls.

Threat intelligence has traditionally been used by security operations centers’ incident response teams. As security awareness in organizations of all sizes begins to expand, most people realize that they want to know which alerts should be made a priority and which threats the organization is subject to. Who are the threat actors? There is a big difference between commodity and targeted attacks. Answering these questions can lead you to implementing new controls that allow you to better secure the environment.

Enter AutoFocus. AutoFocus is the Palo Alto Networks threat intelligence service, which provides a window into billions of samples and threat artifacts collected from and correlated within our Threat Intelligence Cloud, including results from global WildFire data. The information allows security teams to quickly identify targeted that’s and pivot to relevant IOCs quickly, accelerating their analysis and response workflows. AutoFocus complements the Palo Alto Networks Next-Generation Security Platform, enabling searches from your Palo Alto Networks appliances into AutoFocus, or from AutoFocus into your Palo Alto Networks appliances. There is also an API that interacts with the data and feeds third-party security solutions. This level of usability means that a threat research team isn’t necessary to make use of the data. Anyone responsible for handling security incidents in the environment can make use of the data in AutoFocus.

In this post, we will explore a use case that will enable security operators to quickly identify what happened during an incident and to take action.

Searching From AutoFocus

Unit 42 is the Palo Alto Networks threat intelligence team that provides AutoFocus users access to world-class human intelligence, even if they don’t have a research team of their own. Unit 42 contributes to the AutoFocus community by researching malware families, campaigns, adversaries, exploits and malicious behaviors, and by compiling indicators of compromise into durable tags to identify malicious events.

To get started, it may be interesting to navigate through some of the research already done by Unit 42. Let’s assume Locky is something we have not investigated yet. By selecting this tag, we can get information about the research done by Unit 42 on this malware family.

Drilling into Locky provides us with all the search attributes associated with this tag. We can see that Locky is a ransomware payload, which is used to encrypt sensitive files or systems, then hold them until the victim pays the attacker. We also see that Locky is typically dropped byDridex actors, which gives us a better idea of who is likely to be behind the attack. Ransomware is typically more of a commodity type of crime, in which the attacker’s goal is to get as many systems encrypted as possible, driving profits from their malicious activity.

Selecting “Add Tag” to “Search” will bring up the results of a query that includes samples, sessions, statistics, and much more information about the malware. You can search through samples of data that came from devices owned by your organization via WildFire. You can also see samples made public by other organizations, dramatically broadening the lens.

This allows you to gain visibility into threats not directly observed by your organization, taking advantage of the community of WildFire and AutoFocus users. In this case, we will pivot into “Public” samples to further analyze the Locky ransomware.

Finding over 7,000 variants seems daunting. It also demonstrates that file-hash-only identification is no longer practical. By drilling into the samples, we can see that there are patterns in the malware. These are the same similarities that Unit 42 used to create the tag. The infrastructure for the malware and most of what it does to the system once installed are the same each time it is deployed – primarily, that the file is obfuscated by changing a few bits to avoid hash-based detection.

By drilling into one of the hashes, we can see everything that WildFire observed when detonating this malicious software on Windows® XP and Windows 7. From there we can drill into individual indicators of compromise and search our own appliances for evidence, as well as create new protections for specific high-value IOCs, such as IP address, DNS or URLs.

The remote search function allows you to add search filters specifically designed for Palo Alto Networks security appliances. You will first be prompted to choose which of your appliances to search. Finally the console for the specified appliances will launch with the search filters already in place.

In this case, we have selected our Panorama instance. Since the logs from all security appliances are being forwarded, we will have visibility into the entire network with one search.

When we search through all the various types of logs in Panorama, we are looking for a specific command and control server as the destination. The good news is that we did not find the command and control server for Locky in the network, meaning we have confirmed there is no active infection within the organization.

[Palo Alto Networks Research Center]

English
English
Exit mobile version