Category: Cyber Security

Posted on

Navigating the Breach Regulatory Maze: Proper Incident Risk Assessment and Response

Cyber attacks. Lost paper files. Third-party snafus. Misdirected emails. Endless are the ways in which sensitive personal information is accidentally or deliberately exposed. Despite best efforts, it is impossible to stop sensitive data from falling into the wrong hands.

According to a new report, Risk Based Security identified 3,930 data breaches reported during 2015, exposing more than 736 million records. Poorly managed, these data security and privacy breaches put organizations at high risk for regulatory fines, lawsuits, lost business and reputational harm. In addition, customers, patients and employees affected by the exposure of their sensitive information fall prey to identity theft and other forms of fraud.

The Challenges of Incident Risk Assessment
No incident is alike. The types and sensitivity of data exposed, the root cause of the incident, the nature and intent of the recipient of the exposed data—these and other variables make consistency of incident risk assessment a difficult challenge for privacy, compliance and risk professionals.

For example, the Risk Based Security report found that:

  • Hacking accounted for 64.6 percent of breaches and 58.7 percent of exposed records.
  • Nearly half of breaches involved passwords and more than 45 percent exposed email addresses.
  • The breaches reported covered more than a dozen industry sectors, from technology to government to retail to healthcare.

In addition to incident variability, data breach laws are a maze of growing complexity and ambiguity. There are 51 state and territory breach notification laws that have different definitions of personal information, allow varying exceptions and have different requirements regarding notification thresholds, content and timing. And these laws are rapidly changing and getting stricter:  In 2015 and the first part of 2016, 10 states enacted new addendums or breach laws. Adding to the complexity is a plethora of federal regulations and standards—HIPAA, GLBA and PCI to name a few—as well as international laws and the long awaited European Union’s General Data Protection Regulation (GDPR).

The primary struggle for privacy and compliance professionals is lack of consistency given the manual and highly subjective methods of conducting the required multifactor risk assessments. This is understandable, given the challenge of assessing the unique nature of each incident against this backdrop of complex breach notification regulations and lack of purpose-built and automated incident risk assessment tools. And if such a homegrown tool is developed, many organizations find it doesn’t scale, it can’t keep up with the changing regulations and is difficult to use.

Four Steps to Successful Incident Risk Assessment and Response
In order to reduce the risks from unavoidable privacy or security incidents, organizations need an automated and highly consistent process for incident risk assessment. This process must allow each unique incident to be assessed with the latest updates to breach notification laws. To help you accomplish this, consider these four tips:

  1. Understand the difference between an event, an incident and a breach. These terms are often used synonymously or incorrectly, but important distinctions exist. For example, an incident is an event that violates an organization’s security or privacy policies involving sensitive information. A breach, on the other hand, is an incident that meets the legal definition of a breach and requires notification to affected individuals.
  2. Develop a scalable process for reporting incidents. Timely and efficient reporting of suspected incidents by employees, customers and third-party entities is critical for implementing a successful incident response process. Use web forms to efficiently and securely capture incident information and to automatically route the information to the appropriate professionals for investigation and incident risk assessment.
  3. Automate data breach risk assessment. Given the short time line for notifications based on a multifactor incident risk assessment, you need a system that is agile and provides a multifactor risk assessment based on the latest in breach notification laws across all jurisdictions where you have regulatory obligation.
  4. Track trends in incident categories and root causes. Learn from your incidents. Accurately identifying weaknesses in your systems, departments or processes can reduce the number of incidents and your organizational risk. Automation is key to ensuring proper analysis and risk mitigation.

Organizations can ill afford to underestimate the importance of consistent incident risk assessment and response. Done right, this process provides a road map for successfully responding to potential breaches, meeting regulatory requirements and protecting the people who trust us with their most confidential information.

Join Mahmood Sher-Jan at ISACA’s North America CACS in New Orleans 2-4 May. Sher-Jan will present Navigating the Data Breach Regulatory Maze (session 234/Privacy Track) in depth on Tuesday, May 3.

Mahmood Sher-Jan, CEO, RADAR® business unit, ID Experts

[ISACA Now Blog]

Posted on

Is Cybersecurity Everyone’s Concern?

Is your business connected to the Internet for any services? Do you shop online or purchase any products or services online? Are you on Facebook, Twitter, LinkedIn or any other social networking web sites? Do you have a high-end mobile phone and use chat applications such as WhatsApp? If so, cybersecurity is an issue about which you should be concerned.

If you think that you could never be a victim of an attack originating on any of these platforms, you should think twice, because cybercriminals are keenly tracking your identities and researching your shopping behavior, watching what you do online and, ultimately, profiling the very devices through which you are connected to cyberspace. Since you are part of the bigger, interconnected network, you are a potential target of a cyberattack.

If you are thinking to yourself, “What do I possess that will interest a cybercriminal?,” think of it this way:  You are targeted, not to steal anything specific, but to possibly build in-roads to a bigger trusted network to which you belong. Once your systems and networks are compromised, it may appear that the cyberattack has originated from your organization while it was actually performed by an invisible cyberattacker from your IP addresses using your system signatures.

Even if your interconnected networks are protected through a firewall or other security measures, a persistent hacker could still closely footprint your activities, e.g., when have you scheduled your next maintenance of systems and networks, the security behavior of users, or the tools and technologies deployed in your organization. In many cases, cybercriminals operate in stealth mode for a period of time before attacking. Once they are inside a network, they quickly adapt to the network behavior, making it difficult for the existing intrusion detection system to flag them. People are the weakest link that is targeted by a cyberattacker.

Essentially, every organization in cyberspace has to rethink with whom and how they are connected in cyberspace and prepare for any threats that can appear because of these interconnections. It is possible that something is already in place; it may just need strengthening through anti-hacking measures such as user awareness, firewalls, patch management, incident response, authentication, authorization and other controls.

Read Sanjiv Agarwala’s recent Journal article:
“Quick Fixes for Improving Cyberdefenses,” ISACA Journal, volume 2, 2016.

Sanjiv Agarwala, CISA, CISM, CGEIT, BS25999/ISO 22301 LA, CISSP, ISO 27001:2013 LA, MBCI

[ISACA Journal Author Blog]

Posted on

CCSP Certification a Must for Security Pros Pivoting to the Cloud

Cloud computing is transforming the world of information technology before our eyes. Less than a decade ago, IT teams focused most of their time on building enterprise data centers, managing capacity and building custom applications.

Today, times have changed and many organizations are now shifting their focus toward the cloud, moving to a world where automation and integration dominate, and enterprises purchase much of their computing as a service from a number of different providers.

This shift toward the cloud doesn’t only change the world of developers and engineers, it also dramatically affects the work of information security professionals. In the world of cloud computing, assessments rise in importance and contract language becomes as significant a security control as the configuration of the enterprise firewall.

As security professionals seek to reinvent themselves as cloud security experts, they must gain new knowledge and skills and may wish to pursue professional certifications that help them demonstrate this aptitude to current and potential employers.

Security in the Cloud

Perhaps the most fundamental security difference between the old world of on-premises enterprise IT and the new world of cloud computing lies in the degree of dependence that organizations place in their vendors. Certainly, IT organizations have always relied upon vendors to provide hardware, software and services and those vendors have played a key role in enterprise security.

Even in a completely on-premises model, a security flaw in a vendor-supplied product can have dramatic security implications that open holes for an attacker to exploit. In a cloud model, those dependencies grow larger as organizations call upon vendors to provide services in a more active fashion.

The shared responsibility model is the key to understanding cloud computing security. Both vendors and their customers must take responsibility for different elements of security and that division of responsibility depends upon the scope of services provided by the vendor and the agreement between the vendor and its customers.

For example, an infrastructure-as-a-service (IaaS) vendor offering virtualized servers to its customers is typically responsible for providing physical security in their data centers. The vendor is expected to manage network security, and secure both the hardware underlying the servers and the hypervisor that separates virtual instances from each other.

Customers configure the operating system, install applications, manage firewall rules and manipulate their own data. Therefore, the security of those components remains a customer responsibility.

In a software-as-a-service (SaaS) model, on the other hand, the burden of responsibility swings more heavily in the vendor’s direction. The vendor manages all of the servers as well as the application, assuming responsibility for almost the entire security stack. That said, customers may still manage application security settings and control the flow of sensitive information into the application.

As you move services to the cloud, the most important security concern you should have is a clear and documented understanding of the shared responsibility model. You should clearly articulate your security requirements, perhaps drawing this information from the requirements you use for on-premises environments.

Next, you should work with vendors to spell out the technical, physical and administrative controls that satisfy each objective and state who is responsible for the implementation, configuration, operation and verification of each control.

Preparing Yourself for the Cloud

It’s not just organizations that need to reinvent themselves for the cloud. It certainly is true that technologies and business processes will change as we move toward a cloud-centric computing environment.

Those changes will also require a shift in the individuals performing technology-related functions in those organizations, including information security. Current security professionals will need to update their skills to cover the emerging world of cloud computing.

In a cloud-focused world, security professionals must work closely with internal and external customers and suppliers to ensure that security follows the organization’s data wherever it flows or resides. Key skills for cloud security professionals include vendor relations, contract negotiations, security assessments, cloud platform operation and cloud application security.

In addition, cloud security professionals will need to have a deep understanding of the security services provided by their organization’s slate of cloud vendors, and understand how to manipulate those services to achieve the organization’s security goals.

If you’re hoping to reinvent your career as a cloud security specialist, then you may wish to consider earning a cloud-focused information security certification, such as the Certified Cloud Security Professional (CCSP) certification available as a joint partnership between (ISC)² and the Cloud Security Alliance (CSA).

These two organizations, known for providing some of the premier information security certifications available today, partnered to provide an advanced certification that requires a combination of advanced knowledge and practical, hands-on work experience that complements the other certifications they offer.

The Certified Information Systems Security Professional (CISSP) certification offered by (ISC)² is already considered the gold standard certification in the information security field. It covers an extremely broad range of material and only touches on cloud computing topics.

CISSP holders who wish to focus on cloud security may wish to supplement their existing certification with the CCSP as a specialized credential. The good news is that CISSPs already meet the CCSP’s five-year work experience requirement.

The Certificate of Cloud Security Knowledge (CCSK) certification offered by CSA is more of a foundational certification that focuses on a candidate’s mastery of the CSA’s cloud security guidance and has no work experience requirement.

Earning CCSK can smooth your path to CCSP by checking off a portion of the CCSP professional experience prerequisite. If you’re a practicing information security professional, you are probably better off earning the CCSP credential, either as a stand-alone certification or as a complement to the CISSP.

As enterprises continue to move applications, data and infrastructure to the cloud, they will increasingly require the services of information security professionals skilled in securing cloud computing environments.

Building out your skills in the realm of cloud computing and demonstrating those skills by earning the CCSP credential will position you well to take advantage of this trend and find interesting and lucrative employment opportunities.

Mike Chapple is Senior Director for IT Service Delivery at the University of Notre Dame. Mike is CISSP certified and holds bachelor’s and doctoral degrees in computer science and engineering from Notre Dame, with a master’s degree in computer science from the University of Idaho and an MBA from Auburn University.

[GoCertify]

Posted on

Dear CISOs and Legal Counsel: We Can’t Wait for the Privacy Regulators

Privacy is constantly in the news these days. Should Apple create a “back door” to unlock a terrorist’s iPhone for the FBI? Should Microsoft provide European citizen’s information stored on servers in Ireland in response to a US subpoena? Should data be allowed to be stored outside of Germany, France, Sweden and Russia for cloud services? Should we store information in the cloud without retaining the keys? Should commerce between the US and EU flow under the proposed replacement for Safe Harbor (Privacy Shield)? Or maybe the question is should someone be awarded tens of millions of dollars for having their privacy violated for filming them naked in a hotel room without their consent, or for filming someone’s engagement in a sex tape and releasing it to the Internet?

The Issue is Clear:  Why Should Anyone Trust Anyone?
We could leave this issue to privacy officers, internal and external legal counsel, governments, data protection authorities, politicians, regulators, and technology companies to sort out. We could wait for the ultimate answer to solve the privacy question once and for all. And wait. And wait some more. And wait for another review, debate, newsworthy event (such as needing information from another critical terrorist phone). Or wait for the next cloud service to be hacked, exposing photos that violate an individual’s right to privacy.

The reality is we just don’t trust each other—person to person or country to country. The reality is also, we have to trust each other at some level to interact personally or conduct business with each other.

As we grow up, we implicitly trust our parents to protect and lead us in the right direction. We have temporary moments of insanity during the ages of 5-6 and 13-17, where we don’t trust what they are telling us (because we just know better), and our parents all of a sudden get smarter when we turn about 22! In other words, we have temporary moments of disbelief, or a lack of trust in what they are telling us. It is the receiver of the message (in this case the child), that does not believe the sender (parents), even though thesender of the message was telling the truth and had good intentions all along. Trust is earned by delivering a consistent message that matches the real environment.

So what does this have to do with privacy in our organizations? Everything. We are currently in a state where people and governments are challenging the trust model. However, we cannot stop and wait for resolution of this temporary insanity and total lack of trust to figure out how to enable others to trust our assertions.

We Will Lose Valuable Time
We must, as “parents of our own organizational destiny,” continue to refine the controls on our systems and enhance how we protect information privacy. As we promote our message of information protection, those who make the rules will recognize that the organizations performing fundamental security work, building in privacy considerations and protecting rights through followed processes, will be able to be “trusted” and interact with other people and countries.

Privacy is much more than publishing a privacy notice on the company web site or sending out notices. Privacy is an organizational commitment to build trust by securing information and limiting access to accurate information to only those who have a right to it. Security officers are at the core of this issue and must be literate in the language to be effective.

At the 2016 North America CACS conference in New Orleans May 2-4, 2016, Todd Fitzgerald’s “One-Hour Privacy Primer” session will explore privacy concepts every security officer, privacy officer, auditor, lawyer, and governance professional should know:

  • The role of the CISO with respect to Privacy
  • 8 Universal (OECD) privacy principles
  • Global laws impacting privacy
  • Privacy by Design principles
  • Understanding data elements and the language of privacy

Todd Fitzgerald, CISA, CISM, CRISC, CISSP, CIPP/US, CIPP/E, CIPM, PMP, CGEIT, ISO27000, ITILv3f, Global Director Information Security, Grant Thornton International, Ltd.

[ISACA Now Blog]

Posted on

Open Survey: Defeating Insider Threats

We have a new survey entitled “Defeating the Insider Threat and Shoring up the Data Security Lifecycle“

Participate now

Time: 10-15 minutes

Prizes: 5 CCSK Tokens

Goal of the Survey:
Everything we know about defeating the insider threat seems not to be solving the problem. In fact, evidence from the Deep and Open Web points to a greatly worsening problem. Today’s employees work with a number of applications and with a series of clicks information can be both maliciously and accidentally leaked.

The purpose of this survey and research is to uncover:

  • The extent of employees leaking critical information and tradecraft on illicit sites
  • Data types and formats being exfiltrated along with exfiltration mechanisms
  • Why so many of these threats go undetected
  • What happens to the data after it has been exfiltrated
  • Tools to disrupt and prevent the data exfiltration cycle
  • Possibilities to expunge traces of data once exfiltrated

[Cloud Security Alliance Research News]

English
English
Exit mobile version