Copyright Security-Assessment.com 2004 Security Governance and Regulatory Controls by Peter Benson
Copyright Security-Assessment.com 2004 Agenda ISO/IEC AS/NZS SIGS Sarbanes Oxley CIS COBiT Others
Copyright Security-Assessment.com 2004 General Issues Controls considered to be essential to an organization from a legislative point of view include: – data protection and privacy of personal information – safeguarding of organizational records – intellectual property rights Audit and Compliance key issues
Copyright Security-Assessment.com 2004 Trends Continuous Auditing Continuous Assurance Changing Regulatory Environment Security as a Business Requirement Benchmarking Security Metrics Information Leakage / Information Asset Management Hacking for Pirating / Spam Phishing
Copyright Security-Assessment.com 2004 Security Success Factors Security policy, objectives and activities that reflect business objectives; Consistent Security Implementation Approach; Management Buy-in – Visibility and Support; Security Requirements, Risk Assessment and Risk Management understood; Security Marketing; Policy and Standards Distribution; Training and education; Measurement and Improvement Systems.
Copyright Security-Assessment.com 2004 ISO Business Requirements Reasonable level of Uptake Compliance rather than Certification Guideline rather than Prescription Gap Analysis and Roadmaps
Copyright Security-Assessment.com 2004 ISO coverage Security Policy Organisational Security Asset Classification and Control Personnel Security Physical and Environmental Security Communications and Operations Management Access Control Systems Development and Maintenance Business Continuity and Management Compliance
Copyright Security-Assessment.com 2004 SIGS Designed for government departments and agencies, State Owned Enterprises and Crown Entities, however may be applicable to companies working with Government May be Mandatory Based on the Joint Australian New Zealand Standard AS/NZ ISO/IEC 17799:2001 Risk Analysis and Management aligned to AS/NZS 4360: Risk Management Some content drawn from Australia’s “Commonwealth Protective Security Manual”, and the United Kingdom's “Manual of Protective Security”.
Copyright Security-Assessment.com 2004 Sarbanes – Oxley Section 404 Y2K on Steroids Typically under-reaction to over-reaction Required for any company wanting to work in the US Based around Financial Accounting and Audit, but… High focus on Best Practice for IT – COBiT adopted – ISO Compliance / Auditability against reasonable / best practice high on agenda 3 rd Party Auditing issues
Copyright Security-Assessment.com 2004 COBiT Control Objectives and Audit Guidelines NOT a set of audit controls or specifics Not information Security Specific; generally accepted reasonable practice
Copyright Security-Assessment.com 2004 SSE-CMM
Copyright Security-Assessment.com 2004 SSE-CMM Measurement
Copyright Security-Assessment.com 2004 CIS Benchmarks Generally Considered “Reasonable Practice” Strong use in Compliance Testing
Copyright Security-Assessment.com 2004 Emerging Issues Australian Commerce Act Fair Trading Act (AUS) Civil (Tort) Law (Duty of Care, Negligence) Contingent Liability (Hacked Systems) New Zealand Crimes Act Accountability but not necessarily Responsibility (outsourcing) Process Auditability (Do what you say you do) Compliance Management and Security Metrics
Copyright Security-Assessment.com 2004 Common Themes in NZ Organisations Federated business models Lack of centralised decision making or effective delegation Insufficient buy-in (Metrics and Marketing!) Security and Risk disconnect Lack of effective compliance testing Lack of compliance performance analysis Delegation of Responsibility – but abrogating Accountability
Copyright Security-Assessment.com 2004 Directions to Consider Documented processes and process auditibility Compliance Management Vulnerability Management / Continuous Auditing Security SLA’s Manage Security Performance against Benchmarks / Baselines MEASURE SECURITY (and Market it!)
Copyright Security-Assessment.com 2004 Questions?