1
Q
Zero trust architecture
A
which assumes that threats can originate both outside and inside the network. It emphasises continuous verification of user identity and device integrity, minimising access to only what is necessary
2
Q
AI and machine learning ML
A
re increasingly used for threat detection and response. These technologies can analyse large volumes of data to identify patterns and predict potential security breaches.
3
Q
Ransomware evolution
A
as attacks are becoming more sophisticated, with attackers often using double extortion tactics, where they not only encrypt data but also threaten to publish it if the ransom is not paid.
4
Q
Cloud security
A
is about ensuring the security of cloud environments as cloud adoption has grown almost exponentially. This includes securing data, applications and workloads across public, private and hybrid clouds
5
Q
Supply chain attacks
A
Supply chain attacks are on the rise with attackers targeting the software supply chain by compromising legitimate software updates or vendor systems to distribute malware
6
Q
IoT
A
Internet of Things (IoT) security has become a requirement with the proliferation of IoT devices introducing new vulnerabilities. Securing these devices against potential threats is a growing area of concern.
7
Q
Extended detection and response (XDR)
A
Extended detection and response (XDR) solutions provide a holistic approach to threat detection and response by integrating multiple security products together, improving visibility and response times.
8
Q
Regulatory compliance and data privacy
A
Regulatory compliance and data privacy have come more into focus; due to stricter regulations such as GDPR and the Digital Operational Resilience Act (DORA), organisations are focusing more on compliance and protecting personal data to avoid hefty fines and reputational damage.
9
Q
Quantum computing
A
Quantum computing poses a potential threat to current encryption standards. Organisations are beginning to explore quantum-resistant algorithms to prepare for future security challenges.
10
Q
chief information security officer (CISO)
A
is a senior executive who defines the security posture and oversees all IT infrastructures. They establish the vision for the organisation’s security programme and direct the implementation of cybersecurity operations. CISOs do not normally sit on the board, but are part of the senior management team and support organisation strategy with secure, responsible growth
11
Q
CIO
A
The chief information officer (CIO) is the highest position within an organisation that focuses on information. The CIO provides guidance and leadership to specialists and managers within their department by creating regulations for security procedures. The CIO also considers how data is used and processed, making sure it aligns the company’s technical strategy with its overall go
12
Q
information security manager
A
The information security manager is a leader who oversees information security measures within the organisation. They focus on ensuring the security strategy is implemented and supports the organisation. They will make recommendations to senior management and support the writing of policy and procedure. They also assure the organisation is compliant, from an information security aspect, with any regulation.
13
Q
information security analyst
A
An information security analyst gathers and assesses data to learn more about the organisation’s security profile. They can also work with other security and IT technology professionals to implement security measures and assess their performance. They can help support the selection and implementation of controls, including monitoring.
14
Q
cyber engineer
A
A cyber engineer is a technical employee with an in-depth understanding of computer networking and operating systems including security. They focus on implementing important security measures across the organisation, and may test and implement new security measures. They will work with incident response during and after events to help avoid further incidents.
15
Q
security architect
A
A security architect is an experienced cybersecurity individual who has knowledge across security domains. They maintain the security of an organisation’s IT and information security, working across cyber engineering, information security and IT. They can check designs provided by a solution architect to ensure it meets security requirements, and study existing implementations to identify vulnerabilities and create procedures to manage threats.
16
Q
Pentester
A
Pentesters undertake security checks on systems by exploiting any vulnerabilities they find. They essentially hack with permission from the organisation they have been contracted to undertake the pentest (penetration testing) for. They can test physical, system and web security. In addition to technical skills, pentesters need good written and verbal communication skills.
17
Q
SOC analyst
A
SOC analysts undertake reviewing incidents from phishing through to system breaches within a security operation centre (SOC). They analyse data from security systems and then undertake further investigation as required. They can be tiered depending on their skill level, such as levels 1, 2 and 3. They can work directly for the organisation or be part of a third-party SOC that supports several organisations. A SOC analyst is part of cyber defence often known as the blue team.
18
Q
several recognised standard
A
There are several recognised standards that provide guidance on how to manage assurance arrangements and responsibilities within an enterprise, such as the ISO/IEC 27000 series and the Information Security Forum (ISF) Standard of Good Practice for Information Security (securityforum.org/solutions-and-insights/standard-of-good-practice-for-information-security/). These standards can be adapted to fit individual enterprise requirements.
19
Q
SHOULD BE someone responsibility for the day-to-day management of IA issues.
A
This is to ensure that good IA practice is applied properly and effectively across the enterprise and for co-ordinating all assurance activities. This function should be a full-time role in larger organisations
MANAGER of this function = head of information assurance, the information security manager or the CISO
20
Q
The information security manager needs to understand….
A
The information security risks that the enterprise may face, what controls are in place and where the enterprise may be vulnerable. This information must be communicated effectively to senior management (who have ultimate responsibility for IA).
21
Q
The main activities of the information security manager are:
A
*co-ordinating IA activities across the enterprise, including those delegated outside the team;
*co-ordinating the production of the security policy;
*communicating with users so they understand their IA responsibilities and are aware of potential threats to the enterprise;
*understanding the enterprise’s risk appetite and profile and how it may be evolving;
*monitoring the effectiveness of the enterprise’s assurance arrangements;
reporting on the effectiveness of the assurance arrangements to senior management and suggesting improvements;
*providing expert advice on IA matters to the enterprise;
*creating a culture of good information exchange and assurance practices.
22
Q
Managing assurance responsibilities legal?
A
There are a number of recognised standards that provide guidance on how to manage assurance arrangements and responsibilities within an enterprise, such as the ISO/IEC 27000 series and the ISF Standard of Good Practice for Information Security. These standards can be adapted to fit individual enterprise requirements.
23
Q
Where should IA function be placed in the enterprise structure?
A
depends on culture/structure
IA might be in corporate compliance area; IT group; central facilities group
24
Q
IA function in corporate compliance area
A
in some enterprises, the IA function is located within the corporate compliance area. This is common in enterprises or industries that have a strong compliance culture, such as banking or manufacturing.
25
In effective IA assurance:
reporting structures and roles should include
To work effectively, reporting structures should include
**dotted line responsibilities** to
roles including, but not limited to,
the chief risk officer (CRO),
the senior responsible owner (SRO),
the CIO,
the senior information risk owner and
the chief finance officer (CFO).
26
IA function in IT group
In other enterprises the function is based in the IT group because many (but rarely all) of the controls to protect the enterprise are reliant on computer technology.
27
IA function in central facilities group
Sometimes, the function can be placed within a central facilities group, since assurance responsibilities often span a number of management areas within an enterprise.
28
Scope of IA function can vary:
*, the assurance function may include responsibility for setting policy and direction but not for the actual implementation of the security control mechanisms, which then may be carried out by a separate area such as the IT department or local teams.
* the assurance or audit function can also have responsibility for the implementation of technical security controls and solutions and for conducting investigations and monitoring compliance.
29
As a regulatory role, the IA function should be....
positioned as part of a formal structure so that it can facilitate the full management and co-ordination of assurance matters across the enterprise.
30
IA: Board/director responsibility
One senior person = overall responsibility for protecting the assurance of the enterprise’s information assets and be formally held accountable
(board member or CEO as SINGLE POINT OF ACCOUNTABILITY for IA)
ABILITY TO INFLUENCE Experience has shown that if senior support is not in place, assurance initiatives will probably fail
Some organisations have a CISO too
31
Some organisations have a CISO
CISO is usually...
the CISO is usually the primary person responsible for the overall security strategy, policy and implementation within an organisation.
The main responsibility of this individual is to ensure that appropriate assurance controls are implemented across the enterprise.
32
accountability for PLC's legislation?
There is an increasing quantity of UK and worldwide legislation and regulation that demands this level of accountability and responsibility, for example ‘Sarbanes–Oxley’ (USA) and the Companies Act (UK). The Turnbull Report in the UK states that a board member for a public limited company has to be responsible for ensuring adequate service continuity requirements are in place to prevent the enterprise going out of operation after experiencing a major problem.
33
other legistlation on IA accountability within UK and Europe?
The more recent legislative addition has been the European Union’s GDPR incorporated into UK law alongside the DPA of 2018 that tailors how the GDPR applies in the UK.
Another piece of European legislation, the Network and Information Systems (NIS2) Regulations 2018, has a wide-ranging effect on organisations who are classed as ‘operators of essential services’ (OESs) and ‘relevant digital service providers’ (RDSPs).
34
If these measures are not appropriately implemented in GDPR...
that responsible person could perhaps face a custodial sentence or, in the case of GDPR, huge financial penalties that could be disastrous for an organisation.
35
high level working group
The director should establish and chair an ongoing high-level working group to co-ordinate assurance activities across the organisation to ensure adequate assurance measures are in place to protect the organisation to an acceptable and agreed level of risk, often referred to as the organisation’s risk appetite.
36
Working group:
The group should meet regularly in order to ensure that the protection of information is being managed effectively and that controls are in place to reduce risk to an acceptable level. This includes:
*ensuring that assurance is included in the enterprise’s overall planning activities;
*approving and prioritising assurance improvement activities;
*reviewing assurance performance and changes in threats to assess whether the risk profile of the enterprise has altered;
*assessing the effectiveness of policies, procedures and controls to engender an environment of continual improvement in them;
*ensuring that all legislation and regulatory requirements are being met in an appropriate and effective way;
approving policies, standards and procedures that relate to IA;
acting as evangelists for assurance within the organisation by emphasising its importance to colleagues.
37
The working group is responsible for the level of risk?
The director will normally delegate authority for the development of IA initiatives and responsibilities either to individuals within the working group or to other members of the organisation. **However, the director will be ultimately accountable for achievements or failures.**
38
working group
SHOULD BE made of
steering committee or security forum
should be made of a cross-section of individuals from enterprise, either stakeholders in assurance or responsibilities for
should include LOBs to ensure assurance arrangement meet their org needs
should include information security manager, reps from vested parties (internal audit, HR, physical security, head of IT, outsourcing partners)
meet regularly
39
LOB
line of organisation (LOB) managers or departmental heads to ensure that assurance arrangements meet their organisation demands.
40
responsibilities in IA
Must be clearly defined for roles and teams must understand their role in delivering the overall IA function
Should reflect the enterprise IA policy and current legislation
Reviewed regularly=remain current
supplement with additional guidance
41
What responsibilities be clearly defined for roles and teams must understand their role in delivering the overall IA function
*scope of their responsibilities, level of authority;
*processes they should be following to carry out responsibilities;
*procedure they should carry out to report and deal with any security breaches;
*understanding confidentiality/non-disclosure constraints;
*requirements for regular reporting;
*what if they leave the organisation;
*what if they breach the agreed terms and conditions.
42
Where the IA function does not constitute a full-time role, it is important that those engaged in carrying out assurance activities are given...
a clear mandate by senior management to do so and that the work is included as a formal part of their objectives.
These individuals **must have sufficient skills and tools** to be able to carry out these tasks and **may need training and support** to acquire the necessary knowledge and **fully appreciate the critical nature of protecting information assets**.
43
Local security co-ordinators
* eyes and ears’ at a local level to ensure that security policies are followed and for identifying any security vulnerabilities or breaches
*feedback to security managers on existing assurance processes and controls, identify risks and help propose new controls
*Larger=regional, office locations
*GDPR states requirements :has a designated office or point of contact within the EU if they come under the jurisdiction of the legislation
44
User responsibilities
anyone with access to information assets within the organisation will have a level of personal responsibility for assurance
USER RESPONSIBILITIES
**need to be clearly set out** in an **acceptable** information **use policy** and bolstered by **education** so that they can help to protect against risk
45
Individuals may have specific responsibilities for a particular application or system, and in this case their responsibilities are best expressed in the_______
system operating procedures.
46
Outsourcing
Third-party assurance responsibilities
Should be included in contractual terms and conditions and should include appropriate auditing and monitoring arrangements.
47
Any information assets within an organisation should be associated with____
**an owner of that information**
(i.e. head of department, organisation manager or process owner) who understands its importance to the enterprise and the resulting negative impact if its confidentiality, integrity or availability is compromised. This will help to ensure that adequate controls and procedures are put into place.
48
Statutory, regulatory and advisory requirements
requirements can arise from a variety of bodies such as the police, utility companies, government, trade regulatory bodies or telecommunications suppliers. They may be statutory, regulatory or advisory.
49
Statutory requirements
**legal requirements that must be fulfilled. **
For example, law enforcement agencies must be contacted should certain laws be broken or where they are suspected of being broken – the download of indecent images of children would be such a case in many countries. Compliance with these requirements may influence how an enterprise’s incident reporting procedures are organised; for example, how, when and by whom the authorities should be contacted. Privacy legislation such as the GDPR will influence how information is stored and managed within the enterprise and how resources are deployed to ensure that the enterprise complies with this legislation.
50
Regulatory requirements
**are often imposed by trade bodies, and these specify how an enterprise should operate to conform to certain standards. **
Although they are **not legal obligations**, regulatory bodies have extensive powers and failure to comply could lead to possible fines or, in extreme cases, exclusion from trading in a particular environment. The finance sector is a good example of this as it maintains strict controls to prevent financial malpractices such as fraud or money laundering – official bodies, such as the FCA within the UK, have far-reaching powers. Another example of a regulatory authority in the UK with significant powers is the government agency on health and safety in the workplace. In terms of information, the ICO in the UK is the lead body for setting standards and then enforcing them across all sectors, and also acts in an advisory role to other regulatory bodies – some termed ‘competent authorities’ under the Network and Information Systems (NIS) regulations – who have to concern themselves with IA. Some of these regulatory requirements support or supplement statutory requirements in certain organisation operations.
51
Advisory requirements
**Advisory requirements** may arise from government agencies or utility companies and **provide advice** as to what arrangements should be put into place to help cope with instances such as fires, natural disasters and acts of terrorism. These requirements are not legally binding and are generally issued to help encourage best practice.
52
By understanding the requirements of the emergency services, utility companies and government agencies, enterprises can ______
By understanding the requirements of the emergency services, utility companies and government agencies, enterprises can design their contingency plans and incident management processes and procedures more effectively.
53
Who provides specialist security information advice and expertise to the enterprise?
Those involved in the security function should provide
should have current knowledge
54
security function workers should know everything?
awareness of industry trends, changes to threats, new control measures, analysis of risk, legislation and compliance requirements and the latest technological developments. It is an ongoing process. It is not necessary to have all the answers, but it is essential to be in a position to know where to find this information or to have access to someone with this specialist knowledge as and when needed.
e.g. networking, security forums, IA peers, websites/groups, collaboration, early warnings of possible attacks and vulnerabilities, training courses
55
When do we need external security services?
Larger IA functions support larger teams but can be cost effective to buy specific expertise too expensive to maintain e.g forensic analysis or security penetration
56
pentesting, who?
If external, accreditation
UK: Council of Registered Ethical Security Testers (CREST) provides assessments of companies providing security testing services and individual testers
NCSC established scheme:certified Cyber Security Consultancy, which certifies competent independent consultancy companies who offer information or cybersecurity advice and guidance
57
Who might give advice UK?
NCSC established scheme: certified Cyber Security Consultancy, which certifies competent independent consultancy companies who offer information or cybersecurity advice and guidance
58
A key factor for success is ensuring that everyone that accesses the enterprise’s information knows what is expected of them.
How is this achieved?
Having in place clearly defined assurance roles and responsibilities, and up-to-date security policies and standards and procedures, will eliminate any ambiguities.
They do need to be clearly communicated and be readily accessible.
For example, assurance responsibilities should be included in employee job descriptions and form part of third parties’ contractual conditions.
All users need to understand clearly what will happen if they do not follow IA policies and that senior management will be involved should the rules be breached.
Regular awareness campaigns
59
Which employees need to know what the organisation does to secure information assets?
An organisation requires their employees and third parties to use, manipulate and interpret information and requires their co-operation to ensure that the information assets are accessed in a secure and responsible manner. **All users need to know what the enterprise expects of them with regard to this**.
Policies, standards, procedures and guidelines provide this guidance.
60
Who has the overall responsibility for protecting the assurance of the organisation’s information assets and be formally held accountable to ensure that appropriate security controls are implemented across the organisation?
One senior person/director
They are supported by a working group
61
Why should you involve senior management in the IA assurance process?
Involving senior management will help to endorse the governance process, ensure that adequate resources are made available, ensure that controls are implemented effectively and that any identified security gaps are addressed.
62
POLICY
A policy is a **high-level statement of the organisation values, goals and objectives in a specific area, and the general approach to achieving them**. Although they should be **regularly reviewed**, policies should hold good for some time as they are **not intended to provide either detailed or specific guidance** on **how** to achieve these goals.
For example, a policy might say that each user is responsible for creating and maintaining their system passwords – although it does not say exactly how to do this.
**Policies are mandatory.**
63
STANDARD
More prescriptive than a policy. It **quantifies what needs to be done and provides consistency in controls that can be measured**.
For instance, passwords must contain a minimum of eight characters, be a mix of numbers, letters and special characters and be changed if compromised or for other similar reasons.
**Compliance with standards is also mandatory.**
They should support policy and state what ‘must’ be done and how it should be achieved. Standards can be either general (e.g. handling sensitive information) or technical (e.g. encryption of data), but they should always relate to a specific subject.
64
PROCEDURE
A procedure is a set of detailed working instructions and will describe what, when, how and by whom something should be done. Again, they are obligatory and should support enterprise policies and standards.
65
GUIDELINES
Guidelines are not mandatory, but can provide advice, direction and best practice in instances where it is often difficult to regulate how something should be done (e.g. working practices when out of the office).
66
Whether producing policies, standards, procedures or guidelines, these documents should always be...
*clearly written, concise, unambiguous
*free of complex jargon and acronyms.
*positive not negative ‘do not’ rules (less responsive).
*Document clear and well-defined subject area within its scope for the target audience (e.g. ‘this policy applies to all employees in the UK’).
*endorsed by senior management and clear ownership for **follow-through**
*realistic and enforceable/exceptions?
*consistent/compliant with the law
*regularly reviewed
67
TRUE OR FALSE
every organisation should have a (high-level) assurance policy that states the organisation’s commitment to IA and what it expects to be done to protect its information assets.
TRUE
68
A security policy is a strategic statement of the organisation’s approach to assurance and sets out the formal organisational stance on assurance matters for everyone to see. This security policy should contain statements on:
*how the organisation will manage IA;
*the protection of information assets in accordance with their criticality;
*the compliance with legal and regulatory obligations;
*the means by which users will be made aware of IA issues and the process to deal with breaches to policy and suspected assurance weaknesses;
*policy has the support of the board and chief executive.
*More detailed guidance on what to include from ISO/IEC 27000 series and the ISF Standard of Good Practice for Information Security.
*The high-level security policy should be signed off by the director responsible for IA. *available to all individuals with access to the organisation’s information and systems, both internal and external, in a format that is readily understandable and accessible by the user.
69
Do third parties need to see the security policy?
Third parties often require access to an enterprise’s information assets in terms of processing information, offering support, providing services or processing facilities. It is important to ensure that there is no misunderstanding between the enterprise and the third party over what controls are to be put in place to protect the enterprise’s information assets.
**Policies, standards and procedures should be extended to third parties where relevant, and specific policies may need to be written to cover third-party arrangements.** These should be included within the terms of a contract.** Access should not be given** to an external entity **until** the enterprise can be **assured** that the appropriate controls have been put in place and that the third party has formally confirmed that they understand their obligations and accept their responsibility to comply.
70
Agreements with third parties should include the enterprise’s assurance policy. Again, the ISO/IEC 27000 series and the ISF Standard of Good Practice for Information Security contain guidance on the type of controls that should be considered for inclusion in third-party agreements, but typically they should include the following arrangements:
*management of changes to the application/facility/service/resource;
*the right to audit and monitor assurance arrangements within the third party;
*notification and investigation of assurance incidents and security breaches;
*the timely sharing of relevant cybersecurity information and knowledge;
*recruitment of employees.
Care taken: sensitive information is not disclosed to or by third parties, and policies should reflect demands on the third party for confidentiality and non-disclosure of information.
The third party may, in the process of delivering the service, use further subcontractors or service providers. It is important, therefore, to ensure that any policies, standards, procedures and guidelines are applied to them too, and this can be controlled in the contract.
71
Should third party subcontractors have/follow the security policy?
The third party may, in the process of delivering the service, use further subcontractors or service providers. It is important, therefore, to ensure that any policies, standards, procedures and guidelines are applied to them too, and this can be controlled in the contract.
72
Are operational controls flexible?
There will, however, always be exceptions, and these need to be handled in a consistent manner by having a policy and process in place. This might simply involve informing a senior colleague of the issue and the proposed course of action to deal with the issue in the short term.
73
policy rules may be circumvented or ignored?
Occasionally, due to time pressures, or perhaps because of expediency, policy rules may be circumvented or ignored. Ignorance or a failure to properly understand the policy will prevent compliance, and in these instances users will not understand the risks to their information assets and are very unlikely to be fully aware of the threats to them. Policies and procedures rely on individuals knowing that the policy exists and understanding what the policy expects of them as well as their agreement to comply with it. So, policy controls have limitations.
74
End-user code of practice
high-level security policy should be bolstered by an end-user code of practice or acceptable use policy that provides a readily accessible way of communicating requirements to end users.
75
Acceptable use policy
An acceptable use policy demonstrates the organisation’s commitment to IA and must be approved by the director responsible for IA. It should be published for all users that need to access the organisation’s information management systems and include all employees (permanent and temporary, full- and part-time), contractors and third parties.
76
The acceptable use policy should detail what is expected from users to protect the organisation’s information assets. Elements that may be included in this policy are:
*ensuring that user passwords and PINs are protected appropriately and are not compromised;
*ensuring that users only access information, facilities or equipment for which they have the designated organisational need and requisite authorisation;
*logging-off from systems when leaving a workstation unattended;
locking away sensitive documentation and media when not in use (as part of a clear desk policy, for example);
*use of personal devices such as mobile phones and tablets;
*ensuring that all security incidents are reported.
*An acceptable use policy can also include general statements regarding **behaviour in the workplace**, such as making it unacceptable to make any sexual, racist, obscene, discriminatory, harassing or other offensive statements regardless of the method used to transmit such statements (email, instant messaging, telephone, text, paper or spoken word).
*All conditions of employment for permanent or contract employees should contain a statement that compliance with the enterprise IA policies is mandatory.
*To avoid vicarious liability, the policy should also include statements that specify that users must comply with all appropriate legal and regulatory requirements placed on the organisation.
77
Consequences of policy violation
Anyone accessing the organisation’s information assets needs to know what the consequences of a policy violation are, and this should be clearly stated in the policy, standard or procedure
Appropriate processes should be established for reporting and dealing with violations so that they are dealt with in a consistent manner. Should be documented and agreed with the relevant stakeholders when the documents are produced.
Extreme case: employee disciplinary process, termination of supplier contract or report to law enforcement agency.
78
is policy violation always serious?
However, it is a waste of time having a policy in place unless the organisation is prepared to enforce it. Senior management, and those that have to enforce the rules, need to support the processes to deal with any violations. If violations have not been dealt with appropriately, or have been ignored by line management, then this should also be considered as a violation of policy and treated seriously.
79
Why Review, evaluation and revision of security policy?
remain current, relevant and effective they should be reviewed regularly
80
When Review, evaluation and revision of security policy?
Reviews should take place after any significant changes to either systems or resources or as part of a regular review schedule (e.g. annually).
81
How Review, evaluation and revision of security policy?
A management review process should be established to ensure that policy reviews take place in an organised and timely manner. The review schedule should identify all the people to be involved and a formal record kept of any revisions made – with an explanation as to why content has been incorporated, altered or removed. Senior management should then approve the final version of any amended documentation.
82
Who Review, evaluation and revision of security policy?
The review should involve all the main stakeholders, including external parties and, where applicable, regulatory authorities
83
Review, evaluation and revision of security policy:
The review should focus on factors that might influence or trigger possible amendments, such as:
*changes to technology, processes, organisation, resource availability or working practices;
*changes to contractual, regulatory or legal requirements;
*changes in threats and vulnerabilities;
results, actions and recommendations from any assurance reviews or audits;
*findings and recommendations from either incidents or previous assurance breaches, or where there is evidence of non-compliance with the policy.
84
After completing Review, evaluation and revision of security policy
Once the review has been completed, the revised policy should be communicated effectively to the relevant users, both internal and external to the organisation. This process should also be used for the maintenance of all other assurance documents, such as security standards, procedures and guidelines.
85
independent assurance audits and reviews
Regular independent assurance audits and reviews should be carried out across the organisation to ensure that its information systems are compliant with existing security policies, standards and controls. Possible vulnerabilities to these systems can be checked and the effectiveness of existing controls can be tested.
86
Benefits of Audits?
Audits and reviews provide a good opportunity to understand how well things are working within the enterprise and provide senior management with valuable information on the assurance of their environment.
87
How often Audit?
Audits and reviews should be carried out periodically or when a significant change (e.g. a system upgrade, new threat or vulnerability, a change of risk appetite, etc.) has occurred.
88
Who does Audits/reviews?
To introduce a measure of impartiality into the review, it should be carried out by an **independent party**, which will also bring a fresh set of eyes to it. Ideally, a member of an **audit team** or a manager that has no conflict of interest in its outcome could do this. Alternatively, reviews can be carried out by a third party such as an external auditor or a consulting company.
89
Who can perform a technical review?
*specialist knowledge in areas such as penetration testing with experience of similar
*sufficient expertise
*verify their abilities before commencement.
*Technical testing should only be carried out by recognised and approved technicians and engineer
*CV Background
90
A programme of IA audits and reviews should be introduced by senior management
Scope?
*Senior management should introduce a programme of IA audits and reviews
*Scope and deliverables agreed by senior management and area owner
*Scoping exercise must be completed before starting
*Checklist should be developed to measure assurance control effectiveness
*Outputs must show if (e.g. policy, standard, procedural or technical) controls are correctly implemented and effective in reduce risk to an acceptable level
91
Third party auditors must dos
*Access rights for auditors/reviewers should be restricted to need-to-know
*Access should be monitored/logged to create a reference trail
*Read-only access to isolated system copies
*Restrict audit tools to prevent misuse or data compromise
*Consider legal implications of third-party access to sensitive data
*Dispose of audit outputs (e.g. reports, scripts) securely
*NDAs for sensitive information
*Plan in advance to avoid operational disruption
*Penetration tests may cause unexpected system activity
*Follow change management to inform affected parties
92
audit report/review
*Audit/review results should be recorded in a formal report
*Report presented to senior management and area manager
*Agree corrective action plan with timescales
*Monitor plan regularly to track progress
*Add identified risks to central information risk register
*File all documentation securely for future reference
93
Checks for compliance with security policy
Why
*Carry out regular checks for compliance with policies, standards, procedures
*Checks confirm control adequacy and relevance
*Gauge user understanding and awareness of responsibilities
*Lack of checks leads to reduced user regard for controls
*Assurance weakens if users know monitoring is absent
94
If an instance of non-compliance has been identified, then....
investigate cause of non-compliance (e.g. training, misunderstanding, disregard)
*May result from unrecognised process changes
*Decide appropriate action to prevent recurrence
*Action should match severity of non-conformance
*Minor issues may be handled informally
*Major issues need formal response (such as widespread password sharing)
*Corrective actions should be reviewed for implementation
95
After a compliance check...
*Record results of compliance checks in formal report
*Report serious non-compliance to senior management
*Use findings to inform future policy reviews
*Check licence use complies with purchase terms
*Aim is continual improvement of IA posture
*Reduce risk of breaches and incidents
96
The Sarbanes–Oxley Act
was introduced in 2002 following a number of high-profile financial accounting scandals in the USA. The EU’s governance legislation was revised in 2004 via the Companies (Audit, Investigations and Community Enterprise) Act, which has been implemented across the member states and has replaced most of their local company legislation.
97
Senior management and any regulatory or compliance bodies need to have access to sufficient information to be able to demonstrate compliance. To do this, the following types of information need to be made available:
*high-level risk assessments for enterprise and critical systems
* risk register showing identified risks & management
*up-to-date security policies with review process
*Register any dispensations from policies
*Include results from assurance, security, and compliance reviews
*Report breaches/incidents and actions taken
*Plan to address compliance weaknesses
*Present info in regulator-acceptable format
*Use repeatable process to save time and reuse controls
*May form part of enterprise IA policy
98
COMPLIANCE
there are various models (comprising a methodology, structure and processes) that can be adopted by an enterprise to provide this level of information. All the models tend to be based upon the principles of implementing a formal control process for:
*understand risk and identify control requirements to reduce to acceptable
*implement and monitor security controls
*periodic re-evaluate risk and control effectiveness
*support continual improvement
*models include ISO/IEC 27001, SOMA, COSO
*ISO/IEC 27001 uses PDCA (Plan, Do, Check, Act) cycle
*other standards include NIST and PCI DSS
*develop repeatable process for reporting compliance
*reuse controls across regulatory groups
*may form part of enterprise IA policy
99
SOMA
SOMA, produced by the Institute for Security and Open Methodologies, provides a framework for measuring the operational security and management process and is structured in maturity levels that can be adapted to work at different levels of assurance maturity within the enterprise as well as being used with other standards.
100
COSO
COSO, produced by the Treadway Commission, provides a framework for evaluating effectiveness of assurance by establishing a set of objectives for assurance control and measuring against them. This is often used for testing the effectiveness of accounting controls.
101
PCI DSS
NIST generic , and others targeted at specific industries or activities, such as the Payment Card Industry Data Security Standard (PCI DSS) requirements that govern the acceptance of payment cards.
102
ACTIVITY 3.1
After the recent loss of information, Chris Brown is concerned that he needs to demonstrate to the regulators and external auditors that good assurance controls are in place within Quantum View. How would you provide him with evidence to demonstrate that assurance is being managed effectively?
103
Protection of data
classification systems, effective security countermeasure
104
data might be in what formats
INFORMATION ASSETS
*magnetic, such as external disks, USB sticks, magnetic tape, tablets, mobile phones, digital cameras;
*optical media, such as CD, DVD and even still microfiche;
*paper, such as handwritten notes, printed files, punched tape, blueprints and plans;
*data on Wi-Fi and radio frequency networks;
physical – some devices may have a protective marking because of their design or content;
*email, texts and the myriads of social media platforms such as Facebook, TikTok, LinkedIn, Instagram and X.
105
information assets "value"
value to organisation from IMPACT on organisation/people if contents known to a competitor, foreign country or the public
negligible to grave impact on national security’ for a government, or ‘major loss of goodwill'
106
Government and commercial organisations tend to use different classification terms. The UK government at the time of writing has three levels of classification:
top secret;
secret;
official.
107
agreed impact system
All such assets need to be identified and valued against an agreed impact system; it is another form of risk assessment.
108
Asset classification
OFFICIAL
Official is the lowest level and covers the majority of information that is created or processed by the public sector and organisation operations and services, some of which could have damaging consequences if lost, stolen or published in the media, but not to heightened levels.
109
Other governments, such as the USA, may include classifications such as:
Confidential;
restricted;
protected;
unclassified.
Details of what these levels mean and how information should be handled can be found on the various government websites.
110
Commercial organisations may have a asset classification system such as:
highly confidential;
confidential;
internal only;
public or open.
111
once assets classified then..
once values have been assigned, a set of **rules for handling and distribution of each classification of information must be drawn up to define their use**. The most fundamental guideline is universally referred to as the **need-to-know principle** – information should not be made available to people who do not need to know it. The fewer people that are aware of the knowledge, the easier it is to protect, yet that also presents a challenge in that enough people need to know to make best use of the information.
112
Chinese or ethical wall
For example, in finance the concept of the ‘Chinese’ or ethical wall is used to guard against conflicts of commercial interest and insider dealing of shares. The trick is understanding where the ideal balance point lies for each piece or type of data.
113
How would data of the internal only variety be protected?
probably sufficiently well protected by the normal identification and authentication (ID&A) mechanism for the system, the standard organisation rules and the locks on the doors of the building
114
How would data of TOP SECRET variety be protected?
Data that is ‘top secret’ is often required to be kept in strong safes inside heavily guarded buildings, must be handled in strictly defined ways and can only be accessed by people who have been through an extensive security screening process.
115
DATA CAVEATs
In addition to these protective markings, data can also be given ‘caveats’. These are additional markings that define a finer layer of protection and discretion. Some examples are:
*‘Human resources only’ – employee files with sensitive personal data
*‘Board member eyes only’ – restricted to board members
*‘Commercial in confidence’ – not for competitors
*‘Confidential until …’ – protect info until launch/campaign date
*‘Intellectual property’ – subject to NDAs, may relate to patents
116
Once information given security classification..
it automatically imposes certain constraints on the methods that can be used to process, store, transmit, dispose of or otherwise deal with it. These conditions are imposed on anyone who may come into contact with that information.
117
INFORMATION ASSURANCE PROGRAMME IMPLEMENTATION
PLAN: clear to senior management how assurance programme helps reduce risk, support initiatives, realistic, value for money, fulfil agreed objectives, prior risk assessment
Tactical & strategic, identify where quick wins, cost and appetite
HOW, benefits, controls/effort needed, WHO accountable, tracking and cost/timescales
should always have a SRO (sponsor) and steering committee
REVISIONS, cuts, progress, deliverables manageable, reviewed tracked with meetings and alterations
118
steering committee
steering committee should be set up to track the success of the programme and deal with any issues that arise. Resources and budget will need to be secured before the programme starts.
119
How to present information assurance programmes as a positive benefit
to enterprise as a whole, particular interests of management, add value to organisation,
include early on, shared goals
benefits from their investment
how they can support the programme
cause and potential impacts of risks
informed decision on ROI
120
ROI
Return on investment (ROI) *ROI used to justify assurance spend and gain budget approval
*Balance cost of controls vs. potential incident costs
*Positive ROI supports case for implementation
*Demonstrates financial value of assurance controls
*Assurance can offer competitive advantage
*Helps present assurance as a positive investment
121
information security strategy
plan to transform assurance function to improved state- road map/vision
Strategy time period = possible implement significant change within changes in tech (3-5 years)
122
An information security strategy has the elements of an implementation programme but covers a longer period of time and is pitched at a much higher, less detailed level. It should demonstrate how it will enable the enterprise to achieve its objectives and how it will protect it against current and future threats. It should consider:
*Assess current assurance state, strengths & weaknesses
*Consider changing risk profile from evolving objectives/practices
*Include threat/vulnerability trends & incident types
*Account for software/hardware developments
*Include legal, compliance & audit requirements
*Identify cost-saving opportunities
* concise, non-technical language
*Strategy should be reviewed & updated regularly
*Shows IA maturity & commitment to governance
*External pressure (e.g. regulation) may require strategy
123
information security architecture
The architecture translates organisation requirements for assurance into a set of controls that can be used to protect the enterprise’s information assets
COMMON & CONSISTENT framework across enterprise, across systems , layers of detail of controls
works on PRINCIPLES
E.G. ‘auditing and monitoring controls will ensure that the organisation complies with security policies and legal obligations’
framework of assurance controls easily adaptable/repeated to reduce time/quicker/lower costs
supports defence in depth & defence in breadth through CoCo
124
defence in depth
layers of security can be implemented such that only the most valuable or sensitive information is afforded the highest protection, a pattern for security sometimes called the onion model.
125
Defence in breadth
Defence in breadth can also be covered by information security architecture if the bounds of the organisation are extended, in terms of the information security aspects at least, to include key partners and suppliers. This would mean an organisation setting out their terms and conditions for the security of connections of systems and other logical interactions. These are sometimes referred to as code of connection or CoCo.
126
domains
Components within the enterprise with similar security requirements can be grouped together into ‘domains’ so that common sets of security controls can be developed to protect them. For example, all enterprise systems with web-enabled interfaces can use the same domain controls. The term ‘services’ is used to describe the type of controls that will be used to protect these components.
127
Services
The term ‘services’ is used to describe the type of controls that will be used to protect these components known as domains.
128
Assurance governance processes will identify where existing controls are inadequate and where improvements need to be made. This may be through
the reporting of assurance breaches or via auditing or testing of security controls. Governance processes will also determine changes in regulatory or legal requirements that may require additional controls to be put in place.
129
FEDERAL GOV
Countries that have some form of federal government will have multiple levels of law – such as in the USA, Australia, Canada or Switzerland, where there are local state laws that are subject to national or federal laws.
130
EU laws
Within the EU, there are European directives (agreements between the member states) that have been produced to harmonise pieces of legislation across member states. Each country has to incorporate the legislation into their own legal system, and this can result in subtle yet significant differences as each country interprets the directives in their own way.
131
The ISO/IEC 27000 series provides organisations with guidance regarding compliance with legal requirements and covers the following areas:
intellectual property rights;
protection of records;
data protection and privacy of personal information;
prevention of misuse of information processing facilities;
regulation of cryptographic controls.
132
Personal data laws EU vs USA
The EU has a legal framework via the GDPR to protect all types of personal information, whereas the USA protects personal information via a number of federal statutes. In the EU any protection ceases at the time of death.
specific area :
protection of customer information by financial institutions (via the Gramm–Leach–Bliley Act, GLBA) or preserving privacy of medical information (Health Insurance Portability and Accountability Act – HIPAA).
133
In the UK, the individual has a right to a level of privacy, protected by legislation, which restricts how their personal information can be monitored or intercepted.
UK’s Public Records Acts of 1957 and 1967
Within the UK, the RIPA 2000 was enacted to restrict covert monitoring of an individual’s information. It was introduced to take account of new developments in communications technology, the Human Rights Act and the Telecommunications Directive.
134
Legal accountability
Legal accountability in an organisation refers to the obligation of the organisation and its members to comply with laws, regulations and ethical standards, and to be answerable for their actions.
135
Corporate governance
is overseen by the board of directors, which is responsible for ensuring the organisation adheres to legal standards and ethical norms. This includes establishing internal policies and procedures that align with legal requirements and promote ethical behaviour.
136
Compliance with laws and regulations involves
Compliance with laws and regulations involves adhering to local, national and international laws relevant to the organisation’s operations, including employment laws, environmental regulations, data protection laws and industry-specific regulations. Organisations develop and implement comprehensive programmes to ensure ongoing compliance with applicable laws and regulations
137
UBER CASE STUDY
Driver classification: Uber labels drivers as contractors, avoiding employee benefits
Legal challenges: Lawsuits argue drivers should be employees due to Uber’s control
California AB5: Aimed to reclassify gig workers as employees
Proposition 22: Uber-backed law allowing contractor status with limited benefits
Regulatory issues: Faced fines and bans over licensing and safety compliance
Labour rights: Ongoing demands for better pay, security, and conditions
Data breach (2016): Mishandled user data led to legal and regulatory action
Impact: Sparked debate on gig economy laws and corporate accountability
Ongoing influence: Uber’s case shapes future regulation and worker protections
138
Computer misuse
USA
UK
EU
USA introduced the Computer Fraud and Abuse Act in 1984, and this legislation has since undergone several amendments.
The UK was the first European country to enact a law that specifically addressed computer crime, and this legislation formed the basis of the EU Directive on Computer Misuse. The Computer Misuse Act (CMA) 1990
139
The Computer Misuse Act (CMA) 1990
Introduced three new offences: unauthorised access to a computer;
unauthorised access with the intent to commit or facilitate further offences;
and the unauthorised modification of computer material.
140
The misuse of computers can include:
*illegal access (hacking) to computer systems;
*illegal interception of information;
*interference with information and systems;
*computer-related fraud and forgery;
*commercial infringement of copyrights;
*download of illegal material such as indecent images of children;
*trafficking in passwords, digital signatures and encryption keys.
141
Computer fraud
used to describe stealing money or goods by using or involving a computer
entering incorrect/altering information, creating or altering computer code
142
Organisation fraud
now one of the most common ways of criminals making money from organisations. In a sponsored report researched and written by Dr Mike McGuire in April 2018, titled Web of Profit, Dr McGuire estimated that the theft of intellectual property (IP) and trade secrets alone generates US$500 billion each year for the criminals.
143
phishing
criminals entice individuals to disclose their financial details, e.g. email from bank or senior staff
**obtaining information by deception.**
144
Hacking
accessing a computer system without the express or implied permission of the owner of that system
modify software programs, web defacement, modify data, unpatched software
145
web defacement
Website defacement is an example of where a hacker changes the information displayed on a web page.
146
Malware
Malicious code (or malware) is the term used to describe programs that have been written to cause security breaches or damage to computer systems by installing unwanted and unauthorised code onto them.
deletion/corruption of data, hijacking resources to launch DDoS
147
Malicious code types
viruses, Trojan horses and backdoor
Ransomware
148
Ransomware
Ransomware is an example of malware that infects the target computer by encrypting the owner’s personal files. The victim is then contacted and offered the key to decrypt the files in exchange for cash or information. Dr McGuire estimates that ransomware adds a further US$1 billion annually to the criminals’ gains.
149
TRUE OR FAlSE? The download of illegal material onto a computer is another form of computer misuse
true
150
Misuse includes indecent images?
Many countries have in place legislation that prohibits the download of indecent images of children and of the ‘sexual grooming’ of children using the internet. In many countries there is a legal obligation for enterprises (and individuals) to report the discovery of this type of activity to the law enforcement agencies. It is very likely that legislation such as the Obscene Publications Act in the UK would be used to prosecute cases involving indecent images of children, as the penalties are more severe than in computer misuse legislation.
151
Cyber stalking
Computers can be misused by a person to harass and stalk another individual (cyber stalking), for instance by sending threatening emails that cause distress. It is essential to ensure that policies are in place to provide clear guidance to all computer users as to what constitutes computer misuse. Cyber stalking of this nature is now recognised in the UK under the Public Order Act, the Malicious Communications Act and the Protection from Harassment Act.
152
Piracy
computer misuse
The illegal or unauthorised use of software such as programs, computer games or electronically stored music is known as piracy
Only legitimate software and material used in line with licence agreements should be installed on an organisation’s systems and guidance to computer users that the use of unlicenced material is not allowed should be provided.
153
Requirements for records retention
board minutes, financial reports etc.
minimum length of time vs legislation states when must be destroyed (personal privacy, such as the GDPR (EU) or the Fair and Accurate Credit Transaction Act 2003 (USA).
PROOF OF DESTRUCTION
record retention policy and schedule
documents retained need to be stored in protective format
154
proof of record destruction
An organisation may be asked to produce these records (or proof of destruction) either by a government agency or by an opposing party in a legal dispute. Failure to comply with this could result in a legal judgment against the organisation, heavy fines and closure of the organisation or adverse publicity.
155
record retention policy and schedule.
This should be communicated to staff so that they are aware of their responsibilities. In the case of international organisations, more than one schedule will need to be kept dealing with variances in requirements.
156
documents retained need to be stored in protective format
A document that needs to be retained should be stored in a format that can ensure its protection (for example on a secure central repository rather than in a personal file so that it is not deleted or lost inadvertently). For larger enterprises there are document management solutions on the market to do this
157
Externally produced standards available for legal requirements, for RECORD RETENTION
ISO 15489-1:2016 – Record Management Standards produced by the International Organisation for Standardization,
or standards produced by the American National Standards Institute (ANSI)
158
Intellectual property rights IPR
is the term given to the legal rights that protect creative works, and most countries have legislation in place to protect such intellectual property.
159
Copyright law
initially designed to protect original artistic works such as pieces of music, but its use can also be applied to software programs, computer games, documents, books, photographs, video files or other types of work made using a computer or generated by a computer.
AUTOMATIC for ORIGINAL work for FIXED DURATION
160
infringement
e.g. copyright law controls rights over copying, issuing, performing or adapting it. Abuse of these rights by someone else is called infringement
161
Piracy
Piracy is the term commonly used to describe the unauthorised use of computer software and is a breach of copyright law. Where software has been developed by an enterprise, the copyright is normally owned by the enterprise rather than the individual(s) involved, unless a special provision has been agreed beforehand.
162
Copyright less serious in
such as in Asia and East Asia.
163
Harmonising copyright laws
here have been a number of initiatives to harmonise copyright protection internationally, such as the General Agreement on Tariffs and Trades, Trade Related Aspects of Intellectual Property Rights 1993 (GATT TRIPS).
Within the EU there is a directive to harmonise certain aspects of copyright and associated rights in relation to information systems.
164
The Common Law of Breach of Confidence
aims to protect secrets – personal, commercial or governmental. This can only be applied as long as the data are not in the public domain and covers breaches of confidence made between two or more parties.
165
Trademarks
Trademarks, such as Microsoft® or Apple®, are there to protect brand strength by demonstrating their uniqueness in terms of quality, reputation, reliability, ubiquity, originality, value for money or whatever the brand strives to promote.
166
‘Passing off'
is the term used when an object is trying to seem the same as something else in order to cash in on the originator’s reputation or ideas
167
infringement on information assurance
An example of infringement that could apply to information assurance is when someone has set up an internet domain name that uses a very similar name to another, better-known site. The ‘impostor’ site is branded in much the same way as the original so that people who have mistyped the address believe they have gone to the intended site. This is a typical method of perpetrating banking fraud. Dr McGuire estimates that the trade in illicit and illegal online markets generates US$860 billion each year for the criminals.
168
Patents
are used to protect the intellectual property invested in the development of new products or in the creation of inventions, and, like copyright, they are in place to prevent other people from copying or manufacturing the product or invention so that the creator is able to realise their investment (in both time and money) in creating their original work.
applied to software processes and such things as ‘gestures’, for example, on tablet computers. Within information technology, patents tend to be used to protect physical devices such as a new type of computing device. FIXED DURATION & NEED RENEWAL.
COUNTRY SPECIFIC PATENTS
(many countries expensive-expert advice)
* provision within the EU to protect a patent in 30 countries in a single application, using the European Patent Convention (EPC).
169
Contractual safeguards
Contract conditions should include clauses to ensure that proper assurance controls are in place. Security conditions are often handled via a security schedule within the contract. The type of clauses needed to provide adequate protection might include clauses to:
*carry out regular assurance reviews and health checks;
*apply security patches in a timely manner;
*protect information against malicious code;
*provide organisation continuity arrangements that meet agreed service levels;
*vet new staff to an appropriate level;
*enforce discipline against any security breaches;
*manage security incidents reporting to parent org.);
*protect against disclosure of sensitive information;
*allow the enterprise the right to audit and monitor the services being provided;
*prevent further subcontracting without written authorisation.
*e.g. cloud computing
170
Securing digital signatures
Digital signatures are a form of electronic signature that address fraud issue.
Digital signatures binds, provide non-repudiation, ensures neither can deny transmission
APPS available on mobile/tablets
171
digital signatures UK AND EU REGULATION
Within the UK and EU, the legal regulation Electronic Identification, Authentication and Trust Services (eIDAS) came into force on 17 September 2014
172
eIDAS
*states that electronic signatures will not be denied legal effect or admissibility simply on the grounds that they are in electronic form. *Electronic signatures treated as handwritten signatures if they are backed by qualified certificates, by a certification service provider and created by a secure signature creation device.
* admissible as evidence in legal proceedings both in relation to the authenticity of the transmission and as to the integrity of the contents of communication.
173
CA verify signatures
certification authority (CA) to be deemed trustworthy. CAs have their signatures verified by other CAs to build a greater degree of trust. CAs may be liable for any compromise to the integrity of digitally signed documents authorised by them, so, to limit their liability, many certification authorities stipulate a financial cap on transactions. There have been malicious attacks on digital certification companies, though, and this has led to some significant improvements in recent years.
174
Restrictions on purchase, use and movement of cryptography technology
Cryptography can protect privacy and confidential info
Cryptography legislation varies from country to country (treason, death)
175
chinese , pakistan, eu
cryptography laws
In China, foreign organisations and individuals have to gain permission to use cryptography under the China State Council directive 273 of the Regulation of Commercial Encryption Code. In Pakistan, all encryption hardware and software have to be inspected and approved by the Pakistan Telecom Authority. Even within the EU, there is variance on acceptable use of cryptography. France, for example, has a number of very specific requirements as to how cryptography can be used that are in addition to the EU directives.
176
Wassenaar Arrangement (WA) 1996
controls export of cryptographic controls
agreement was to ensure that transfers of conventional firearms and dual-use goods and technologies between countries were carried out responsibly and did not further the development of hostile regimes.
42 participating countries and, although export controls are implemented by each individual WA participating state, the scope of export controls is determined by Wassenaar directives.
177
The ISO/IEC 27000 series advises that the following factors should be considered in cryptographic methods
*Restrictions on import/export of cryptographic hardware/software
*Restrictions on tools designed to add cryptographic functions
*Restrictions on encryption use
*Authorities may require access to encrypted data
*Regulators may impose additional cryptography constraints
*Industry-specific standards may apply (e.g. finance sector)
*All factors must be considered when applying cryptographic controls
178
Baseline controls
standards used to define how systems should be configured and managed. The intention is that any new system in any location should be built using the settings and guidelines contained in this document. In this case, the concern is about configurations for information security.
179
Baseline control contents:
*which OS versions to use;
*which parts of the OS to install;
*patches required;
*additional applications such as anti-virus software, intrusion detection agents and so on;
*settings for password length, ACLs and so on;
*network configuration.
180
Baseline, take care
*no one size fits all
*email server config differs for web server
*not necessarily secure, new vulnerabilities so patched continuously
181
default passwords
Once an attacker identifies the infrastructure in use, they can try the default passwords, which will often give them administrative privileges and provide an excellent basis for an attack. It is very important that all default passwords are changed as soon as the installation is complete. Since they are for administrative use and provide significant administrative rights to the user, that password needs to be longer and stronger than ordinary user passwords, making it much harder to break.
182
Configuration management and operational change control
process of monitoring and controlling configuration of devices and documentation within the infrastructure
183
configuration documentation
The configuration documentation should describe the baseline that is in place, and it can then be used to identify any changes made.
can be used to help assess changes/impacts before approval, should be updated, might be used in auditing for QA
184
MSPS
organisation has any links to third parties or external suppliers, such as managed service providers (MSPs
185
should third parties work to same IA standards?
they are required to work to the same IA standards and adopt the same working practices, or at least to those that are clearly compatible. If they do not, they may become the weakest link in the chain and can invalidate much of the good work done in-house.
186
How can we ensure third parties work to same IA standards?
The use of working protocol documents and contractual clauses can require them to do so and should allow auditing to ensure compliance. It is becoming more common to see third parties required to have an accreditation such as ISO/IEC 27001 before they can work for an organisation. This provides a degree of confidence in their assurance, including the quality and content of their documentation.
187
security documents should be protected?
protected against unauthorised access and loss
physical/electronic must be safeguarded
knowledge of countermeasures and procedures would allow attacker to find vulnerability in infrastructure and gain access- strictly control access to docs and monitor
protective marking system
188
protective marking system
protective marking system to allow such documents to receive extra protection and safe handling.
189
Failure to comply with accepted standards?
not mandatory but can dissuade potential customers,
can't demonstrate competency
190
ISO
each standard reviewed every 5 years, current
can be purchased though BSI
ISO collabs with IEC and ITU =WORLD STANDARDS COOPERATION
191
IEC
ITU
Work with ISO
International Electrotechnical Commission (IEC) and the International Telecommunication Union (ITU
192
IA management standards
Specifically
ISO/IEC 27000 series, which is the current set of standards for information security management.
(others cover explicit technologies, techniques or architectures used within IT)
193
ISO/IEC 27000
specific IA management
mainly 27001 and 27002
risk management--27005
network security-27033
infosec in health sector 27799
cloud resources- 27017
194
ISO/IEC 27001
Specifies the ISMS requirements standard
195
ISO/IEC 27002
ISO/IEC 27002 provides a code of practice for information security management. It is probably the most influential standard for IA management. It describes a high-level set of controls to protect the confidentiality, integrity and availability of an organisation’s information assets, and looks at the various aspects of assurance such as security policy, IA employees, asset management, human resources assurance and compliance.
196
ISO/IEC 27001 VS 27002
ISO/IEC 27002 is a generic advisory document rather than a formal specification like ISO/IEC 27001.
197
ISO/IEC 27007:2017 provides
ISO/IEC 27007:2017 provides guidelines for auditing ISMSs, helping auditors to assess the compliance with ISO/IEC 27001.
198
in order to use ISO/IEC 27002...
In order to use the standard, the organisation will need to assess the risks of their enterprise and apply the recommended control measures from the standard that are applicable to mitigate these risks.
199
ISF’s Standard of Good Practice for Information Security for IA,
reviewed by them every year. This standard focuses on how IA can support organisation processes and provides guidance on implementing appropriate protection. It focuses on security governance, security requirements, control framework and security monitoring and improvement. The ISF membership (who are in the main corporate organisations) fund the forum via an annual subscription, and then collaborate with them in developments for best practices in IT security and information risk management. However, the Standard of Good Practice for Information Security is available to other organisations or individuals.
200
notes on other standards
Many other standards not produced exclusively for IA that do affect IA management.
Cover other related organisation functions or processes such as retention of records (ISO/IEC 15489), the implementation of organisation continuity (ISO/IEC 22301:2019 and PAS 77), project development (COBIT), the management of information technology services (ISO/IEC 2000 ITIL) and quality assurance (ISO/IEC 9001). If these standards have been implemented within an organisation, it is necessary to ensure that IA management controls are compatible with them and support their requirements. For example, ISO/IEC 20000–1:2018 Information technology – Service management includes requirements for operational security.
It is necessary to be familiar with the standards that apply to the country and industry sector in which the organisation operates. There are a wide range of standards to which the financial and manufacturing industries need to adhere, and an inability to meet these requirements could, for instance, prevent an organisation from actively trading in the financial services market.
201
Internet Engineering Task Force (IETF)
large, open, international community that develops and promotes standards for the internet.
*governing body meets 2/3 times a year.
*Standards developed by working groups (network designers, operators, vendors and researchers, that each focus on a particular topic)
*Standards =RFC
*issued to IETF community as draft RTCS
202
RFC
IETF STANDARDS:
The standards generated are known as Request for Comments (RFCs), and upon production are subsequently issued to the IETF community as draft RFCs for comment and review. Once an RFC has been issued it is not withdrawn, although it may in time be superseded by further RFCs. This, in many ways, can show the development of standards. The published RFC documents have a status of either a proposed standard or an informational statement.
203
Federal Information Processing Standards Publications (FIPS PUBS)
are standards and guidelines developed and issued by the NIST for federal government computer systems within the USA. Where possible, the US federal government uses existing (internationally recognised) published industry standards, but should none be suitable it will ask NIST to help develop them. NIST collaborates with national and international standards committees such as IETF and other interested parties (such as vendors and industry bodies) to produce FIPS PUBS.
204
the European Telecommunications Standards Institute (ETSI)
based in france,
*ETSI standardises ICT across Europe
*Recognised by European Commission & EFTA
*Provides technical specs for directives & regulations
*CE mark shows product compliance
*Members include manufacturers, operators, providers, researchers, users
*Members set work programme & approve deliverables
*Docs available via ETSI Documentation Service (EDS)
205
ENISA
The European Union Agency for Network and Information Security (ENISA)
*ENISA provides guidance based on research
*Focus on human aspects of InfoSec
*Includes psychology, sociology, anthropology, biology, behavioural economics
*Explores human behaviour in security context
206
The Digital Operational Resilience Act
DORA
EU reg jan 2022
recovery from ICT disruptions
Key provisions include **implementing robust ICT risk management frameworks**, promptly **reporting** major ICT-related incidents, conducting regular **resilience testing**, managing risks from third-party ICT service providers and promoting information sharing on cyber threats among financial entities
207
INFORMATION SECURITY FRAMEWORKS
what are they?
structured sets of guidelines/best practices
help org. manage/protect their information assets
frameworks designed for comprehensive approach to infosec, ensuring sensitive data protected from unauthorised, breaches using controls
208
development of an infosec programme..
Information security frameworks support the development of an information security programme, starting with risk assessment and the identification of control objectives and key controls. These are defined by standards such as NIST CSF 2.0, ISO27001:2022, CIS 18 and Cyber Essentials.
209
ACTIVITY 3.2
Chris Brown is very pleased with the work that you have done so far on information assurance and has given you a budget to implement some additional access controls within Quantum View. How would you approach this?
210
1. Which of the following activities should NOT be handled by the information assurance function?
a. Monitoring the effectiveness of the enterprise’s assurance arrangements.
b. Providing advice on information assurance.
c. Effectively delivering a secure environment across the enterprise.
d. Reporting on the effectiveness of the enterprise’s assurance arrangements to senior management.
c
211
2. Where should the information assurance function be placed within the enterprise so that it can facilitate full management co-ordination of assurance across the enterprise?
a. Within the compliance function.
b. At board level.
c. It will depend on the structure of the enterprise.
d. Within the IT group.
c
212
3. What is the key role of the board director with responsibility for information assurance?
a. To ensure that appropriate security controls are implemented across the enterprise.
b. To have a detailed understanding of the threats facing the enterprise.
c. To implement information assurance solutions across the enterprise.
d. To provide day-to-day management of the information assurance function.
a
213
4. Clearly defined responsibilities for information assurance should include which of the following?
a. Operating procedures and reporting requirements.
b. The scope of the responsibilities and level of authority granted.
c. Disciplinary procedure.
d. None of these three.
b
214
NIST CSF 2.0
fun fact
established in response to an executive order by former President Obama in 2013. This called for greater collaboration between the public and the private sector for identifying, assessing and managing cyber risk.
215
NIST CSF 2.0
versions
1.0 2014
1.1 2018
2.0 2024
developed through workshops, comments, analysis and draft to reflect current security challenges
216
NIST CSF 2.0
FUNCTIONS
GOVERN (underpins)
Identify, Protect, Detect, Respond and Recover
(concurrently and continuously)
217
NIST CSF 2.0
FUNCTIONS
GOVERN
Govern is used to ensure all the other functions align with the organisation requirements and are measured and managed. Leadership is an essential element of this.
218
NIST CSF 2.0
FUNCTIONS
IDENTIFY
Identify is used to develop an overall risk management approach to cybersecurity. It helps understand critical assets, organisation environment, governance model and supply chain
219
NIST CSF 2.0
FUNCTIONS
PROTECT
Protect is used to put defensive controls in place based on critical assets, to ensure they are protected within risk tolerance. Protect highlights the importance of managing identities, securing access, protecting data and training users.
220
NIST CSF 2.0
FUNCTIONS
DETECT
Detect is used to ensure an attack is detected in the shortest time possible and detection systems are in place by spotting anomalies, investigating events, continuously monitoring and other detection processes.
221
NIST CSF 2.0
FUNCTIONS
RESPOND
Respond is used when under attack, and the quicker an organisation can respond the quicker it can reduce harm. Respond helps to ensure an organisation takes action as quickly as possible through incident response planning, analysis, mitigation, communication and ongoing improvement.
222
NIST CSF 2.0
FUNCTIONS
RECOVER
Recover is used to return to normal operations, in other words the same state, after the attack. The Recover function helps the organisation restore operations through recovery planning, continuous improvement and communications.
223
NIST CSF version changes
*Governance included
*CSF 2.0 has expanded best practices.
*Organisational Profiles
*community profiles
*Revision 5: outcome based approach
*removed the limiting term ‘information system’
224
NIST 800-53
PURPOSE
PROBLEMS
NIST 800-53 is the catalogue of security controls for information systems and organisations, serving as a comprehensive guide for safeguarding sensitive data.
Adherence to NIST 800-53 assures compliance with the Federal Information Systems Management Act, which is required for federal government agencies and government contractors.
NIST 800-53 has more than 900 security controls, organised into 18 control families.
The current revision, Revision 5, released in 2020, dropped the word ‘federal’ to broaden the scope of the guidance, making NIST 800-53 applicable to all organisations.
The main problem of the NIST framework is the number of controls and granularity. One method to remedy this is to go through the controls and remove all the ones that do not apply to your organisation.
225
Organisational Profiles NIST CSG
Organisational Profiles, which are used to describe current and future security postures, making it easier to set goals and define the practice required to meet these goals.
226
NIST CSF Community profiles
Community Profiles, which are created to address shared security interests and goals common with many organisations that occupy the same sector or subsector and use similar technologies or have similar threat types
227
NIST recommends following their seven-step process when establishing a cybersecurity programme, as well as when reviewing previously existing cybersecurity programmes to determine how they measure up.
***Prioritise & scope** – define objectives, identify key assets
***Orient** – continue implementing the cybersecurity programme
***Current profile** – assess which CSF controls are in place
***Risk assessment** – analyse environment & likelihood of threats
***Target profile** – define desired control outcomes & risk appetite
***Gap analysis** – identify & prioritise gaps using risk/cost/benefit, allocate resources
***Implement Action plan** – implement steps to close gaps in chosen order
228
ISO/IEC 27001
international standard for ISMSs part of ISO 2700 series
Most important= 27001 HOW to manage all aspects of security
provides a systematic approach to managing information so that it remains secure. It includes people, processes and IT systems by applying a risk management process.
229
Figure 3.2 ISO 27001 process" illustrates a simplified flow of achieving ISO 27001 certification. Here's a summary of the process:
*1 **Business** – Organization initiates the process
* 2**ISO 27001 Standards** – Refer to the framework for information security
* 3**Gap Analysis** – Identify gaps between current practices and standards
* 4**Implement Controls** – Apply necessary security measures
*5 **Certification** – Undergo external audit for compliance
* 6**Verified** – Achieve certification and confirm adherence
230
ISO 27001 requires you to:
*systematically examine information security risks, taking account of the threats, vulnerabilities and impacts;
*design and implement a comprehensive set of information security controls with other forms of risk treatment to address those risks that cannot be accepted;
*adopt an overarching management process ensuring information security controls continue to meet the information security needs, ongoing basis.
231
ISO 27001: 2022 controls new
The 11 new controls in the 2022 revision are
A.5.7 Threat intelligence
A.5.23 Information security for use of cloud services
A.5.30 ICT readiness for organisation continuity
A.7.4 Physical security monitoring
A.8.9 Configuration management
A.8.10 Information deletion
A.8.11 Data masking
A.8.12 Data leakage prevention
A.8.16 Monitoring activities
A.8.23 Web filtering
A.8.28 Secure coding
231
Process of ISO 27001 CERTIFICATION:
3 stage process
**Stage 1** is an initial review of the ISMS. This includes checking for the existence and completeness of key documentation.
**Stage 2 ** is a more detailed and formal compliance audit.
Ongoing involves follow-up reviews or audits to confirm that the organisation remains in compliance.
232
ISO 27001:2022 controls
114 to 93 controls new/merged found in Annex A, provides list of control objectives too in four themes
2022 11 new controls
233
ISO 27001:2022 controls sit within these 4 themes
**Organisational controls**: Covering information security policies, roles and responsibilities, as well as human resource security, among others.
**People controls**: Focusing on areas such as access control, user responsibilities and security awareness and training.
**Physical controls**: Encompassing physical and environmental security to protect information and systems from physical threats.
**Technological controls**: Addressing controls related to secure configuration, network security and information security in supplier relationships.
234
5. Which would be the best way to hear about and plan for any regulatory changes to your industry that may affect information assurance?
a. Permanently employing consultants.
b. Scanning bulletin boards and websites for snippets of information.
c. Waiting until the changes are announced in the press.
d. Maintaining a relationship with regulatory bodies for the industry.
d
235
ISO 27001 CLAUSES
The ISO 27001 clauses are the core pillars of the ISMS. Think of clauses as sections. Clauses 4–10 list every requirement the ISMS must meet before it can be ISO 27001 certified.
Clauses 0–3:
introduction;
scope;
normative references;
terms and definitions.
Clauses 4–10 (provide ISO 27001 requirements):
context or employee;
leadership;
planning;
support;
operation;
performance evaluation;
improvement.
236
CIS 18
*Centre for Internet Security
*Version 8: April 2021
*V8: CIS enhances controls; address threats to systems and software, increased use of cloud computing, virtualisation mobility, outsourcing, working from home and changes in attack tactics.
*controls prioritise actions/best practice for defence in depth
*developed from wide sector/first hand experience
*controls, goals with guidelines=checklist best practice, more guidelines= stronger security posture
237
CIS 18 CONTROLS
CIS Control 1: Inventory and Control of Enterprise Assets
CIS Control 2: Inventory and Control of Software Assets
CIS Control 3: Data Protection
CIS Control 4: Secure Configuration of Enterprise Assets and Software
CIS Control 5: Account Management
CIS Control 6: Access Control Management
CIS Control 7: Continuous Vulnerability Management
CIS Control 8: Audit Log Management
CIS Control 9: Email and Web Browser Protections
CIS Control 10: Malware Defences
CIS Control 11: Data Recovery
CIS Control 12: Network Infrastructure Management
CIS Control 13: Network Monitoring and Defence
CIS Control 14: Security Awareness and Skills Training
CIS Control 15: Service Provider Management
CIS Control 16: Application Software Security
CIS Control 17: Incident Response Management
CIS Control 18: Penetration Testing
238
Benefits of CIS 18
* **Enhanced security** – Provides a comprehensive set of best practices to defend against a wide range of cyber threats
* **Simplified framework** – Offers a prioritised and simplified set of controls that are easier to implement and manage
* **Improved compliance** – Helps an organisation align with various regulatory and compliance requirements by providing a clear security roadmap
* **Scalability** – Suitable for organisations of all sizes, from small organisations to large enterprises
* **Resource efficiency** – Helps in the efficient allocation of resources by focusing on the most critical security measures
* **Continuous improvement** – Encourages regular updates and continuous monitoring to adapt to the evolving threat landscape
239
CYBER ESSENTIAL
UK government-backed certification scheme designed to help organisations protect themselves against common online threats.
*offers a clear set of basic security controls implement to mitigate the risk of cyber-attacks.
REQUIREMENT for organisations with government contracts.
*controls aimed at protecting against the most common internet-based threats, and cover five key areas.
240
Cyber Essentials key areas
The controls are aimed at protecting against the most common internet-based threats, and cover five key areas.
* **Secure configuration** – Ensure systems are securely configured; remove unnecessary functionality and accounts; replace default settings with secure ones
* **Patch management** – Keep systems and software up to date; regularly apply security patches to fix known vulnerabilities
* **Malware protection** – Use anti-virus and anti-malware solutions to defend against malicious software
* **Firewalls and internet gateways** – Protect internet connections with firewalls; block untrusted networks and provide a first line of defence
* **Access control** – Restrict access to data and services; manage admin accounts securely; ensure only necessary access is granted
241
CYBER ESSENTIALS PLUS
* **Advanced level of Cyber Essentials** – Requires hands-on technical verification by an independent certification body
* **Not self-assessed** – Unlike basic Cyber Essentials, this involves external testing
*Assessment includes: security of internet-connected devices, firewalls, anti-malware configurations, secure configurations, user access controls and the application of security patches.
242
Steps to obtain Cyber Essentials Plus certification
* **Initial Cyber Essentials certification** – Complete the self-assessment covering five key controls
* **Pre-assessment preparation** – Internally review and remediate cybersecurity measures
* **Engage a certification body** – Select an accredited body to conduct the technical verification
* **Technical verification** – Includes external/internal scans, configuration, malware, and access control reviews
* **Remediation (if required)** – Fix any issues found during assessment
* **Certification** – Issued if all requirements are met; valid for one year
243
cyber essentials plus certification: Technical verification: The certification body conducts a thorough examination of the organisation’s IT systems. This typically includes:
* **External vulnerability scan** – Assesses exposure of internet-facing systems to common threats
* **Internal vulnerability scan** – Checks internal systems for vulnerabilities post-breach
* **Configuration review** – Examines device and software configurations for security
* **Malware protection review** – Tests effectiveness of anti-malware measures
* **Access control review** – Verifies enforcement of access controls and authorised access only
4th edition CISMP
flashcards
Decks in class (15)
# Cards
-
1 INFORMATION SECURITY PRINCIPLES139
-
2 INFORMATION RISK142
-
ABBREVIATIONS238
-
GLOSSARY128
-
3 INFORMATION SECURITY FRAMEWORKS244
-
4 SECURITY OPERATIONS280
-
5 SECUIRITY LIFECYLCE AND DEVSECOPS107
-
6 TECHNICAL SECURITY253
-
7 PHYSICAL AND ENVIRONMENTAL SECURITY28
-
8 DISASTER RECOVERY AND DIGITAL FORENSICS99
-
9 EMERGING TECHNOLOGIES113
-
Specimen20
-
Misc Qs20
-
AI questions22
-
chapter 889
