1 1 Risk Management: How to Comply with Everything July 11, 2013

2 2 Introduction Chris Cronin – Principal Consultant, Halock Security Labs – GCIH, ISO Auditor – Recent GSNA Gold – 15+ years experience IT operations, audit, consulting and incident response

3 3 What You Will Learn Finding the Investment Sweet Spot How much security does the organization really need? On Common Ground Meeting the agendas of the Executive Suite Ease Their Pain Conflict-free audits Ask and You Shall Receive Bullet proof risk treatment planning & approvals How to Comply with Everything Why risk management is the compliance keystone

4 4 Presentation Layout What is risk management? Who benefits? How to bust the myths.

5 5 What is Risk Management?

6 6 Asset

7 7 Control

8 8 Vulnerability

9 9 Threat

10 Likelihood

11 Impact to Your Mission

12 Risk Risk = Likelihood x Impact

13 Risk Treatment

14 The Risk Register

15 The Risk Register

16 What Risk Management Isn’t

17 Gap Assessment

18 What Keeps You Up At Night?

19 Predicting the Future

20 What Risk Management Is

21 Risk Management in Regulations HIPAA Security Rule – “Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information...” – “Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level…” – “Security measures implemented to comply with standards and implementation specifications …must be reviewed and modified as needed to continue provision of reasonable and appropriate protection of [EPHI]”

22 Risk Management in Regulations HIPAA Security Rule – “Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information...” – “Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level…” – “Security measures implemented to comply with standards and implementation specifications …must be reviewed and modified as needed to continue provision of reasonable and appropriate protection of [EPHI]”

23 Risk Management in Regulations Massachusetts 201 CMR – “Every person that owns or licenses personal information about a resident of the Commonwealth shall develop, implement, and maintain a comprehensive information security program” – “Identifying and assessing reasonably foreseeable internal and external risks to the security, confidentiality, and/or integrity of any electronic, paper or other records containing personal information…” – “…evaluating and improving, where necessary, the effectiveness of the current safeguards for limiting such risks…”

24 Risk Management in Regulations Massachusetts 201 CMR – “Every person that owns or licenses personal information about a resident of the Commonwealth shall develop, implement, and maintain a comprehensive information security program” – “Identifying and assessing reasonably foreseeable internal and external risks to the security, confidentiality, and/or integrity of any electronic, paper or other records containing personal information…” – “…evaluating and improving, where necessary, the effectiveness of the current safeguards for limiting such risks…”

25 Components of Risk Management Risk Management Assessment Oversight Identity Risks Propose Controls Implement Controls Test Effectiveness Improve Ineffective Controls

26 Information Risk Management: The Standard of Care Required by laws and regulations – SOX (Audit Standard 5) – HIPAA Security Rule / Meaningful Use – Massachusetts 201 CMR – Gramm Leach Bliley – FISMA – Federal Trade Commission Rulings

27 Information Risk Management: The Standard of Care Required by Security Standards – PCI DSS 2.0 – ISO 27001/ISO – CobiT – NIST Special Publications

28 Who is Benefiting from Risk Management?

29 A Real-Life Case Study An organization that needed to improve their information compliance and security program Multiple roles that each had something at stake Multiple regulations apply to them

30 Whose Jobs are Getting Easier With Risk Management? Chief Financial Officer Auditor Chief Information Security Officer General CounselChief Information Officer IT Staff

31 Their Risk Register

32 Their Risk Calculations Risk = Likelihood x Impact Likelihood values: 1-5 Impact values: 1-5 Risk rating range: 1-25 Acceptable Risk = Below 8

33 Lesson 1: Finding the Investment Sweet Spot Risk : – Local administrator passwords on end-user systems are identical. They allow a “pass-the- hash” breach. Roles : – CIO : Needs to balance business and compliance requirements – IT Staff : Need an easy way to support desktops – CISO : Needs to be sure requirements are met – General Counsel: Needs to balance business and compliance while addressing liability

34 Lesson 1: “Pass-the-Hash” Risk

35 Lesson 1: “Pass-the-Hash” Risk

36 Finding the Sweet Spot

37 Lesson 2: Finding Common Ground Risk : – Lack of secure web application coding practices have created vulnerable applications. Roles : – CIO : Needs to balance demands for new secure applications with many other demands – CFO : Needs controlled applications for financial reporting. Needs to control costs. – CISO : Needs to be sure requirements are met – General Counsel: Needs to balance business and compliance while addressing liability

38 Lesson 2: Unsecured Applications Risk

39 Lesson 2: Unsecured Applications Risk

40 Lesson 3: Ease Their Pain Risk : – Client auditor demanding “hard tokens” rather than “soft tokens” for two-factor authentication. Roles : – Auditor : Needs to demonstrate whether controls are met (while maintaining independence) – CIO : Needs to respond truthfully to auditor (while balancing business with compliance) – CISO : Needs to ensure compliance

41 Lesson 3: Two-Factor Token Risk

42 Lesson 3: Two-Factor Token Risk

43 Lesson 4: Ask and You Shall Receive If you ask for something that reduces a risk to the mission of the organization, and the cost is reasonable for reducing the impact … then you will get it.

44 Lesson 5: How to Comply with Everything Risk Mgt HIPAA CMR PCI DSS FTCCFPB ISO 27001

45 Lesson 5: How to Comply with Everything

46 How to Bust Risk Assessment Myths

47 “We need actuarial tables” Actuarial tables are not used for risk assessments! Information risk assessments are standard, straight-forward processes. They require no statistical skills.

48 “We can’t predict the future” Risk assessments are not intended to be predictions, but should be “due care” considerations of what could go wrong.

49

50 “Risk assessments take too much time” Because risk assessments help determine reasonable control levels, less time and cost is invested to get compliant Risk management reduces liability even before full compliance is met.

51 “Reasonable means ‘what our competitors do.’” You don’t know what your competitors do. The regulations and statutes tell you to arrive at “reasonable and appropriate” using risk analysis

52 “We can never agree on asset values” Risk assessment methodologies often state the need to assess the asset value. That is often more difficult than what you need. Try assessing the impact instead.

53 “We did a gap assessment. That’s good enough” Your first gap will be “We didn’t conduct a risk assessment.” Risk assessments are the standard of care for laws, regulations and information security standards.

54 Questions Chris Cronin: