Cybersecurity Assurance at CloudSec 2015 Kuala Lumpur
-
Upload
alan-yau-ti-dun -
Category
Presentations & Public Speaking
-
view
188 -
download
3
Transcript of Cybersecurity Assurance at CloudSec 2015 Kuala Lumpur
CYBERSECURITY ASSURANCE ALAN YAU TI DUN CISA CISM CGEIT CRISC CISSP CSXF ITIL SPECIAL INTEREST GROUP 1 ISACA MALAYSIA CHAPTER
Like any information security processes, there should be an adequate and reasonable level of assurance for cyber security, which completes the security perspective when combined with governance and management processes. Cyber security assurance requires a comprehensive set of controls that covers risk as well as management processes. These controls are supported by appropriate metrics and indicators for security goals and factual security risk. This session will share the cybesecurity self assessment program in carrying out an audit or self-assessment review on cyber security controls and practices in a typical organisation. This assurance program will leverage on COBIT 5 framework and COBIT 5 for Information Security as a baseline.
CYBERSECURITY ASSURANCE
2
CYBERSECURITY ASSURANCE
3 <insert speaker organization logo>
This session aims to bring forth the following to the delegates: • General understanding of cyber security assurance. • Exposure to a cyber security assurance program, which is leveraging on
COBIT 5 as a baseline. • Provide guideline in conducting cybersecurity audit
AUDITING & REVIEWING CYBERSECURITY
4
5
AUDITING & REVIEWING CYBERSECURITY
• Review is required to validate the controls are designed and operating effectively.
• Audit & review universe is distributed across all 3 lines of defense, which provides the required degree of independence needed.
6
AUDITING & REVIEWING CYBERSECURITY
7
AUDIT UNIVERSE
• Include all control sets, management practices and GRC provisions in force.
• Possible to be extended to 3rd parties – contract with audit rights.
• Keep within the right boundaries –
! Corporate sphere of influence vs private sphere of controls.
! Internal IT infrastructure vs external infrastructure.
! Corporate sovereignty vs legal provisions.
8
AUDIT BOUNDARIES
9
AUDIT OBJECTIVES
• Can range from high-level governance reviews to technical reviews.
• Needs to be clearly defined and concise manner.
• Consider time and effort.
• Audit objectives are best defined in line with the governance and management activities defined for cyber security.
• For complex audits, the underlying audit program may spans several years.
10
KEY CONSIDERATIONS
• Legal consideration
• Privacy and data protection
• Logging, data retention and archiving
• Audit data storage and archiving. Should be within the standard criteria:
• Confidentiality
• Integrity
• Availability
11
EXAMPLE – CYBERSECURITY AUDIT GOALS
12
EXAMPLE – CYBERSECURITY AUDIT GOALS
13
EXAMPLE – CYBERSECURITY AUDIT GOALS
14
EXAMPLE – CYBERSECURITY AUDIT GOALS
15
TRANSFORMING CYBERSECURITY – COBIT 5
Eight Key Principles: 1. Understand the potenAal impact of cybercrime and warfare on your
enterprise. 2. Understand end users, their cultural values and their behavior paQerns. 3. Clearly state the business case for cybersecurity and the risk appeAte of the
enterprise. 4. Establish cybersecurity governance. 5. Manage cybersecurity using principles and enablers. (The principles and
enablers found in COBIT 5 will help your organizaAon ensure end-‐to-‐end governance that meets stakeholder needs, covers the enterprise to end and provides a holisAc approach, among other benefits. The processes, controls, acAviAes and key performance indicators associated with each enabler will provide the enterprise with a comprehensive picture of cybersecurity.)
6. Know the cybersecurity assurance universe and objecTves. 7. Provide reasonable assurance over cybersecurity. (This includes monitoring,
internal reviews, audits and, as needed, invesAgaAve and forensic analysis.) 8. Establish and evolve systemic cybersecurity.
CYBERSECURITY ASSURANCE USING
16
17
CYBERSECURITY ASSURANCE– COBIT 5
18
CYBERSECURITY ASSURANCE – COBIT 5
EDM01: ENSURE GOVERNANCE FRAMEWORK SETTING AND MAINTENANCE Key Areas / Points
1 Cyber security management is supported by enAty standards, processes and procedures.
2 Cyber security prevenAon is monitored on a regular basis by senior management.
3 Business and IT Unit Leaders are trained and acTvely involved in the oversight and significant decisions relaAng to cyber security preparedness and incidents.
4 A cyber security task force / panel has been established and includes appropriate funcAonal members.
5 Cyber security risks and vulnerabiliTes are idenTfied and evaluated on a periodic basis.
19
CYBERSECURITY ASSURANCE – COBIT 5 EDM01: ENSURE GOVERNANCE FRAMEWORK SETTING AND MAINTENANCE
Other notable cyber security assurance concepts
1 IdenAfy and validate governance model in terms of cyber security aYacks (e.g. ‘Zero Tolerance’ vs ‘Living with it’). This model should be aligned with the enTty’s overall risk appeTte.
2 Determine an opTmal decision making model for cyber security. This may be disAnct and different from the ‘ordinary’ informaAon security model.
3 Embed cyber security transformaAon acAviAes that is driven by a steering commiQee. These acAviAes should be included in the overall security strategy.
4 Develop and foster an informaAon security-‐posiTve culture and environment within all business units.
5 Integrate cyber security measures measurements and metrics into rouAne compliance check mechanisms.
20
CYBERSECURITY ASSURANCE – COBIT 5 APO01: MANAGE THE IT MANAGEMENT FRAMEWORK
Key Areas / Points
1 IT management establishes, maintains and monitors a secure infrastructure
2 IT management receives and reviews key reports and analysis of security, vulnerability, intrusions and penetraAon test results.
3 IT management supports the cyber security task force and informaAon security iniAaAves
21
CYBERSECURITY ASSURANCE – COBIT 5
APO01: MANAGE THE IT MANAGEMENT FRAMEWORK
Other notable cyber security assurance concepts
1 Define the expectaAons with regard to cyber security, including ethics and culture. The expectaAons should match the overall governance model.
2
IT General Controls (‘ITGC’) should be tested and updated regularly. IT General Controls provides the support and baseline assurance for cyber security specific objecAves.
3 Controls and objecAves that are performed by third parAes should also be evaluated periodically by management.
22
CYBERSECURITY ASSURANCE – COBIT 5 AP003 MANAGE ENTERPRISE ARCHITECTURE (ARCHITECTURE REVIEW)
23
CYBERSECURITY ASSURANCE – COBIT 5
Security Incident Management
1 Policies and procedures are established to ensure that a risk analysis and asset prioriAzaAon is part of the evaluaAon process
2 Asset value and prioriAzaAon are components of the incident response analysis
3 Incident response policies and processes should idenAfy the scope, objecAves and requirements defining how and who should respond to an incident, what consTtutes an incident, and the specific processes for monitoring and reporAng the incident acAviAes.
4 An incident response team has been organized with appropriate management, staffing and senior management support.
5 Forensic policies and procedures should ensure that documented management trails are preserved to permit internal invesTgaTons and support any legal or regulatory invesTgaTons (internal and external).
6 Incident response tools should be installed, scheduled, monitored, and secured to avoid unauthorised access to invesAgaAon acAviAes.
7 The crisis management funcTon is part of the cyber security preparedness process.
AP013 MANAGE SECURITY (SECURITY INCIDENT MANAGEMENT)
24
CYBERSECURITY ASSURANCE – COBIT 5 AP013 MANAGE SECURITY (SECURITY INCIDENT MANAGEMENT)
25
SUMMARY
• Understand CyberSecurity from a holistic, organizational perspective
• Understand the approach to CyberSecurity Assurance • Develop audit programmes by identifying risks and
relevant controls • Know how to test controls related to CyberSecurity
ALAN YAU TI DUN CISA CISM CGEIT CRISC CISSP CSXF ITIL SPECIAL INTEREST GROUP 1 ISACA MALAYSIA CHAPTER