Lecture Slides-Lecture 3

8/13/2019 Lecture Slides-Lecture 3

1/29

HackMeCo, Incident Response

An approach to lecture #2


2/29

Weve been had, and it was all Georgesfault.

If you recall from week 2


3/29

Finish the job

Already we:Hopefully were preparedDetected and analyzedContained, eradicated?? and recovered

Dont forget the follow -upPost mortem analysis

Prosecute?Re-visit our controls?

An approach


4/29

Multiple shades of redDo we need to be XXX compliant?What does regulatory compliance mean tounregulated industries?

Regulatory and otherwisecompliance


5/29

Industries treatment of information is oftenregulated to assure society that protectionsmeet an agreed upon standard.

In such cases, the regulations are published,well known and expertise is available forinterpreting the legal language.

Health Insurance Portability and Privacy act(HIPAA): 355 pages in the federal register

Sarbanes Oxley: 65 pagesNERC Critical Infrastructure Protection 31documents (but carefully read - $1 million / dayfining authority)

Simple compliance


6/29

In the government regulatory scenario:The rules are knowableIts reasonably clear who the rules apply to As written into law, the rules are usually prettygenericIts possible to know where you stand

Simple sort of


7/29

Payment Card Industry Data Security Standard (PCIDSS): Industry self-regulation, notable failures in e-

commerceFFIEC guidance on Internet banking authentication

Guidance, not regulation, though Internet searcheslink pages which incorrectly refer to the guidance asregulation because US Courts are finding against banks which have notimplemented the guidance citing it as best practice

Non regulatory, but stillcompliance


8/29


9/29

Fines: Non compliance can result in regulatoryauthorities assigning fines.These range from relatively minor to NERC CIPat $1,000,000 / day / incident back dated to thestart of the non-compliant behavior

Fines are typically assigned directly by theregulating body, no court action required

Penalties vary - regulatory


10/29

Legal: In some cases (some levels of HIPAAviolation for example) non-compliance iscriminal

Penalties include fines as well as potential jailtimeCriminal liability is, of course, individual an can be applied to directors, employees and officers ofthe company

Penalties vary - regulatory


11/29

PCI penalties are civil in nature, not criminalMost levels include finesThey can also decide not to allow you to acceptcredit cards anymore

Penalties vary civil


12/29

FFIEC Guidance has NO direct effect, but banks are losing in court (sometimes) based onit

Civil judgments against the bank, based on non-compliance

Other standards may apply in the same way,keeps lawyers busy

Penalties vary civil


13/29

Security incidents these days can be noisy

affairsOrganizational reputations are at stakePerception of shoddy infosec standards can costyou customersUmbrella laws like the Federal Trade

Commissions Unfair Practices Act can be used tocategorize poor behavior and levy fines in lieu ofdirect regulation

Penalties vary market


14/29


15/29

In cases like HIPAA where third party agreements arespelled out, it doesnt necessarily make it simpler

HIPAA is a legal requirement for the covered entity, butthe BA agreements are civilWhile there is no private right of action against a coveredentity (you cant sue them) under HIPAA, the contractualagreement may allow for civil action against third partiesWhile you cannot contractually indemnify parties withrespect to violations of the law (HIPAA violations) youCAN indemnify against contract breach

Sometimes there are no audit requirements, justpenalties for breach or other evidence of non-compliance (e.g. state breach disclosure laws)

Complicated Landscape


16/29

Sometimes, as in the case of US States, regulation isregional

46 of 50 states have laws regarding notification inthe case of breach of Personally IdentifiableInformation (PII.) Each of them are different, someare VERY different.Washington State provides a free pass if the breached entity was PCI Compliant at the time ofthe breach Global companies with information stored inmultiple locations throughout the world have todeal with local law and regulation, wherever theymay be

Whos in charge


17/29

Break 1


18/29

If your customer must comply, they will likely

feel that you need to comply as well.EVERYONE tries to spread the liability aroundEven if folks arent spreading it around,sometimes liability spreads through courtactionEven without liability or regulatory mandate, being responsible for a breach can be painful

Business Realities


19/29

Sometimes, full compliance without therequirement is a marketing tool

Even though you arent currently mandated bylaw, someone in local or federal government isthinking about regulating you count on it.If a customer has to choose between you, and acompetitor that is compliant, you loseMOST government regulations regardinginformation security and assurance are justgood sense guidelines, and fairly weak at that.

Good Sense


20/29

What if you have to comply with:CIPA (Children's Internet Protection Act) CISP (Visa Cardholder Information Security Program)

PA-DSS (Payment Application Data Security Standard) PCI DSS (Payment Card Industry Data Security Standard) Federal Circular A-123 FFIEC authentication in an electronic bankingenvironment guidance FISMA (Federal Information Security Management Act) GLBA (Gramm-Leach Bliley Act) HIPAA (Health Insurance Portability and AccountabilityAct) Sarbanes-Oxley Act of 2002 (Public Company AccountingReform and Investor Protection Act)

This is the SHORT and USA ONLY list

Compliance Costs
http://www.securecomputing.com/index.cfm?sKey=1301http://www.securecomputing.com/index.cfm?sKey=1301http://www.securecomputing.com/index.cfm?sKey=1301http://www.securecomputing.com/pcihttp://www.securecomputing.com/index.cfm?sKey=1301http://www.securecomputing.com/index.cfm?sKey=1301http://www.securecomputing.com/index.cfm?sKey=1301http://www.securecomputing.com/index.cfm?sKey=1301http://www.securecomputing.com/index.cfm?sKey=1301http://www.securecomputing.com/index.cfm?sKey=1301http://www.securecomputing.com/index.cfm?sKey=1301http://www.securecomputing.com/index.cfm?sKey=1301http://www.securecomputing.com/index.cfm?sKey=1301http://www.securecomputing.com/index.cfm?sKey=1301http://www.securecomputing.com/index.cfm?sKey=1301http://www.securecomputing.com/index.cfm?sKey=1301http://www.securecomputing.com/index.cfm?sKey=1301http://www.securecomputing.com/index.cfm?sKey=1301http://www.securecomputing.com/index.cfm?sKey=1301http://www.securecomputing.com/index.cfm?sKey=1301http://www.securecomputing.com/index.cfm?sKey=1301http://www.securecomputing.com/index.cfm?sKey=1301http://www.securecomputing.com/index.cfm?sKey=1301http://www.securecomputing.com/index.cfm?sKey=1301http://www.securecomputing.com/index.cfm?sKey=1301http://www.securecomputing.com/index.cfm?sKey=1301http://www.securecomputing.com/index.cfm?sKey=1301http://www.securecomputing.com/index.cfm?sKey=1301http://www.securecomputing.com/pcihttp://www.securecomputing.com/index.cfm?sKey=1301http://www.securecomputing.com/index.cfm?sKey=1301http://www.securecomputing.com/index.cfm?sKey=1301http://www.securecomputing.com/index.cfm?sKey=1301http://www.securecomputing.com/index.cfm?sKey=1301


21/29

Direct CostsNew infrastructure (new firewalls, IDS, logging

devices)Additional personnelInternal audit and compliance (time)???

Indirect costsOpportunity costsBusiness model restrictions???

Compliance Costs (cont.)


22/29

Direct BenefitMarketing MaterialSales (base on new marketing)Customer audit readiness???

Indirect BenefitProcess improvement (CMM style

improvements?)Risk reduction???

Compliance Benefits


23/29

Break 2


24/29


25/29


26/29

Nobody is demanding anything, we are operatingperforming the service we advertise.

Customers have asked our salespeople if we are PCIcompliant. Our salespeople said Gee, I expect thatwe are, but Ill ask The truth is, we are not PCI compliant, nor is there alegal requirement for it

In a short email, we explained this to thesalesperson, who then asked why not (and CCed theCIO and CEO) Not adversarial, just wants adiscussion since she sees it as a potential negative.

The Issue of the day


27/29


28/29

So far, its just an email conversation but theCIO has called for a meeting of the COO, CIO,Director of Marketing, Director of Operations,You and the Salesperson to discuss.The CFO (your boss) has asked that youresearch the topic and present your findings to

the meeting with your recommendations.Draft an outline of your presentation to themanagement team

Choose Your Response


29/29

Remember, just because you are not forced tocomply doesnt mean its necessarily a bad idea Weigh the benefits and costs of compliance orlack of compliance

Put a mousetrap in your lunchbox

Suggestions for theassignment

Lecture Slides-Lecture 3

Documents

Transcript of Lecture Slides-Lecture 3