Federal Information Security Management (FISMA) Act of 2002
Requires each agency to develop, document, and implement an agency- wide information systems security program to protect their data
Payment Card Industry Data Security Standard (PCI DSS) is a contractual obligation
Help America Vote Act (HAVA) of 2002
Provides regulations that govern the security, confidentiality, and integrity of the personal information collected, stored, or processed during the election and voting process
SB 1386 requires any business that stores personal data to disclose a breach
Privacy policies govern data labeling and handling.
Acceptable Use Policy
Defines rules for using a computer, network, or systems.
Change Management Policy
Defines the structured way of changing the state of a computer system, network, or IT procedure
Separation of Duties
A preventative type of administrative control
Job Rotation
Different users are trained to perform the tasks of the same position to help prevent and identify fraud that could occur if only one employee had the job
Onboarding and Offboarding Policy
Dictates what needs to be done when an employee is hired, fired, or quits.
Terminated employees are often not cooperative.
Due Diligence
Ensuring that IT infrastructure risks are known and managed properly.
Due Care
Mitigation actions against uncovered risks.
Due Process
How an organization must respect and safeguard personnel’s rights.
User Education
Security Awareness Training
Reinforces the importance of user help in securing valuable resources.
Security Training
Teaches personnel skills for secure job performance.
Security education is generalized training (like Security+).
Specialized training may be developed too.
Vendor Relationships
Non-Disclosure Agreement (NDA)
Defines confidential data that cannot be shared.
Memorandum of Understanding (MOU)
Non-binding agreement detailing a common line of action.
Service-Level Agreement (SLA)
Ability to support and respond to problems within a given timeframe and continuing to provide the agreed upon level of service to the user
SLA may promise 99.999% uptime
Interconnection Security Agreement (ISA)
Documents technical requirements each organization must meet.
Business Partnership Agreement (BPA)
Establishes conditions of relationship, including security requirements.
Disposal Policies
Asset disposal occurs when a system is no longer needed.
Degaussing
Wipes data by exposing the hard drive to a powerful magnetic field.
Purging (Sanitizing)
Removes data so it cannot be reconstructed using any known forensic techniques
Clearing
Assurance that data cannot be reconstructed
Process Steps:
1. Define equipment for disposal.
2. Determine storage location.
3. Analyze equipment for disposal method (reuse, resell, destruction).
4. Sanitize device and remove data.
5. Dispose, recycle, or resell.
Incident Response Procedures
Systems will never be 100% secure.
Incident Response
Procedures followed when examining a security incident.
Incident Management Program
Monitoring, detection, and response to security events.
Preparation
Identification: Determine if an event is classified as an incident.
Containment: Isolating the incident.
Eradication
Recovery: Data restoration, system repair, and re-enabling.
Lessons Learned
Data Collection Procedures
Create a forensic disk image of the data as evidence
Capture and hash system images
Analyze data with tools
Capture screenshots
Review network traffic and logs
Capture video
Consider Order of Volatility
Take statements
Review licensing and documentation
Track man-hours and expenses
FTK and EnCase are popular forensic tools
IT Security Frameworks
Sherwood Applied Business Security Architecture (SABSA) is a risk-driven architecture
Control Objectives for Information and Related Technology (COBIT)
Divides IT into four domains: Plan and Organize, Acquire and Implement, Deliver and Support, and Monitor and Evaluate
NIST SP 800-53 is a security control framework developed by the Dept. of Commerce
ISO 27000
ITIL is the de facto standard for IT service management