Month: March 2017

Business leaders must take accountability for governing and managing IT-related assets within their units and functions just as they would other assets, such as those involving physical plant or human resources.

This is critical as achieving enterprise goals becomes increasingly interconnected with successfully managing and governing its technology. COBIT 5 provides the framework needed to connect business goals with IT goals while utilizing non-technical, business language, as explored in a recent ISACA podcast. John Jasinski, a COBIT certified assessor, discusses the framework’s core principles and enablers, and ways in which enterprises can successfully leverage them.

“The main purpose of the governance of enterprise IT is to achieve strategic alignment of information and related technology with the goals of the enterprise,” Jasinski said. “However, a continuing challenge for enterprises is how to achieve and maintain the alignment as stakeholder needs and enterprise goals change. The COBIT goals cascade provides context, structure and content for consistency of goals and meeting stakeholder needs.”

The COBIT 5 goals cascade provides a model to define and link enterprise goals and IT goals in support of stakeholder needs.

Decisions on how to utilize IT assets and resources should be made by business managers in an overall governance and management context, according to Jasinski. Directors should govern IT through three main tasks:

1. Evaluate the current and future use of IT;
2. Direct implementation of plans and policies to ensure the use of IT meets business objectives;
3. Monitor conformance to policies and performance against the plans.

COBIT 5, which aligns with other relevant standards and frameworks used worldwide, provides a technology-agnostic common language to more effectively address information and cyber security, risk, vendor management, cloud controls and many other challenges faced by enterprises. Distinctions between governance and management also are addressed.

“If you’re looking for context, structure and content to address your biggest digital business challenges and opportunities, you must have an understanding the COBIT goals cascade, enabling processes and the entire COBIT library,” Jasinski said. “COBIT can help you understand how to connect all the dots, and fit the puzzle pieces together. This is important stuff.”

Further ISACA insights on the topic can be found in the white paper, “COBIT 5 Principles: Where Did They Come From?”

Editor’s note: The ISACA Podcast is now available on iTunes, Google Play and SoundCloud. Listen to experts in cyber security, audit, governance and more as they explain the latest trends and issues facing professionals.

[ISACA Now Blog]

Editor’s note: Daymond John, the FUBU clothing founder, Shark Tank reality TV judge and a self-made multimillionaire, will deliver the closing keynote address at ISACA’s North America CACS 2017 conference, which will take place 1-3 May in Las Vegas, Nevada, USA. John visited with ISACA Now about what innovation means to him, his approach to taking business risks and the Shark Tank experience. The following is an edited transcript:

ISACA Now: The word ‘innovative’ is thrown around a lot. What does that mean to you, and in what ways has that kind of mindset allowed you to achieve such a high level of success with FUBU and your other ventures?
Innovation is the process of creating something new, which oftentimes is just a newer version of something that already existed. For example, to me, Twitter was a note on a pigeon’s leg hundreds of years ago. It’s just a new form of delivery.

There’s a huge misconception about innovation, which is that it starts with some grand idea. The truth is that it typically begins with people collaborating and working together on ordinary ideas that transform into something innovative.

When I started FUBU, I didn’t put three sleeves on my T-shirts. I didn’t start trying to be “innovative.” I just did what I could with what I had, and the brand became more than what even I imagined it could be.

ISACA Now: What advice would you give somebody who has a business idea that he or she is excited about but is nervous about taking that entrepreneurial plunge?
Take affordable steps. You don’t need to take great leaps of faith. Again, start with whatever you can afford to lose.

The idea is not to get over your fear of taking a plunge – it’s not to take a plunge at all. Baby steps; that way, you don’t hurt yourself too much when you run into problems. That way, you can survive your mistakes and live to take another step.

ISACA Now: What has it been like to be involved with Shark Tank, and what aspects of the show do you think resonate most with viewers?
It has been a great learning experience for me. I learn as much from the entrepreneurs as they learn from me sometimes.

What resonates with people? I think the show illustrates that the American Dream is still achievable. It shows that ordinary people can do extraordinary things if they’re willing to act on their ideas.

[ISACA Now Blog]

The overall objective for security controls is to support the organization’s services and infrastructure by identifying risks, improving the security level, and enabling rapid detection and response to security attacks.

It is also true that, in practice, no organization can place all the security controls against every cyberattack by itself. Consequently, it is now a growing practice that many organizations leverage a hybrid model for their security controls. For example, organizations put in place onsite or locally deployed security controls in the form of people, process and technology, together with cloud-based security controls.

On the other hand, risks, regulatory and compliance requirements drive business values of highly regulated industries, such as financial services and healthcare. Therefore, using a hybrid model for security controls in highly regulated industries raises compliance implications. Especially for highly regulated industries, the multitude of risk, regulatory and compliance requirements, such as PCI DSS, SOX, HIPAA and many others related to privacy and sensitive data, are increasing. There is more complexity, cost and operational overhead in the infrastructure – consequently, cloud-driven security controls are a natural choice for many organizations to address complexity, cost and operational issues. However, this also leads to new challenges to remain compliant with ever-increasing requirements.

Many compliance regulations cover specific requirements on processing personal information and cloud compliance for sensitive data. Organizations are required to ensure that their security polices, controls and IT systems remain compliant with these requirements. Selecting adequate cloud-based security control for specific data or applications would be a challenge if it is related to personally identifiable information (PII). Organizations must assess if PII needs to be part of the data processed in third-party cloud locations/data centers.

Furthermore, data may be stored and processed across different jurisdictions. It is important that while sharing data for security purposes, organizations remain compliant with pertinent laws. While choosing any particular cloud-based security control, organizations should be aware of related compliance requirements.

Organizations must also analyze technological aspects of particular compliance requirements – for example, how encryption/decryption will be performed inside or outside a particular jurisdiction, and where and how the data (alerts, logs) will be stored and handled. While decrypting traffic externally, who will have access to that decrypted data? More importantly, in the case of a breach or data leakage, how will accountability be established and how will fines be paid that are imposed by regulatory authorities?

Compliance and security are critical when protecting sensitive data and infrastructure. However, organizations often have a false sense of security, and consider their infrastructure secured if they are compliant. Instead, compliance can be considered a snapshot of overall security controls.

Being compliant does not guarantee a secured infrastructure. Many organizations make security more complex by developing separate programs for compliance and security, which leads to overlapping solutions. This adds significant expense to an overall organizational budget. Hence, for strengthened security, security initiatives must not be driven by compliance, and should go beyond particular sets of compliance requirements. Compliance and security initiatives should be tightly coupled. This will reduce cost, minimize overlapping solutions and deliver effective security infrastructure.

Compliance and security complement each other in various aspects. However, being compliant does not necessarily mean that an organization is covering all aspects of security required to protect infrastructure. There have been significant known breaches of many companies that were considered “compliant.” An effective security program integrated with an efficient compliance plan will strengthen overall security infrastructure and ensure compliance.

Muhammad Waheed Qureshi, CISA, CIPP/IT, PCIP-PCIDSS, ITIL V3, Senior IT Security Specialist, MSc (IT Security) – KTH

[ISACA Now Blog]

Recently there has been an increase in the perceived threat of the quantum computer to modern cryptographic standards in widespread use. During the last year, security agencies such as the United States Government National Security Agency (NSA) and the United Kingdom’s Communications Electronics Security Group (CESG) have called for a move to a set of quantum-safe cryptographic standards. The consensus is that today’s cyber security solutions needs to be retooled sooner rather than later, and the transition to quantum-safe security must begin now. The arrival date for a practical quantum computer is still up for debate, however, most experts believe we will see a quantum computer capable of breaking current public key cryptosystems within five to 15 years.

Recently the Quantum-Safe Security Working Group from the Cloud Security Alliance (CSA), released its ‘Applied Quantum-Safe Security’ paper, designed to provide individuals in the security industry and related fields with applicable knowledge regarding the quantum computer and its influence on cyber security. The white paper discusses how cryptographic tools must be adapted to fit specific types of data and serves as a call-to-arms for the available protection options for when the quantum computer arrives.

Digital and physical security
Computer security has primarily focused on digital security methods, however, physical security of data is also critical. Algorithms provide authentication and encryption for online communications and security of a cryptographic scheme is based on mathematics and resilience against large computing power to ensure digital security. Consider this physical security example – security breaches impacting governments and large organizations are often linked to insiders, capable of physical access not afforded the outside world. This breach occurs despite the fact that digital avenues may have been closed and intensive security protocols employed. Cryptographic keys are not only abstract random strings, but also real physical objects that should be stored in secured physical appliances. To be more quantum-safe, new tools must include all physical and mathematical security systems, each with its own practical application domain.

Impact of Cloud Computing
The ongoing move toward the cloud for all our IT needs greatly increases the reliance on data networks. Data is stored in huge data centers, and transferred between them at ever-increasing rates. The cloud model—with its associated storage and network requirements—enables a stronger and more reliable IT infrastructure. This heavily networked model also opens some serious new post-quantum threat vectors, with the most serious being a “data-vaulting” or harvesting attack where an attacker stores communications between the client and the cloud so that data can be decrypted in the future when general purpose quantum computers are available.  What we need to keep top of mind is that data stored today may already be compromised by future quantum computers, especially if the data is being monitored and stored.

Data “at rest” in enormous cloud data centers is also at risk since quantum computers will effectively reduce the keys protecting that data to half of their original strength. Additionally, post-quantum attack vectors will compromise the key management systems that generate, distribute and protect the keys needed to secure that data. Any connections and links between these large data centers must have the highest levels of protection possible. The need for quantum-safe cybersecurity is greatly compounded in a cloud-based IT environment.

As we move towards a world of quantum computers, organizations need to take the knowledge outlined in the ‘Applied Quantum-Safe Security’ paper and assess their own quantum-safe needs. Not every organization will require the same security measures and it takes time to change an infrastructure. The best way to prepare is to follow what is going on with the development of the quantum computer and its security solutions.

Since the cloud relies heavily on secure communications, quantum safety is a critical issue for the CSA. Enterprises will only use cloud services if they believe that their data is safe, both in the cloud provider servers and in transit. Quantum-safe security is a true requirement for further expansion of the cloud. The CSA encourages industry leaders to start thinking and talking about quantum safety. Quantum-related technology is evolving very quickly every day, both on the attack side and the defend side. Organizations should think about adopting some low-risk solutions now to improve infrastructure.

Cyber security technology never has and never will be a ‘one size fits all’.  There is no one universal solution that would provide the perfect security against all possible threats. What we have learned, however, is that we must prepare ourselves for emerging technology, especially when we know it’s coming. The key to quantum computer protection is the use of adaptable cryptographic tools. These tools must be tailored to fit specific types of data and specific applications. To download a copy of the full white paper, please visit here.

Frank Guanco, Quantum-Safe Security Working Group, Cloud Security Alliance

[Cloud Security Alliance Blog]

Many of us ask ourselves: “How can I differentiate myself from others in the workplace? I have plenty of drive and ambition to improve my professional skills – what can I do to demonstrate this to employers?”

Increasingly, for many, the answer is professional certifications. The Certified Public Accountant (CPA) exam and associated credential were created in 1917. Since then, mostly within the past several decades, professional certifications have flourished. One can earn certifications in just about any professional field.

As the explosive growth of our reliance on information systems continues, in all aspects of our personal and professional lives, we all need to be able to place reasonable trust in these systems. This creates an increasing demand for competent professionals to review information systems, identify areas for improved security and quality, and make cost-effective recommendations for improvement.

This is where the Certified Information Systems Auditor (CISA) certification comes in. In the realm of technology, including all the associated risks and controls, there are a variety of well-respected certifications. The holders of these certifications have demonstrated their dedication to and achievement within their profession. The CISA has historically been one of the top-paying and most respected certifications. Many employers, including some government agencies, will not consider hiring someone to perform audits of information systems and technology unless they are CISAs.

CISA is a globally recognized certification within the fields of technology audit, control and security. Of the many available technology-related certifications, CISA is the gold standard. It was created in 1978 by a non-profit organization known at the time as the EDP Auditors Association – now ISACA.

The CISA certification is ANSI-accredited and recognized globally. It has been earned by more than 129,000 professionals since inception. The exam is offered globally at computer-based testing centers.

ISACA offers a wealth of resources that candidates can use to prepare for this challenging exam, both through ISACA HQ and through exceptional review courses offered by local ISACA chapters.

After passing the exam, in order to become certified, candidates are required to provide evidence of at least five years of professional IS audit experience. Related work experience and higher education programs can provide credit against the five-year requirement. Candidates must also comply with the ISACA Code of Professional Ethics and adhere to ISACA’s auditing standards.

After obtaining the CISA, certification-holders must complete a minimum of 20 hours of training per year and a total of 120 hours in a three-year period to retain the certification.

The efforts are well worthwhile. CISA certification can be a career game-changer – now more than ever.

Being a CISA has certainly made a difference in my career. I was fresh out of IT, having spent 12 years doing everything you could possibly do in the data center, 24 hours a day, and wanted something else. I “stumbled” across something that would allow me to utilize my IT background without having people calling me in the middle of the night because the system crashed. One of the first things my new manager told me to do was “go take this EDPAA review course and pass the CISA exam.” The what course and exam?

I passed the exam after much hard work, and went on to better jobs, higher income and professional recognition. It also led me to try my hand at teaching. I volunteered to teach some sessions in our Chicago chapter’s CISA review course. That was more than 20 years ago. Not only have I been teaching CISA review ever since, the teaching experience I acquired enabled me to join the staff of Elmhurst College as an adjunct faculty member. I am now in my ninth year at the college, teaching accounting and technology courses. Recently, I have been asked to develop and present a course in IT auditing at a major university in Chicago.

None of this would have been possible without my CISA. Being a CISA will open doors for you that you may not presently envision.

Editor’s note: An ISACA webinar, “How to Prepare for and Pass the Certified Information Systems Auditor (CISA) Examination,” will be offered 14 March. To find out more, visit http://www.isaca.org/Education/Online-Learning/Pages/Webinar-How-to-Prepare-for-and-Pass-the-CISA-Examination.aspx.

Ken Schmidt, CISA, CISSP, CIA, CPA, Consultant with R&M Consulting

[ISACA Now Blog]