© ITT Educational Services, Inc. All rights reserved. IS4680 Security Auditing for Compliance Unit 1 Information Security Compliance

© ITT Educational Services, Inc. All rights reserved.Page 2 IS3440 Linux Security Class Agenda 6/13/16  Introduction  Course Syllabus.  Learning Objectives  Lesson Presentation and Discussions.  Discussion on Assignments.  Discussion on Lab Activities.  Break Times as per School Regulations.

© ITT Educational Services, Inc. All rights reserved.Page 3 IS3440 Linux Security Course Syllabus  Introduction of Course Syllabus. Course Summary Course Plan Evaluation Academic integrity  Discussion and questions about syllabus.

© ITT Educational Services, Inc. All rights reserved.Page 4 IS3440 Linux Security Name: Williams Obinkyereh Bachelor of Science in Statistics (BSc Stats) Master of Science in Information Technology (MSc IT) Post Masters of Advanced Studies in Software Engineering. Doctor of Computer Science (DCS) Ongoing Contacts:

© ITT Educational Services, Inc. All rights reserved.Page 5 IS4680 Security Auditing for Compliance Learning Objective  Describe the role of information systems security (ISS) compliance in relation to U.S. compliance laws.

© ITT Educational Services, Inc. All rights reserved.Page 6 IS4680 Security Auditing for Compliance Key Concepts  ISS and information assurance in organizations  The various U.S. compliance laws and standards and their role in organizations  The difference between public and private sector regulatory requirements

© ITT Educational Services, Inc. All rights reserved.Page 7 IS4680 Security Auditing for Compliance Key Concepts (Continued)  The importance of organizational governance and compliance and the difference between ISS audits and assessments  ISS audits and their importance in organizations

© ITT Educational Services, Inc. All rights reserved.Page 8 IS4680 Security Auditing for Compliance EXPLORE: PROCESSES

© ITT Educational Services, Inc. All rights reserved.Page 9 IS4680 Security Auditing for Compliance Explore-Group discussion.  IA  IT security audits  IT security assessments  Compliance laws and standards  The consequences of not adhering to compliance laws  Public and private compliance requirements

© ITT Educational Services, Inc. All rights reserved.Page 10 IS4680 Security Auditing for Compliance Generic Process for Information Assurance Step 1 Identify organizational vulnerabilities. Step 2 Apply commercial information technology (IT) solutions, services, and frameworks. Step 3 Protect assets by using the Central Intelligence Agency (CIA) methodology.

© ITT Educational Services, Inc. All rights reserved.Page 11 IS4680 Security Auditing for Compliance Generic Process for Information Assurance (Continued) Step 4 Document any existing or new vulnerabilities. Step 5 Schedule next review.

© ITT Educational Services, Inc. All rights reserved.Page 12 IS4680 Security Auditing for Compliance Regulations Leading to Compliance Step 1 Interpret the new law or regulation and the way it applies to the organization. Step 2 Identify the gaps and determine where the organization stands regarding the compliance mandate. Step 3 Devise a plan to close gaps identified. Step 4 Execute the plan to bring the organization into compliance.

© ITT Educational Services, Inc. All rights reserved.Page 13 IS4680 Security Auditing for Compliance Managing Information Security: Risk-Based Approach Step 1 Identification of the information and information system. Step 2 Categorization of the identified information and information system. Step 3 Selection of the system and appropriate security controls.

© ITT Educational Services, Inc. All rights reserved.Page 14 IS4680 Security Auditing for Compliance Managing Information Security: Risk-Based Approach (Continued) Step 4 Implementation of the selected system and appropriate security controls. Step 5 Assessment of the implemented system and appropriate security controls’ effectiveness.

© ITT Educational Services, Inc. All rights reserved.Page 15 IS4680 Security Auditing for Compliance Managing Information Security: Risk-Based Approach (Continued) Step 6 Authorizing the systems by accepting the risk based upon the selected security controls. Step 7 Monitoring the security controls on a continual basis.

© ITT Educational Services, Inc. All rights reserved.Page 16 IS4680 Security Auditing for Compliance EXPLORE: ROLES

© ITT Educational Services, Inc. All rights reserved.Page 17 IS4680 Security Auditing for Compliance Roles and Responsibilities  Risk Manager Responsible for identifying organizational risk.  Auditor Responsible for conducting information assurance audit and applying frameworks to the seven domains to align with compliance.  Executive Manager Responsible for aligning external or internal compliance with governance requirements.

© ITT Educational Services, Inc. All rights reserved.Page 18 IS4680 Security Auditing for Compliance EXPLORE: CONTEXTS

© ITT Educational Services, Inc. All rights reserved.Page 19 IS4680 Security Auditing for Compliance Security Audit Organizational  Examines the management control over IT and related programs, policies, and processes. Compliance Pertains to ensuring that specific guidelines, laws, or requirements have been met. Application  Examines the IT infrastructure and data communications. Technical  Involves the applications that are strategic to the organization. Scope of an IT Audit

© ITT Educational Services, Inc. All rights reserved.Page 20 IS4680 Security Auditing for Compliance EXPLORE: RATIONALE

© ITT Educational Services, Inc. All rights reserved.Page 21 IS4680 Security Auditing for Compliance Compliance InternalExternal Refers to an organization’s ability to follow its own rules, which are typically based on defined policies. Refers to an organization’s desire to follow rules and guidelines set forth by external organizations and initiatives.

© ITT Educational Services, Inc. All rights reserved.Page 22 IS4680 Security Auditing for Compliance Summary In this presentation, the following were covered:  Process for information assurance and regulation leading to compliance  Roles and responsibilities related to information security compliance  Importance of IT security audit  Need for compliance

© ITT Educational Services, Inc. All rights reserved.Page 23 IS3440 Linux Security Unit 1 Discussion and Assignments  Discussion 1.1 Public and Private Sector Regulatory Requirements ( Group Discussion)  Assignment 1.3 Compliance Laws

© ITT Educational Services, Inc. All rights reserved.Page 24 IS3440 Linux Security Unit 1 Lab Activities  Lab 1.2 Assess the Impact of Sarbanes- Oxley (SOX)Compliance Law on Enron  Lab is in the lab manual on line

© ITT Educational Services, Inc. All rights reserved.Page 25 IS3440 Linux Security Class Project  Project Title  Department of Defense DOD Audit  This is a Team Project. You will create 3 teams.  Deliverables or milestone drafts as specified in the project content will be submitted.  Due on Week 11