Category: Cyber Security

After attending the White House Summit on Cybersecurity and Consumer Protection, I agree with the paradox raised by President Barack Obama—the very technology that can be used to do great good can also be used to imperil us and do great harm. The President labeled cybersecurity threats as one of the most serious economic national security challenges today.

While the resolve of CEOs and government leaders for more global collaboration and information sharing was encouraging, I found it even more reassuring to hear them recognize the need for significantly more skilled cybersecurity professionals. Cyberattacks are damaging enough when intellectual property, personal information and emails are stolen; but the potential for attacks on water and electrical systems and even your car or pacemaker would be far more catastrophic. Cybersecurity is a matter of public safety and must be treated as such.

There is no question that businesses, academic institutions, civil society and governments must, as President Obama emphasized, work together like never before. This unprecedented level of collaboration is essential to stay ahead of our cyber adversaries. The bad actors share information when launching global attacks, so we must improve real-time information sharing among industry sectors and nations. This will help proactively identify attacks and techniques, and enable cyber experts to take immediate action.

To effectively do this we need more skilled professionals on the front lines and a cyber-safety mindset throughout every organization. For far too long, companies have either avoided dealing with the threat from cyberspace or have quietly tried to address it alone. But this is no longer enough. The risk has grown exponentially and substantially greater investment in technology and training for new cybersecurity professionals is urgently needed.

ISACA first identified this gap more than 10 years ago and has teamed with leaders in business and government to develop relevant training and certifications in information security and cybersecurity. Last year’s launch of Cybersecurity Nexus (CSX) brought together guidance, career development, skills-based certification and ongoing training for cybersecurity professionals at every stage of their careers. We will continue to evolve CSX as the role itself evolves and the skills requirements and threat landscape continue to change.

It is also vital for organizations to partner and develop high-impact public awareness campaigns that create a more cyber-aware society. People of all ages and walks of life play a very important role in reducing the effects of cyberthreats.

In the wake of the White House Cybersecurity Summit, I see the following as top priorities:

• Conversations lead to solutions. Government and industry alike must continue to gather the insights of experts and translate these ideas into action.
• If it is connected, it is vulnerable. Manufacturers need to build security in from the inception of new connected products.
• Beat the drum. Consumers need to be made more aware of the importance of security when they’re considering connected cars, appliances, medical devices and other items.
• Train and educate. Increase investments in building cybersecurity skills and knowledge among all members of the workforce.

Cybersecurity is everybody’s business—it is a global issue, a critical need, and it deserves our undivided attention.

Matt Loeb
CEO, ISACA

[ISACA]

Organizations today are being burdened with an unprecedented volume of regulatory and compliance requirements leading to increased operational complexity, challenging production capability and occupying key resources. Integrated compliance frameworks offer a mechanism for these organizations to implement a single enterprise wide solution that allows you to “control once, comply with many.” While the concept is simple, implementation of these frameworks fails as often as it succeeds due to circumstances that could be prevented with up-front planning and coordination. Below are five basic points to consider before you begin your integrated compliance journey:

1. Start small, think broadly. It is tempting to try and tackle all compliance requirements across the entire organization in one pass. However, integrated compliance solutions take significant up-front time and effort to succeed. While a solution should be built with an organizational scope in mind, demonstrating incremental successes through smaller pilot efforts will help build support and keep momentum throughout the framework development and roll-out.
2. Consider the pros and cons of “off-the-shelf” frameworks versus custom built. You will find several solutions in the market that offer “off-the-shelf” integrated compliance frameworks. Careful consideration should be given to how these frameworks fit your organization, the applicability of all regulations/requirements included in the frameworks, and whether your organization truly understands the applicability of specific requirements if dependent on a package solution. On the flip side, while a custom framework can allow increased flexibility in scoping, control design and roll-out, there may also be increased overhead with maintaining a custom solution.
3. Identify organizational stakeholders. It is critical to identify who key stakeholders are within compliance, legal, audit, business units and IT, as the success of integrated compliance frameworks depends on support of all functions that are impacted by the various compliance and regulatory requirements included in the framework. Often times a steering committee made up of key organization representatives can help not only with the initial design of your integrated compliance framework, but also with the successful ongoing support of the program going forward.
4. Understand the applicability of requirements. Whether attempting to comply with SOX, PCI, HIPAA or other requirements, the effort of scoping each requirement for your organization in detail remains important to the effectiveness of your framework. While the purpose of an integrated compliance framework is to allow one common set of controls to achieve all applicable requirements, that does not mean all controls apply to the entire organization. Understanding and capturing the scope of each applicable requirement is crucial to demonstrating that the appropriate level of control has been applied to the environment while not over controlling.
5. Consider the outputs at the start. It is easy to get buried in the details when designing and implementing your integrated compliance framework. Careful thought should be given at the start of your program to define goals, reporting and key metrics that will measure success. Integrated compliance frameworks can help achieve a reduction in controls, improved compliance reporting, a reduction in hours spent on compliance efforts, and improve the ability to strategically address compliance and regulatory remediation efforts. Identifying key outputs for your organization at the start will allow you to design your framework in a way that will help best realize these benefits and be able to effectively communicate them to management.

Implementation of an integrated compliance framework is a complex undertaking that cannot be solved with a quick-fix solution. As is the case with any large project, management can improve the likelihood of a successful implementation through careful planning and consideration of the organization’s objectives and risks to those objectives. Proper consideration of the points above can help you start on your journey to a simplified and integrated compliance landscape.

Nick Blaesing, CISA
Director, Risk Assurance, PricewaterhouseCoopers LLP

[ISACA]

Today’s business environment is fraught with risk. Economic, technology and market conditions affect organizations on a daily basis. The constantly “changing risk landscape” is a discussion point in headlines, industry forums, media outlets and board rooms. We are moving to a world where risk management will become the primary source of competitive advantage. Rather than avoiding risk, organizations need the ability to embrace risk with confidence.

Risk management will become the core capability which separates winners from losers. Organizations that understand and manage risk effectively will prosper, while those that cannot will fail. Success starts with the ability to manage operational risk in a manner that frees up resources to focus on the company’s long term, strategic objectives. This does not happen overnight.

Executives need relevant, up-to-date information to pursue the right opportunities. But, they also need a balanced approach to manage the major risks facing the organization to acquire the insight to make the right business decisions, address risk and explore new opportunities with predictability. A governance, risk and compliance (GRC) program is the backbone that keeps the organization prepared to manage issues and reduce risk. A GRC strategy that focuses on sharing data, leveraging processes and breaking down organizational barriers builds efficiencies across the organization to effectively transform compliance, manage risk and exploit opportunity.

Whether executives like it or not, all risk and compliance functions are expected to add value to the organization. These days, you cannot invest in anything that does not bring value to the company. Risk and compliance functions are no different. You can gauge your GRC program’s value by two simple measurements, and the first is results. GRC programs are expected to drive a constant increase of effectiveness in managing risk and compliance. The second measurement is reach. As the risk and compliance function matures, ideally it protects more and more of the organization. These two factors, as they increase, are key measurements of the risk and compliance function and how it brings value to the organization.

Organizations are looking to improve their results and expand their reach by maturing programs beyond check-the-box compliance. They must mature from first meeting the company’s compliance obligations, progressing to managing risk and, ultimately, reaching the point where the organization can use compliance and risk as a competitive advantage—truly bring value to the organization by helping drive opportunity.

I invite you to join me at ISACA’s 2015 North America CACS conference to explore this topic in more depth in my presentation titled “GRC Maturity Models.” I hope that these ideas will help you find conversation tools that help you determine your path to a mature, sustainable GRC program that helps fuel your enterprise toward opportunity.

Steve Schlarman, CISM, CISSP
GRC Strategist, IT and Security, RSA, The Security Division of EMC

[ISACA]

The days of doing business with a handshake and a smile are long gone. However, one thing continues to remain constant—how few vendor contracts are updated, even if the scope of service changes. This can be detrimental to an organization, particularly if the vendor is handling sensitive data such as personally identifiable information (PII), protected health information (PHI), cardholder data (CHD), or confidential, intellectual property and strategic data (also known as CIPS).

Periodically reviewing—and appropriately updating—master services agreements ensures both parties are aware of the processes, data elements and where the data processing is being performed. In other words; contracts must be continuously reviewed and revised as scopes of work change. The best way (or at least, the cleanest way) to update the master services agreement is via addendums that are signed and dated by both parties.

Effective vendor risk management is in managing the details. A key consideration in developing a durable vendor contract also means identifying the success criteria for the vendor and includes:

• The business unit’s requirements for the vendor
• The technical requirements involved (e.g., data elements, IT components, connectivity)
• The vendor’s requirements for the customer

To ensure that all expectations (performance, compliance, regulatory, etc.) are met—and no one is blindsided—it is important for the organization to identify early and manage the following key vendor risk operational points:

• Coordination between sourcing and vendor management
• Vendor risk classification
• The monitoring of vendor performance
• Effective use of assessment results
• Responding to and managing vendor performance issues

But what do you do if the vendor is not living up to the agreed-upon expectations documented in the contract?

An exit strategy is a must when a vendor does not meet its contractual expectations. It is a prudent step for the organization to ensure that a backup plan exists to either redirect the work to an already existing vendor used by the organization or to find a new vendor (one that most likely went through the previous request for proposal [RFP] process).

In my upcoming session (#145—“Contracting for the Full Vendor Lifecycle”) at ISACA’s 2015 North America CACS taking place 16-18 March 2015 in Orlando, FL, I will discuss these and other challenges during the contract phase of the third-party relationship. Hope to see you there!

Tom Garrubba, CISA, CRISC, CIPT, CTPRP
Senior Director, The Santa Fe Group
Program Director for the Shared Assessments Program

[ISACA]