1. Copyright Security-Assessment.com 2004 Security Governance and Regulatory Controls by Peter Benson

2. Copyright Security-Assessment.com 2004 Agenda ISO/IEC AS/NZS 17799 SIGS Sarbanes Oxley CIS COBiT Others

3. Copyright Security-Assessment.com 2004 General Issues Controls considered to be essential to an organization from a legislative point of view include: – data protection and privacy of personal information – safeguarding of organizational records – intellectual property rights Audit and Compliance key issues

4. Copyright Security-Assessment.com 2004 Trends Continuous Auditing Continuous Assurance Changing Regulatory Environment Security as a Business Requirement Benchmarking Security Metrics Information Leakage / Information Asset Management Hacking for Pirating / Spam Phishing

5. Copyright Security-Assessment.com 2004 Security Success Factors Security policy, objectives and activities that reflect business objectives; Consistent Security Implementation Approach; Management Buy-in – Visibility and Support; Security Requirements, Risk Assessment and Risk Management understood; Security Marketing; Policy and Standards Distribution; Training and education; Measurement and Improvement Systems.

6. Copyright Security-Assessment.com 2004 ISO 17799 Business Requirements Reasonable level of Uptake Compliance rather than Certification Guideline rather than Prescription Gap Analysis and Roadmaps

7. Copyright Security-Assessment.com 2004 ISO 17799 coverage Security Policy Organisational Security Asset Classification and Control Personnel Security Physical and Environmental Security Communications and Operations Management Access Control Systems Development and Maintenance Business Continuity and Management Compliance

8. Copyright Security-Assessment.com 2004 SIGS Designed for government departments and agencies, State Owned Enterprises and Crown Entities, however may be applicable to companies working with Government May be Mandatory Based on the Joint Australian New Zealand Standard AS/NZ ISO/IEC 17799:2001 Risk Analysis and Management aligned to AS/NZS 4360:1999 - Risk Management Some content drawn from Australia’s “Commonwealth Protective Security Manual”, and the United Kingdom's “Manual of Protective Security”.

9. Copyright Security-Assessment.com 2004 Sarbanes – Oxley Section 404 Y2K on Steroids Typically under-reaction to over-reaction Required for any company wanting to work in the US Based around Financial Accounting and Audit, but… High focus on Best Practice for IT – COBiT adopted – ISO 17799 Compliance / Auditability against reasonable / best practice high on agenda 3 rd Party Auditing issues

10. Copyright Security-Assessment.com 2004 COBiT Control Objectives and Audit Guidelines NOT a set of audit controls or specifics Not information Security Specific; generally accepted reasonable practice

11. Copyright Security-Assessment.com 2004 SSE-CMM

12. Copyright Security-Assessment.com 2004 SSE-CMM Measurement

13. Copyright Security-Assessment.com 2004 CIS Benchmarks Generally Considered “Reasonable Practice” Strong use in Compliance Testing www.cisecurity.org

14. Copyright Security-Assessment.com 2004 Emerging Issues Australian Commerce Act Fair Trading Act (AUS) Civil (Tort) Law (Duty of Care, Negligence) Contingent Liability (Hacked Systems) New Zealand Crimes Act Accountability but not necessarily Responsibility (outsourcing) Process Auditability (Do what you say you do) Compliance Management and Security Metrics

15. Copyright Security-Assessment.com 2004 Common Themes in NZ Organisations Federated business models Lack of centralised decision making or effective delegation Insufficient buy-in (Metrics and Marketing!) Security and Risk disconnect Lack of effective compliance testing Lack of compliance performance analysis Delegation of Responsibility – but abrogating Accountability

16. Copyright Security-Assessment.com 2004 Directions to Consider Documented processes and process auditibility Compliance Management Vulnerability Management / Continuous Auditing Security SLA’s Manage Security Performance against Benchmarks / Baselines MEASURE SECURITY (and Market it!)

17. Copyright Security-Assessment.com 2004 Questions?