Category: Cyber Security

There is no question about it, DevOps is coming to the forefront in enterprise. A 2014 survey from Rackspace found that 79 percent of those they surveyed plan to implement DevOps practices or approaches by the end of 2015. Meaning, most shops now are DevOps shops. For ISACA members, this can have a significant impact—security, assurance, risk, and governance impacts aplenty.

Security pros will need to understand how DevOps can impact existing security controls; some controls (automated static or dynamic application security testing controls—or even manual code reviews) may need to be adjusted in light of faster release cycles and new tools. There might also be hidden security advantages as the transition takes place. As tools like Puppet, Chef, Salt, and others allow them to better meet historical challenges: for example, by leveraging those tools to perform security hygiene tasks (e.g. patching, automated configuration validation, etc.).

Assurance pros likewise will need to understand the impacts of DevOps as it directly impacts them as well. In many DevOps shops, developers can affect changes to the production environment through the use of automated tools. To understand whether this undermines important goals like segregation of duties, assessors will need to understand the deployment model. Is segmentation of duties undermined? Or, is it improved by virtue of automated (and thereby non-repudiable) recordkeeping? The answer will depend on implementation, which is why it is important that practitioners know what questions to ask.

Risk professionals will need to understand how their organization’s overall risk equation is impacted by the move too: there might be new technical risks that arise and other existing ones that are mitigated. There are business risks to consider as well, like what the potential impact on competitiveness our organization should not adopt while the competitors do.

Lastly, there is an impact on governance. Folks who are responsible for overseeing the IT governance program for their organization will need to consider how existing governance structures will extend into DevOps processes and tools. How will DevOps impact those structures and what artifacts (like organizational policy) might need to change as a result?

The point is there are quite a few potential changes on the horizon that will impact all of the disciplines and professional areas that ISACA members inhabit. In order to help those practitioners navigate these potentially-complicated waters, ISACA has released a new whitepaper: DevOps Practitioner Considerations. This guide examines the impacts that DevOps can have on different practitioner communities and explores what those practitioners might choose to do in response.

As organizations start to more frequently move to DevOps, it becomes increasingly important that the “DevOps way” be understood by those with a stake in ensuring trust and value in information systems. Those who do not keep pace might find themselves unequipped to ensure the mission of their organization is protected. Those that adapt may find themselves able to use DevOps concepts to do their jobs even better.

Ed Moyle
Director of Emerging Business and Technology at ISACA

[ISACA]

Today marks the launch of the CSX Practitioner (CSXP) certification exam. For the first time, cybersecurity professionals can now obtain a vendor-neutral, performance-based cyber certification.

With Cybersecurity Nexus (CSX), ISACA has made a commitment. Through training, guidance, education and credentialing, we will help develop a skilled cybersecurity workforce to reduce the global skills gap, and we will provide resources for cyber professionals at every level of their careers. CSXP is one way we are fulfilling that commitment.

Research shows that the majority of employers—nearly 7 in 10—are requiring cybersecurity job candidates to hold a certification. They are also looking for candidates with hands-on skills. When a prospective employee has CSXP, it indicates that they fulfill both of those criteria and that he or she has the skills needed to help protect the organization.

To earn CSXP, candidates must pass an exam in a state-of-the-art, adaptive, performance-based cyber laboratory environment. The exam measures skills and abilities in a virtual setting using real-world cyber security scenarios. Registration is now open for the exam, and a beta test rate is available for those who take the exam and complete a survey by 1 October 2015.

Very soon, ISACA’s CSX will offer cyber training and certifications for all skill levels and specialties:

• Cybersecurity Fundamentals Certificate—Knowledge-based certificate that demonstrates a foundational understanding of cybersecurity (currently available)
• CSX Practitioner—Demonstrates ability to be a first responder to cyber incidents, following established procedures and defined processes. CSXP indicates firewall, patching and anti-virus experience, as well as the ability to implement common security controls and perform vulnerability scans and analysis. (currently available)
• CSX Specialist—Demonstrates effective skills and deep knowledge in one or more of the five areas based closely on the NIST Cybersecurity Framework: Identify, Detect, Protect, Respond and Recover (coming soon)
• CSX Expert—Demonstrates ability of a master/expert-level cybersecurity professional who can identify, analyze, respond to and mitigate complex cybersecurity incidents (coming soon)
• Certified Information Security Manager—Demonstrates the ability to manage, design, oversee and assess an enterprise’s information security program (currently available)

It is an exciting time of opportunity for cyber professionals. Companies and government organizations need you more than ever. As you grow your career in this area, know that we are here for you—we will help you stand out, grow your career and connect with a global community of cybersecurity experts.

Christos Dimitriadis, Ph.D., CISA, CISM, CRISC
2015-2016 ISACA International President

[ISACA]

Enterprise resource planning (ERP) systems automate and integrate the majority of a company’s business processes, producing consistency. They do this by sharing common data and practices across an organization, leveraging one-time data entry, and providing access to information in real time. To help in this working environment, ISACA recently released a go-to reference book for auditors that they can dog-ear with sticky note flags sticking out of the top and return to year after year.

Since the 1990s, businesses have been managing their operations with ERPs, which have enabled centralized control over operations by implementing a common data model and integrated business processes. SAP has been a leader in ERP systems from the beginning and uses a process-driven approach to match business processes with application processes.

SAP’s core product is SAP ERP (also called Enterprise Core Component [ECC] 6.0). SAP ERP is configurable and integrated across modules. This creates a system that is flexible but also complex. Because of the complexity and variability of configuration across industries, many companies are starting to use automated tools to assist in tracking and monitoring compliance. Systems such as SAP Governance, Risk, and Compliance (GRC) are common in large organizations to monitor and manage on-going compliance. Information technology auditors are also finding that it takes an SAP-specific skillset to audit these systems. This knowledge is required to understand the risks and the controls that mitigate those risks.

The ISACA Security, Audit and Controls Features of SAP ERP 4^th Edition brings together detailed information related to SAP ERP-specific risks, controls, and testing procedures. The handbook is separated into modules that cover the risk and controls, followed by testing procedures for both configuration and security. The book was designed as a long-term reference guide for auditors working in an SAP environment—a handbook written by auditors for auditors.

The 4^th Edition provides an update of previous sections and adds sections for Finance, Controlling, Human Resources, and Security with a focus on SAP ECC 6.0. The handbook walks through each of these new sections in detail with the same methodology used to cover the other areas (risk, mitigating controls, and testing procedures). In addition, this latest version also comes with downloadable audit plans that are COBIT 5 compliant. It is nearly a completely new book!

The 4^th edition was a great opportunity for Deloitte Advisory and ISACA work jointly to rewrite and build upon a great foundation to produce a new edition that refreshes and expands the scope of the original book.

Ben Fitts
Deloitte Advisory

As used in this document, “Deloitte” means Deloitte & Touche LLP, a subsidiary of Deloitte LLP.
Please see www.deloitte.com/us/about for a detailed description of the legal structure of Deloitte LLP and its subsidiaries. Certain services may not be available to attest clients under the rules and regulations of public accounting.

[ISACA]

When governments routinely address cybersecurity as part of their policy, you know that the topic is of national interest. When vulnerabilities are found in—and researchers demonstrate attacks against—computer systems in medical devices, automobiles and airplanes, you know that the significance extends even farther.

While that kind of recognition is important for the profession as a whole and is certainly impactful, there’s another area in which cybersecurity is gaining interest that is arguably more impactful to most practitioners on a day-to-day basis: increase in cultural interest.

TV shows (e.g., CSI: Cyber, Mr. Robot) and movies (e.g., Blackhat) that popularize the topic serve to guide younger professionals toward the discipline. You know that the cultural awareness has been firmly established when a movie like The Duff (a lighthearted teenage comedy) both features a hacker as a main character and incorporates security as a significant plot point.

When it comes to talent retention and acquisition for those in (or running) a security organization, understanding that this phenomenon exists – and knowing how to get it working in your favor – can be part of a security manager’s broader plans.

Leveraging cultural interest

Junior roles in any organization are the hardest to fill. Why? Because leaders tend to have more experience than the candidates they seek to hire; as a consequence, the folks in their virtual “rolodex” are those that they’ve worked with or collaborated with in the past – i.e., those with (most likely) a similar amount of work experience to their own.

Moreover, the folks moving into those junior roles are those more likely to be newer to the workforce.  A recent study from the Brookings Institution found that 64% of millennials (those born between 1980 and 2000) would prefer to make US $40,000 at a job they love (i.e., one they find interesting and engaging) vs. US $100,000 at a boring job. In other words, the work they value most is that which is most interesting. An increase in cultural interest on the topic of security means a corresponding uptick in the ability of security managers to find the best and brightest for their teams.  That said, it’s up to those same managers to retain them once they’re there.

This is where job rotation and cross-training within the organization can play a very beneficial role. Because, let’s face it, there are some jobs that are less interesting than others but still need to get done. Understanding that fulfillment and interest tie directly to employee satisfaction (and thereby attrition rate), periodically “refreshing” staff (sharing the load for those less interesting tasks) helps keep those folks from getting bored (and antsy to look outside the organization for more fulfilling work). Additionally, rotation of duties can help deepen internal understanding of the organization, cross-pollinate valuable skills and build a depth of experience for future leaders.

There’s a cultural phenomenon at work; at least for the moment, security has the interest of the media. The impact of this in the short term could mean an upcoming reduction in the pain we all feel as a result of the much-discussed security skills gap (an issue ISACA’s Cybersecurity Nexus [CSX] aims to address)—but for those thinking longer term, planning now for a way to hone, develop and retain those folks once they’re through the doors is time well spent.

Ed Moyle
Director of Emerging Business and Technology at ISACA

[ISACA]