M3 & M4 & M5 S3 ISC CPA

Risk Management Framework

Framework that outlines a comprehensive process to manage risk by applying the four components (“FARM”)

1. Risk Framework ←- Helps make risk-based decisions by identifying environment;; forms strategy

2. Assess Risk ←- Identify threats, vulnerabilities, harm, and likelihood of harm

3. Respond to Risk ←- Develop alternative actions

4. Monitor Risk ← Determine ongoing effectiveness of risk responses

Risk Framework

Component of risk management framework that defines or frames the environment in which risk-based decisions are made

• Helps form a strategy that enables the organization to assess, respond to, and monitor risk

• Companies identify:

1. Risk assumptions

2. Risk constraints

3. Risk tolerance

4. Priorities and trade-offs

Assess Risk

Component of risk management framework that identifies threats, vulnerabilities, potential harm, and likelihood of harm

• This component addresses the way the organization assesses risk in the context of the established risk framework

Respond to Risk

Component of risk management framework that develops alternative actions, evaluations of alternative actions, consideration of actions juxtaposed to risk tolerance, and implementation of risk responses

• Purpose of this component is to provide a consistent, organization-wide response based on the risk assessment results

Monitor Risk

Component of risk management framework that determines of the ongoing effectiveness of risk responses, the identification of risk-impacting changes to organizational systems and environments, and the verification that planned risk responses are implemented

• Purpose of this component is to evaluate and monitor risk over time

Security Assessment Report (SAR)

A report that serves as evidence of control compliance and documents the findings of the assessor; provides a disciplined and structured approach for documenting the

findings of the assessor and the recommendations for correcting any identified issues or vulnerabilities in the security controls

• Procedures/ assessment (methods) included in a security assessment engagement include Examination, Interviewing, and Testing

Key Items

1. Summary of Findings - Synopsis of key findings/ recommended actions

2. System Overview - Outlines info. system being assessed

3. Assessment Methodology - Techniques/ procedures used

4. Security Assessment Findings - Gaps & deficiencies that were discovered

5. Recommendations - Direction to remediate deficiencies

6. Action Plan - Roadmap that covers steps to remediate deficiencies

Determination Statements are made assigning grades to procedures performed by assessor

• Satisfied (S) ←- Assessment objective was met

• Other than satisfied (O) ←- Could not obtain sufficient information that meets objectives

Examination

Procedures included in a security assessment engagement that is the process of analyzing, observing, and reviewing one or more assessment objects, such as job roles, security specifications, security activities, or relevant operational controls

Interviewing

Procedures included in a security assessment engagement that involves having individual or group discussions to better understand, collect, and evaluate evidence

Testing

Procedures included in a security assessment engagement that’s the process of testing assessment objects that reflect how the object performs in its current state compared to a target or expected state

Security Awareness Program

Successful security program components:

1. Phishing simulations - Teach employees to recognize phony emails

   1. Click Rate, Re-click Rate, Report Rate, Non-responder Rate, Reply Rate

2. Program supporters & champions - Lead the effort of implementing security platform

   1. Employee consultation, Security behaviors (with/ without champions), Champion density vs. security behavior

3. Employee engagement

   1. % of employees who complete training, Average time taken per training session

   2. Count of employees who attended training session

4. Metrics to measure success

Privacy

The right of a party to maintain control and confidentiality of information about itself; the process of protecting human autonomy and dignity

• Protects the rights of an individual and gives the individual control over what information they are willing to share with others

Confidentiality

Preserving authorized restrictions on access and disclosure of data, including means for protecting personal privacy and proprietary information; protects unauthorized access to information gathered by the company

Personal Identifiable Information (PII)

All data that can be used to identify an individual, including:

1. Name

2. Personal identification numbers: Social Security, passport number, driver's license number, taxpayer identification number, or credit card number

3. Address

4. Personal characteristics: Photographic images, fingerprints, handwriting

NIST Privacy Framework

A tool for improving privacy through risk management procedures and communication methods employed throughout the organization

• Purpose is to help organizations manage privacy risks by:

1. Consider privacy best practices as they design and deploy systems, products, and services that affect individuals

2. Communicate privacy practices

3. Encourage cross-organizational workforce collaboration relating to user privacy and IT security

Privacy Safeguards

Common operational safeguards, privacy-specific safeguards, and security controls an organization can use to manage PII and proprietary information:

1. Data Collection

   1. Create Policies and Procedures: Comprehensive policies and procedures for protecting the confidentiality of PII and proprietary information

   2. Conduct Training: All individuals receive appropriate training to understand the relevant guidelines

2. Data Processing

   1. De-identifying Personal Info: De-identify records by removing enough personal information such that the remaining information does not identify an individual ←- Pseudonymization

3. Data Storage

   1. Using Access Enforcement: Control access to personal information through access control policies and access enforcement mechanisms

   2. Implementing Access Control for Mobile Devices: Prohibit or strictly limit access to personal information from portable and mobile devices

   3. Auditing Events: Monitor events that affect the confidentiality of personal info.

4. Data Transmission: Protect the confidentiality of information transmitted through encrypting info before its transmitted

5. Data Deletion/ Purging: Policies to determine data sets subject to be archived or purged

   
   

Data Obfuscation

The process of replacing production data or sensitive information with data that is less valuable to unauthorized users

1. Encryption

2. Tokenization

3. Masking

Tokenization

Type of obfuscation method that removes production data and replaces it with a surrogate value or token

• Tokens can be generated using random number generators; by hashing, which transforms data using mathematical algorithms; or by encryption

• Does not change length or type of characters

• Used in credit card transactions

Masking

Type of obfuscation method that swaps data with other like data so that the original identifying characteristics are disguised, or masked, while maintaining a similar structure to the unmodified data set; modified data set's aggregate value remains intact, allowing insights and the data to be extracted

• Shuffling, scrambling, substitution, nullifying, and masking out, in which all or part of the data's value is swapped with a single character, such as an asterisk.

Data Encryption

A method of mitigating the risk of data breaches and data loss through the application of cryptography so that data is protected during its collection, processing,

and storage

• Uses algorithm to transform plaintext data into cipher text

Two Forms of encryption:

1. Symmetric Encryption

2. Asymmetric Encryption

• Primary goal is to safeguard data by transforming it into an indecipherable form to prevent unauthorized access.

Symmetric Encryption

Method of encryption that involves a single shared or private key for encryption and decryption of data within a group

• Private key is used by all members of the group to both encrypt and decrypt data

• Protects the data exchanged between a user's device and the VPN server

• Both parties use the same key to encrypt and decrypt the message so that the key must be shared

• Handles bulk data encryption

Drawback = Does not facilitate non-repudiation, given that any person with the shared key can encrypt and decrypt messages; cannot tell where message originated

Asymmetric Encryption

Method of encryption that uses two keys, a public key and a private key, where the public key is used to encrypt the message and the private key to decrypt it

• Adds extra security because only the two opposite keys can be used in tandem, which would make it ideal for a digital signature of an electronic document with sensitive information and blockchain

• Drawback = Relies on complex mathematical operations involving large key sizes, making it far too slow and resource-intensive to practically encrypt large volumes of data

  • Best for small data items

Cipher

The result of applying encryption algorithms that encode unencrypted messages into an encrypted form

1. Substitution Ciphers

2. Transposing Ciphers

Substitution Ciphers

Algorithms that replace each character of a plaintext message with another character

Transposing Ciphers

Encryption technique that rearranges the letters of a message to form unreadable ciphertext, often by using a matrix to perform columnar transposition

Data Loss Prevention (DLP)

System that enables organizations to detect and prevent attempts by employees or unauthorized users to transfer sensitive information out of the organization electronically across multiple protocols, ports, and communication methods

1. Network-Based

2. Cloud-Based

3. Endpoint- Based

Network-Based DLP

Type of DLP system that scans outgoing data that meet specific criteria and are transmitted using means such as email, file transfer protocols, and direct messaging

Endpoint-Based DLP

Type of DLP system that scans files stored or sent to devices outside of a network, such as a printer, USB drive, or any other device that data can be transferred

Read-Through

Involves distributing security, confidentiality, and privacy procedures to members IT and non-IT departments supporting the walk-through for review; lets an organization inform personnel of tactical and strategic procedures and review plans for obsolete information

Walk-Through

Takes the read-through one step further by role playing/simulating a disaster scenario related to security or a confidentiality and privacy scenario in which an attacker is attempting to obtain data for personal gain and having team members use the procedures in place to prevent the attack and ensure the data leaked cannot be deciphered

• Occur in phases:

1. Plan and Prep

   • Define the scope, Identify key controls and processes, Identify personnel

2. Obtain an Understanding

• Review documentation, Interview personnel, Create notes

3. Perform Walk-through

• Re-perform processes, verify results and effectiveness

4. Create Documentation

• Create workpapers, document procedures

5. Test

• Test controls identified in walk-through, Obtain samples if needed

6. Evaluate and Report

• Interpret results, Prepare a report to summarize findings, Provide recommendations

Public Key

Key in encryption that’s used to verify digital signatures

• Private key is used to create the digital signature, whereas the corresponding public key must be made available to users who need to verify the signature's authenticity. The public key allows users to confirm that the document was signed by the holder of the private key and hasn't been altered.

Digital Signature

A means of ensuring that the sender of a message is authentic by using encryption so that the recipient of a message can be assured that it is from the sender that is shown

Hashing

A cryptographic process used to ensure data integrity, securely store passwords, and authenticate digital messages

Incident Response Plan (IRP)

Documentation of a set of procedures, people, and information to detect, respond to, and limit consequences of a cyberattack against an organization

• Include: Roadmap for implementing incident response capabilities detailing the method of detection, response timeline, and incident response team's responsibilities

  • IR timeline - Charted when incidents occur to help clearly delineate the points at which an incident is detected, contained, and eradicated

  • Detection Methods…

    • Vulnerability scanning, anomaly detection, EDR solutions, file integrity monitoring, log analysis, IDS, IPS, physical security monitoring SIEM solutions, threat intelligence software, User Behavior Analytics (UBA) tools

  • Critical component = Human capital/ People

    • Senior management ←- Champion for incident response management

Main focus = Intrusion Detection

• 
  

Centralized Incident Response Team

Model where a single incident response team is responsible for managing incidents across the organization

• More effective for smaller organizations; organizations that are not distributed geographically

Distributed Incident Response Team

Model where there’s multiple response teams responsible for specific logical or physical segments of a company’s network

• Effective in organizations that have widespread geographical computing resources.

Coordinating Team

Secondary function that may be part of a distributed or centralized incident response team

• Team coordinates with other departments without having authority over those teams and dispatches them

NIST’s Computer Security Incident Handling Guide

Recommendations by NIST that companies should consider when selecting staffing model for incident response teams:

1. 24/7 Availability: Staff available 24/7 either by phone or on-site

   • Real-time availability minimizes impact of attack

2. Full-Time vs. Part-Time Team Members: Staff incident response team full time vs. part time depends on available funding, constraints, the industry in which the company operates, and company's needs

3. Employee Morale: Segregating roles combats fatigue and boost morale

4. Cost: 24/7 availability requirement = Expensive; members require broader knowledge

5. Staff Expertise: Incident handling requires specialized knowledge and experience in both technical and nontechnical disciplines

Event

An observable occurrence in a system or network

• Can be benign

• User connecting to a shared file server, a server receiving a request for a web page, a user sending an email, and a firewall blocking a connection attempt

  • Includes- Cybersecurity changes that have an effect on an organization's operations, mission, manufacturing capabilities, or reputation.

Cybersecurity Event

A cybersecurity change that may have an impact on organizational operations (including mission, capabilities, or reputation)

• Can be benign or adverse

Adverse Event

Any event with a negative consequence

• Includes both intentional and unintentional events/ human-inflicted and environmentally inflicted events

• System crashes, packet floods, unauthorized use of system privileges, and unauthorized access to sensitive data

Incident

Occurrence that poses a threat to an organization's computer or network security that jeopardizes the confidentiality, integrity, or availability of an information system or

the information that the system processes, stores, or transmits

Cybersecurity Incident

A cybersecurity event that has been determined to have an impact on the organization prompting the need for response and recovery

Computer Security Incident

A type of adverse event that is computer security-related and caused by malicious human intent and not by environmental or indirect human factors; any violation or imminent threat of computer security policies, acceptable use policies, or standard security practices

Steps to Respond to Incident

1. Preparation ←- Prepare for incident

   • Assembling key personnel, tools, and processes

   • Vulnerability assessment software, intrusion detection and prevention applications (vulnerability scanners), anti-malware software, and training

2. Detection ←- Detect/ identify incident

   • Recognize deviations from normal operations, evaluate, correctly classifying as acceptable event or cybersecurity incident

3. Containment ←- Contain incident from spreading

   • Prevent threat from causing further damage (technical/ non-technical measures)

4. Eradication ←- Eradicate threat

• Target extraction and restore system

5. Reporting ←- Report and communicate status

   • Communicate incident to management, IT, employees

6. Recovery ←- Recover and restore normal operations

   • Used phased approach to return IT operations back to functional state

7. Post-Incident Activity/ Learning←- Learn and improve

   • Senior management examines incident, understands it, develop ways to improve response

SANS Institute IRP

Largest cybersecurity training organization in the world that divides incident response into 6 phases in its Incident Handlers Handbook:

1. Preparation

2. Identification

3. Containment

4. Eradication

5. Recovery

6. Lessons learned

Tabletop Exercise (Simulation)

An incident response testing activity where representatives from each group of the incident response team walk through a scripted cybersecurity scenario together without physically interacting with systems or engaging outside entities, and a third-party moderator oversees the discussion, writes a summary of the event, and makes recommendations for improving the response plan

• Most likely procedure to be utilized to test a hypothetical security incident response to compare with the corporation’s incident response planN

NIST IRP

NIST separates the incident response process into 4 stages in its Computer Security Incident Handling Guide:

1. Preparation

2. Detection and analysis

3. Containment, eradication, and recovery

4. Post-incident activity

Information Technology Infrastructure Library (ITIL)

A library created by the British government that outlines incident management process that is integrated with service management

principles

• Issue certifications

ISO IRP

Standards that help companies across the globe respond to security incidents = ISO/IEC 27000 family of standards

• Activities:

1. Evaluating event criteria and defining an incident

2. Monitoring and detecting events by human or automated means

3. Managing incidents to the end of their lifecycle

4. Coordinating with authorities and handling evidence properly

5. Performing a root cause analysis

6. Reporting on all incident management activities

Mean Time To Detect (MTTD)

Amount of time in minutes or hours it takes an organization to detect a prior incident or one in progress

• Higher average times = poorer detection capabilities

• IRP Metric

Mean Time to Acknowledge (MTTA)

A metric used to determine the amount of time an organization takes to acknowledge an incident once it has occurred

• Measured as the difference between the point in time when an incident is reported and when it is recognized as an actual threat that requires a response.

System Availability / Downtime

Amount of time that a production system is completely or partially unusable

• Agreements with IT providers have a specified amount of system uptime they are required to meet