S1: Cyber Security implementation core issues in Financial ... Abu-Joudom-Cyb… · Agenda 1...
Transcript of S1: Cyber Security implementation core issues in Financial ... Abu-Joudom-Cyb… · Agenda 1...
Sep 27, 2017
1
S1: Cyber Security implementation core issues in Financial Institutions: Addressing Governance, Risk, and Compliance (GRC) imperatives based on NIST Framework (CSF) and COBIT 5
Agenda 1 • Introduction
2 • Financial Institutions Industry Challenges
3 • Common CyberSec Concerns
4 • 7D H2O Analogy
5 • Cyber Risk Culture
6 • NIST Cyber Security Framework
7 • COBIT 5: One Complete Business Framework
8 • C5: Risk Perspectives – Function & Management
9 • Applying NIST CSF ID.GRC using COBIT
10 • Conclusion & Takeaway
2 Daoud Abu-Joudom S1 Presentation Sep 27/28 2017
3
7D H2O Analogy
LQs
Introduction
Financial Institutions Industry Challenges 1. Competition tough / Clients expectations (Net services) high
2. Technology Risks -> ultimately Business Risks
3. Never closed Env. anymore, Web Services -> Security issues
4. FIs need to address Regulatory Requirements/Compliance on timely basis, Central Banks, PCI,.. -> $$$ Fines?
5. Enabling security Technologies (IDS, MSS) are just tools/services - require specialized staff, processes, internal/application controls
6. Risky Projects (IT, BPO) if not well managed - Need to address IT/Projects risks, Regtech -> Reputational risks
7. Projects /services provided by 3Ps expose risks to be managed
8. Need comprehensive InfoSec/IT/OPS Policies & procedures
9. Systems, business processes, decision making processes, CRM require formalized GRC Processes
GRC=everyone is doing, BUT! … SILOs, & not institutionalized
4 Daoud Abu-Joudom S1 Presentation Sep 27/28 2017
7D D
Common CyberSec Concerns
1. Cyber Threats are becoming very critical for ORGs - investing in expensive security Technologies & Services?
2. To what level are we realizing benefits of our investments?
3. Are SEC Technologies just tools -> work by themselves ?
4. Are we hiring & training specialized staff to implement InfoSec
5. Huge investments>Really becoming immune to Cyber Threats?
6. Do we still believe it is an IT Issue?
7. Or do we holistically address InfoSec programs at Board & Management Levels? – Do they have sufficient assurance?
8. Are we truly formalizing right Governance, Risk, and Compliance (GRC) processes? – Is ERM in strategy setting?
9. Well, what about Security Risk Culture – would that be one CSF for InfoSec Program implementations
5 Daoud Abu-Joudom S1 Presentation Sep 27/28 2017 Challenges
Daddy
Doctor
Defend Drive
Dealer
Direct
Devote
Cyber Risk Culture Home 2 Office (H2O)
Risk Manager
Zealous Vigilant
Family Man
6 Daoud Abu-Joudom S1 Presentation Sep 27/28 2017
Richard F. Chambers, IIA
Story
7D H2O
Cyber Risk Culture Home 2 Office (H2O)
Compliance
Regulations 7 Daoud Abu-Joudom S1 Presentation Sep 27/28 2017
Risk Culture
1. Culture is the keystone that holds things together
2. Providing a source of strength or weakness for ORG
3. Actionable risk culture helps balance inevitable tension
1. (a) Creating enterprise value through strategy & driving performance vs.
2. (b) Protecting enterprise value through risk appetite & managing risk
4. In effect, it balances the push between strategy and risk appetite.
Board of Directors/Management Roles in Promoting Positive risk culture
Source : Establishing-and-Nurturing-an-Effective-Risk-Culture-Protiviti
8 Daoud Abu-Joudom S1 Presentation Sep 27/28 2017
NIST CSF
Structure of NIST Cyber Security Framework
The NIST Cyber Security Framework (CSF) Risk-based iterative approach to the adoption of a more vigilant cyber security posture in the public and private domains.
CSF CORE 9 Daoud Abu-Joudom S1 Presentation Sep 27/28 2017
Functions of NIST CSF Core V 1.0 (2014)
Supply Chain Risk
Management (ID.SC)
Draft V 1.1 2017
COBIT 5 FW 10 Daoud Abu-Joudom S1 Presentation Sep 27/28 2017
V1,1 draft Comments Assessed – Measurement Standards is still debated
Governance of Enterprise IT
COBIT 5
IT Governance
COBIT4.0/4.1
Management
COBIT3
Control
COBIT2
An business framework from ISACA, at www.isaca.org/cobit
Audit
COBIT1
COBIT 5: Now One Complete Business Framework for
2005/7 2000 1998
Evo
luti
on
of
sco
pe
1996 2012
Val IT 2.0 (2008)
Risk IT (2009)
11
© 2012 ISACA® All rights reserved.
Daoud Abu-Joudom S1 Presentation Sep 27/28 2017 COBIT 5 STR
COBIT 5 Structure
12 Daoud Abu-Joudom S1 Presentation Sep 27/28 2017
C5 Risk Persp.
C5: Risk Perspectives
The risk function perspective describes how to build and sustain a risk function in the enterprise by using the COBIT 5 enablers.
The risk management perspective looks at core risk governance and risk management processes and risk scenarios. This perspective describes how risk can be mitigated by using COBIT 5 enablers
C5 R Func Prsp. 13 Daoud Abu-Joudom S1 Presentation Sep 27/28 2017
Risk Function Perspective C5 for Risk defines seven risk principles Provide a systematic, timely and
structured approach to RM Contribute to consistent,
comparable and reliable results Risk principles formalize & standardize policy implementation—both core IT risk policy & supporting policies—e.g., InfoSec policy, BCM policy. Policies provide more detailed guidance on how to put principles into practice
How they will influence decision making within an enterprise.
C5 R Mgm Prsp. 14 Daoud Abu-Joudom S1 Presentation Sep 27/28 2017
Risk Management Perspective
C5 RM Prcs 15 Daoud Abu-Joudom S1 Presentation Sep 27/28 2017
EDM03 Ensure Risk Optimization
Understanding, articulation &
communication of enterprise risk
appetite & tolerance, ensures
identification & management of
risk to enterprise value - related to IT
use & its impact.
The goals of this process are to:
1. Define & communicate risk
thresholds & make sure key IT-
related risk is known.
2. Effectively & efficiently manage
critical IT-related enterprise
risk.
3. Ensure IT-related enterprise risk
does not exceed risk appetite.
APO12 Manage Risk
Continuous identification, assessment
& reduction of IT-related risk within
levels of tolerance set by enterprise
management.
Management of IT-related enterprise
risk should be integrated with
overall ERM. Costs & benefits of
managing IT-related enterprise risk
should be balanced by:
1. Collecting appropriate data &
analyzing risk
2. Maintaining Risk profile of
enterprise & articulating risk
3. Defining risk management
action portfolio & responding to
risk
C5 - Risk Management Processes
C5 & CSF 16 Daoud Abu-Joudom S1 Presentation Sep 27/28 2017
1. Business Environment (ID.BE) 2. Governance (ID.GV) 3. Risk Assessment (ID.RA) 4. Risk Management Strategy (ID.RM)
CSF Identify Function
C5 & CSF 17 Daoud Abu-Joudom S1 Presentation Sep 27/28 2017
C5 is a framework to manage all CSF References frameworks/standards
Applying NIST CSF ID.GRC using COBIT
CSF Business Environment (ID.BE) ORG mission, objectives, stakeholders, & activities understood,
prioritized; -> Inform cyber security roles, responsibilities, & risk management decisions.
18 Daoud Abu-Joudom S1 Presentation Sep 27/28 2017
1. Establish Comprehensive Policies & Procedures /Coverage & Compliance
2. Assess/think of Risk Culture Elements, 3. Implement formal Security Awareness programs -> Assess Progress 4. Define/Assess Risky Business Processes, -. BIA, RA 5. Manage Regulatory/Industry Requirements – formal process/Monitor 6. Manage 3rd Parties & Stakeholders/Users -> effective communication
ID.BE-3: Priorities for ORG mission, objectives, & activities are established & communicated
1. APO02 Manage Strategy 2. APO03 Manage Enterprise Architecture
C5 /CSF GV
Specific C5 Management Practices to be posted
Governance (ID.GV): Policies, procedures, and processes to manage & monitor
organization’s regulatory, legal, risk, environmental, & operational requirements are understood & inform the management of cyber security risk.
19 Daoud Abu-Joudom S1 Presentation Sep 27/28 2017
1. ID.GV-1: Organizational information security policy is established 2. ID.GV-2: Information security roles & responsibilities are coordinated and
aligned with internal roles and external partners 3. ID.GV-3: Legal and regulatory requirements regarding cyber security,
including privacy and civil liberties obligations, are understood and managed 4. ID.GV-4: Governance & risk management processes address Cyber Sec risks
1. EDM01 Ensure Governance Framework Setting and Maintenance 2. EDM03 Ensure Risk Optimization 3. APO01 Manage the IT Management Framework 4. APO13 Manage Security 5. DSS06 Manage Business Process Controls 6. DSS04 Manage Continuity 7. MEA03 Monitor, Evaluate and Assess Compliance With External
Requirements
C5 /CSF GV
20
1. InfoSec Roles & Responsibilities , 2. Authorities & Accountability defined, Coordinated & aligned with
internal roles & external partners 3. CyberSec Regulatory Compliance understood & managed / 4. CyberSec program is mapped, (plan vs. results) -> Monitor and review
changes, 5. InfoSec Program Compliance Monitored 6. Governance & Risk management processes in Place / Board
Oversight Assured, Governance system monitored 7. Risk Management Process Established – maintain Risk profiles – IA &
ORG
C5 /CSF RA Daoud Abu-Joudom S1 Presentation Sep 27/28 2017
Policies, procedures, and processes to manage & monitor organization’s regulatory, legal, risk, environmental, & operational requirements are understood & inform the management of cyber security risk.
Governance (ID.GV):
Risk Assessment (ID.RA): The organization understands the cyber security risk to organizational
operations (including mission, functions, image, or reputation), organizational assets, and individuals.
21
ID.RA-3: Threats, both internal and external, are identified and documented ID.RA-4: Potential business impacts and likelihoods are identified ID.RA-5: Threats, vulnerabilities, likelihoods, & impacts used to determine risk ID.RA-6: Risk responses are identified and prioritized
APO12 Manage Risk APO13 Manage Security
C5 /CSF RA
1. Cyber Sec Governance – Systems, Structure, Policies & Procedures, & Decision Making & Authorities
2. Risk Management Processes, 3. Risk Profile are established 4. IA issues -> Internal Controls defined, Implementation tracked 5. Business Impact analysis (BIA) conducted, 6. BCM/DRP Established and managed
Specific C5 Management Practices to be posted
Risk Management Strategy (ID.RM):
The organization’s priorities, constraints, risk tolerances, and assumptions are established and used to support operational risk decisions.
22
EDM03 Ensure Risk Optimization APO04 Manage Innovation APO12 Manage Risk APO13 Manage Security BAI02 Manage Requirements Definition BAI04 Manage Availability and Capacity
ID.RM-1: Risk management processes are established, managed, and agreed to by organizational stakeholders ID.RM-2: Organizational risk tolerance is determined and clearly expressed ID.RM-3: The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis
C5 /CSF RMS
23
1. Risk management processes well defined – Embed in Policies & Procedures
2. NEVER allow SILOs – Define all Organizational Charters, Roles & Responsibilities among all functions (RM, IT, OPS, Legal, Business)
3. Risk Profiles maintained, Internal Controls, Mitigation Plans tracking, 4. Risk treatment, Risk Acceptance, Based on Risk Appetite, 5. Internal/Application Controls, Addressing IA Issues (could be serious) 6. Organizational risk tolerance, 7. Define & apply effective KRI, Dashboard reporting, and Monitor, 8. Ensure Risks are reassessed – Controls designed & implemented
Con/Tk Awy
Risk Management Strategy (ID.RM): The organization’s priorities, constraints, risk tolerances,
and assumptions are established and used to support operational risk decisions.
Conclusion & Takeaway 1.Every business has an InfoSec and CyberSec risk.
2.“Can this happen to us?” Sadly, answer remains “yes,” as CyberSec risk can never fully be removed
3.BoD/ORG should assess CyberSec risk on a regular or event driven basis, …> After any incident or security event
4.Successful compromise result of either lack of adequate controls or control failure, -> Indicates risk was not assessed accurately & must be reassessed.
5.However, corporate boards can create a culture of security to mitigate risk & better protect their ORG critical infrastructure, data systems & reputation
6.BoD/Management can no longer be content in solely hearing about metrics, resources, and compliance when evaluating corporate success.
7.Increase board awareness -> (CISO) must proactively engage their boards on issues of data confidentiality, integrity, and availability.
8.Recent ransomware, DoS, phishing & other malware attacks are calling for BoD/Management to ask difficult questions about their ORG risk.
24 Con/Tk Awy * CSO Online Articles main points Included
1. Once ORG defined its corporate risks & identified its security expectations, compliance should be met at all levels of ORG
2. Opportunities for risk mitigation -> InfoSec strategy
3. InfoSec Governance is a subset of CG -> provides strategic direction for security activities & ensures CyberSec objectives
4. ORG must mandate development & maintenance of an InfoSec framework that supports & is intrinsically linked with business objectives.
5. Distinction between compliance & security is Critical
6. Conduct BIA to determine current & emerging threats?
7. InfoSec should be woven into fiduciary, oversight & RM purview of ORG
8. After all, benign neglect, indifference or ignorance will not end well & could result in irreparable reputation and product damage
25
Conclusion & Takeaway
S2: CyberSec Audit