Chapter 5 (143 to 187)

Qualys allows various reporting and views on assets and their characteristics.

ASSET MANAGEMENT TOOLS FOR SECURITY FUNCTIONS

 Asset management helps with the following security functions:

 Patch management
 Software whitelisting
 Software assets discovery and management
 Enterprise tracking and reporting
 Gartner refers to this area as Unified endpoint management (UEM):

 Unified endpoint management (UEM) tools combine the management of multiple endpoint types in a single
console. UEM tools perform the following functions:

GARTNER UEM 2018 REPORT

 Configure, manage and monitor iOS, Android, Windows 10 and macOS, and manage some Internet of Things
(IoT) and wearable endpoints.
 Unify the application of configurations, management profiles, device compliance and data protection.

3. Provide a single view of multi-device users, enhancing efficacy of end-user support and gathering detailed
workplace analytic.
4. Act as a coordination point to orchestrate the activities of related endpoint technologies such as identity services
and security infrastructure.
MICROSOFT SOFTWARE RESTRICTION POLICIES (SRP) FOR WHITELISTING

 Software Restriction Policies (SRP) is Group Policy-based feature that identifies software programs running
on computers in a domain, and controls the ability of those programs to run.

 …Software restriction policies are part of the Microsoft security and management strategy to assist
enterprises in increasing the reliability, integrity, and manageability of their computers.

 …You can also use software restriction policies to create a highly restricted configuration for computers, in
which you allow only specifically identified applications to run. Software restriction policies are integrated with
Microsoft Active Directory and Group Policy.

 You can also create software restriction policies on stand-alone computers. Software restriction policies are
trust policies, which are regulations set by an administrator to restrict scripts and other code that is not fully trusted
from running.

WHAT IS SECURITY ENGINEERING ?

Security Engineering is the third layer of the Security Transformation Model

Consists of more in-depth and complicated security activities which take more time and effort

Many times related to security architecture

SECURITY TRANSFORMATION MODEL

(1). security governance, (2). Security Engineering, (3). Vulnerability management, (4). Security Harderning

Types of activities for security engineering:

 FW granular access lists

 Building an effective DMZ architecture
 Segregating the network with VLANs
 Adding a security tool such as SIEM, FW, DLP, NAC, etc
 App-DB encryption

DMZ Architecture Case Study:

 DMZ is an important zone in the overall security architecture

 Devices which need to communicate to outside world placed in DMZ
 Web servers, email gateways, web gateways

FW Access List Case Study:

 Most of the industry has not worked on building granular access lists
 Most FWs have “allow all” for traffic
 Granular access lists need to be built based on servers, or traffic flows

Why at Layer 3 of Security Transformation Model ?

 Low hanging fruit first

 Teams tend to get bogged down with advanced security tasks
 These take time, effort, and often budget approval

WHAT IS THE OBJECTIVE OF SECURITY ENGINEERING ?

 Security architecture as per best-practices

 The right security devices in the right places
 Effective security configuration of security devices (features)
 Optimum operation of security devices
 Aggregate controls

SECURITY ENGINEERING STRUCTURE

(1). Operation, (2). features and config, (3). Architecture

Examples:

 FW first and then IPS

 Edge FW, data center FW
 Malware protection at the network edge
 VPN termination on remote access VPN device
 VPN tunnels for extranet connectivity

The right time for setting up security engineering is when a new network is being designed & implemented Fixing a
poorly architected operational network is an arduous task

WHOSE RESPONSIBILITY IS SECURITY ENGINEERING ?

Security Engineering can best be accomplished with effective team work

TYPICAL STRUCTURE OF AN
INFORMATION SECURITY TEAM ACTIVITY TEAM
SECURITY INFORMATION SECURITY
REQUIREMENTS WITH IT CONSULTATION

SECURITY DESIGN NETWORK/IT SECURITY

ASSISTED BY VENDOR

VALIDATING SECURITY INFORMATION SECURITY

DESIGN
SECURITY NETWORK/IT SECURITY
IMPLEMENTATION ASSISTED BY VENDOR

VALIDATING SECURITY INFORMATION SECURITY

REQMTS MET TEAM

As Security Engineering involves in-depth knowledge of IT & Security, the necessary resources, knowledge, skilsl,
and people need to be pooled to achieve the objectives effectively.

CIS 20 CRITICAL SECURITY CONTROLS

What are the CIS 20 Critical Security Controls ?

 CSC 2: Inventory of Authorized and Unauthorized Software

 CSC 3: Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and
Servers
 CSC 4: Continuous Vulnerability Assessment and Remediation
 CSC 5: Controlled Use of Administrative Privileges
 CSC 6: Maintenance, Monitoring, and Analysis of Audit Logs
 CSC 8: Malware Defenses
 CSC 9: Limitation and Control of Network Ports, Protocols, and Services
 CSC 10: Data Recovery Capability
 CSC 11: Secure Configurations for Network Devices such as Firewalls, Routers, and Switches
 CSC 12: Boundary Defense
 CSC 13: Data Protection
 CSC 14: Controlled Access Based on the Need to Know
 CSC 15: Wireless Access Control
 CSC 16: Account Monitoring and Control
 CSC 17: Security Skills Assessment and Appropriate Training to Fill Gaps
 CSC 18: Application Software Security
 CSC 19: Incident Response and Management
 CIS 20 CRITICAL SECURITY CONTROLS
 CSC 20: Penetration Tests and Red Team Exercises

CSC1: Inventory Of Authorized & Unauthorized Devices

 Deploy an automated asset inventory discovery tool and use it to build a preliminary inventory of systems
connected to an organization’s public and private network(s), and both active tools that scan through IPv4 or IPv6
network address ranges and passive tools that identify hosts based on analyzing their traffic should be employed.
 If the organization is dynamically assigning addresses using DHCP, then deploy dynamic host configuration
protocol (DHCP) server logging, and use this information to improve the asset inventory and help detect unknown
systems.
 Ensure that all equipment acquisitions automatically update the inventory system as new, approved devices are
connected to the network.
 Maintain an asset inventory of all systems connected to the network and the network devices themselves,
recording at least the network addresses, machine name(s), purpose of each system, an asset owner responsible for
each device and the department associated with each device.
 The inventory should include every system that has an Internet protocol (IP) address on the network, including
but not limited to desktops, laptops, servers, network equipment (routers, switches, firewalls, etc.), printers, storage
area networks, Voice Over-IP telephones, multi-homed addresses, virtual addresses, etc.
 The asset inventory created must also include data on whether the device is a portable and/or personal device.
 Devices such as mobile phones, tablets, laptops, and other portable electronic devices that store or process data
must be identified, regardless of whether they are attached to the organization’s network.
 Deploy network level authentication via 802.1x to limit and control which devices can be connected to the
network. The 802.1x must be tied into the inventory data to determine authorized versus unauthorized systems.
 Use client certificates to validate and authenticate systems prior to connecting to the private network.

CSC2: Inventory Of Authorized & Unauthorized Software

 Devise a list of authorized software and version that is required in the enterprise for each type of system,
including servers, workstations, and laptops of various kinds and uses. This list should be monitored by file integrity
checking tools to validate that the authorized software has not been modified.
 Deploy application whitelisting technology that allows systems to run software only if it is included on the
whitelist and prevents execution of all other software on the system. The whitelist may be very extensive (as is
available from commercial whitelist vendors), so that users are not inconvenienced when using common software. Or,
for some special-purpose systems (which require only a small number of programs to achieve their needed business
functionality), the whitelist may be quite narrow.
 Deploy software inventory tools throughout the organization covering each of the operating system types in use,
including servers, workstations, and laptops. The software inventory system should track the version of the
underlying operating system as well as the applications installed on it. The software inventory systems must be tied
into the hardware asset inventory so all devices and associated software are tracked from a single location.
 Virtual machines and/or air-gapped systems should be used to isolate and run applications that are required for
business operations but based on higher risk should not be installed within a networked environment.

CSC3-I: Secure Configurations For HW & SW

 Establish standard secure configurations of your operating systems and software applications. Standardized
images should represent hardened versions of the underlying operating system and the applications installed on the
system. These images should be validated and refreshed on a regular basis to update their security configuration in
light of recent vulnerabilities and attack vectors.
 Follow strict configuration management, building a secure image that is used to build all new systems that are
deployed in the enterprise. Any existing system that becomes compromised should be re-imaged with the secure
build. Regular updates or exceptions to this image should be integrated into the organization’s change management
processes. Images should be created for workstations, servers, and other system types used by the organization.
 Store the master images on securely configured servers, validated with integrity checking tools capable of
continuous inspection, and change management to ensure that only authorized changes to the images are possible.
Alternatively, these master images can be stored in offline machines, air-gapped from the production network, with
images copied via secure media to move them between the image storage servers and the production network.
 Perform all remote administration of servers, workstation, network devices, and similar equipment over secure
channels. Protocols such as telnet, VNC, RDP, or others that do not actively support strong encryption should only be
used if they are performed over a secondary encryption channel, such as SSL, TLS or IPSEC.
 3.5: Use file integrity checking tools to ensure that critical system files (including sensitive system and
application executables, libraries, and configurations) have not been altered. The reporting system should have the
ability to account for routine and expected changes; highlight and alert on unusual or unexpected alterations; show
the history of configuration changes over time and identify who made the change (including the original logged-in
account in the event of a user ID switch, such as with the su or sudo command). These integrity checks should
identify suspicious system alterations such as: owner and permissions changes to files or directories; the use of
alternate data streams which could be used to hide malicious activities; and the introduction of extra files into key
system areas (which could indicate malicious payloads left by attackers or additional files inappropriately added
during batch distribution processes).
 Implement and test an automated configuration monitoring system that verifies all remotely testable secure
configuration elements, and alerts when unauthorized changes occur. This includes detecting new listening ports,
new administrative users, changes to group and local policy objects (where applicable), and new services running on
a system. Whenever possible use tools compliant with the Security Content Automation Protocol (SCAP) in order to
streamline reporting and integration.
 Deploy system configuration management tools, such as Active Directory Group Policy Objects for Microsoft
Windows systems or Puppet for UNIX systems that will automatically enforce and redeploy configuration settings to
systems at regularly scheduled intervals. They should be capable of triggering redeployment of configuration settings
on a scheduled, manual, or event-driven basis.

CSC4-I: Continuous Vuln. Assessment & Remediation

 Run automated vulnerability scanning tools against all systems on the network on a weekly or more frequent
basis and deliver prioritized lists of the most critical vulnerabilities to each responsible system administrator along
with risk scores that compare the effectiveness of system administrators and departments in reducing risk. Use a
SCAP-validated vulnerability scanner that looks for both code-based vulnerabilities (such as those described by
Common Vulnerabilities and Exposures entries) and configuration-based vulnerabilities (as enumerated by the
Common Configuration Enumeration Project).
 Correlate event logs with information from vulnerability scans to fulfill two goals. First, personnel should verify
that the activity of the regular vulnerability scanning tools is itself logged. Second, personnel should be able to
correlate attack detection events with prior vulnerability scanning results to determine whether the given exploit was
used against a target known to be vulnerable.
 Perform vulnerability scanning in authenticated mode either with agents running locally on each end system to
analyze the security configuration or with remote scanners that are given administrative rights on the system being
tested. Use a dedicated account for authenticated vulnerability scans, which should not be used for any other
administrative activities and should be tied to specific machines at specific IP addresses. Ensure that only authorized
employees have access to the vulnerability management user interface and that roles are applied to each user
 Subscribe to vulnerability intelligence services in order to stay aware of emerging exposures, and use the
information gained from this subscription to update the organization’s vulnerability scanning activities on at least a
monthly basis. Alternatively, ensure that the vulnerability scanning tools you use are regularly updated with all
relevant important security vulnerabilities.
 Deploy automated patch management tools and software update tools for operating system and
software/applications on all systems for which such tools are available and safe. Patches should be applied to all
systems, even systems that are properly air gapped.
 Monitor logs associated with any scanning activity and associated administrator accounts to ensure that this
activity is limited to the timeframes of legitimate scans.
 Compare the results from back-to-back vulnerability scans to verify that vulnerabilities were addressed either by
patching, implementing a compensating control, or documenting and accepting a reasonable business risk. Such
acceptance of business risks for existing vulnerabilities should be periodically reviewed to determine if newer
compensating controls or subsequent patches can address vulnerabilities that were previously accepted, or if
conditions have changed, increasing the risk.
 Establish a process to risk-rate vulnerabilities based on the exploitability and potential impact of the
vulnerability, and segmented by appropriate groups of assets (example, DMZ servers, internal network servers,
desktops, laptops). Apply patches for the riskiest vulnerabilities first. A phased rollout can be used to minimize the
impact to the organization. Establish expected patching timelines based on the risk rating level.

CSC5-I: Controlled Use Of Administrative Privileges

 Minimize administrative privileges and only use administrative accounts when they are required. Implement
focused auditing on the use of administrative privileged functions and monitor for anomalous behavior.
 Use automated tools to inventory all administrative accounts and validate that each person with administrative
privileges on desktops, laptops, and servers is authorized by a senior executive.
 Before deploying any new devices in a networked environment, change all default passwords for applications,
operating systems, routers, firewalls, wireless access points, and other systems to have values consistent with
administration-level accounts.
 Configure systems to issue a log entry and alert when an account is added to or removed from a domain
administrators’ group, or when a new local administrator account is added on a system.
 Configure systems to issue a log entry and alert on any unsuccessful login to an administrative account.
 Use multifactor authentication for all administrative access, including domain administrative access. Multi-
factor authentication can include a variety of techniques, to include the use of smart cards, certificates, One Time
Password (OTP) tokens, biometrics, or other similar authentication methods.
 Where multi-factor authentication is not supported, user accounts shall be required to use long passwords on the
system (longer than 14 characters).
 Administrators should be required to access a system using a fully logged and non-administrative account. Then,
once logged on to the machine without administrative privileges, the administrator should transition to administrative
privileges using tools such as Sudo on Linux/UNIX, RunAs on Windows, and other similar facilities for other types
of systems.
 Administrators shall use a dedicated machine for all administrative tasks or tasks requiring elevated access. This
machine shall be isolated from the organization's primary network and not be allowed Internet access. This machine
shall not be used for reading e-mail, composing documents, or surfing the Internet.

157 ….162…. NA

CIS CONTROL 9: LIMITATION & CONTROL OF NETWORK Ppt 163

 Associate Active Ports, Services and Protocols to Asset Inventory: Associate active ports, services and
protocols to the hardware assets in the asset inventory.
 Ensure Only Approved Ports, Protocols and Services Are Running: Ensure that only network ports,
protocols, and services listening on a system with validated business needs, are running on each system.
 Perform Regular Automated Port Scans: Perform automated port scans on a regular basis against all systems
and alert if unauthorized ports are detected on a system.
 Apply Host-based Firewalls or Port Filtering: Apply host-based firewalls or port filtering tools on end
systems, with a default-deny rule that drops all traffic except those services and ports that are explicitly allowed.
 Implement Application Firewalls: Place application firewalls in front of any critical servers to verify and
validate the traffic going to the server. Any unauthorized traffic should be blocked and logged.
PROCEDURES & TOOLS:
 Port scanning tools are used to determine which services are listening on the network for a range of target
systems. In addition to determining which ports are open, effective port scanners can be configured to identify
the version of the protocol and service listening on each discovered port.
 This list of services and their versions are compared against an inventory of services required by the
organization for each server and workstation in an asset management system.
 Recently added features in these port scanners are being used to determine the changes in services offered by
scanned machines on the network since the previous scan, helping security personnel identify differences over
time.
CIS CONTROL 10: DATA RECOVERY CAPABILITIES
 Ensure Regular Automated Back Ups: Ensure that all system data is automatically backed up on regular basis.
 Perform Complete System Backups: Ensure that each of the organization's key systems are backed up as a
complete system, through processes such as imaging, to enable the quick recovery of an entire system.
 Test Data on Backup Media: Test data integrity on backup media on a regular basis by performing a data
restoration process to ensure that the backup is properly working.
 Ensure Protection of Backups: Ensure that backups are properly protected via physical security or encryption
when they are stored, as well as when they are moved across the network. This includes remote backups and
cloud services.
 Ensure Backups Have At least One Non-Continuously Addressable Destination: Ensure that all backups
have at least one backup destination that is not continuously addressable through operating system calls.
Procedures & Tools:
1. Once per quarter (or whenever new backup equipment is purchased), a testing team should evaluate a random
sample of system backups by attempting to restore them on a test bed environment. The restored systems should
be verified to ensure that the operating system, application, and data from the backup are all intact and
functional.
2. In the event of malware infection, restoration procedures should use a version of the backup that is believed to
predate the original infection.
CIS CONTROL 11: SECURE CONFIG FOR NETWORK DEVICES-I
 Secure configuration for network devices such as firewalls, routers, and switches
 Maintain Standard Security Configurations for Network Devices: Maintain standard, documented security
configuration standards for all authorized network devices.
 Document Traffic Configuration Rules: All configuration rules that allow traffic to flow through network
devices should be documented in a configuration management system with a specific business reason for each
rule, a specific individual’s name responsible for that business need, and an expected duration of the need.
 Use Automated Tools to Verify Standard Device Configurations and Detect Changes: Compare all network
device configuration against approved security configurations defined for each network device in use and alert
when any deviation is discovered
 Install the Latest Stable Version of Any Security-related Updates on All Network Devices: Install the latest
stable version of any security-related updates on all network devices.
CIS CONTROL 11: SECURE CONFIG FOR NETWORK DEVICES-II
 Manage Network Devices Using Multi-Factor Authentication and Encrypted Sessions: Manage all network
devices using multi-factor authentication and encrypted sessions.
 Use Dedicated Machines For All Network Administrative Tasks: Ensure network engineers use a dedicated
machine for all administrative tasks or tasks requiring elevated access. This machine shall be segmented from
the organization's primary network and not be allowed Internet access. This machine shall not be used for
reading e-mail, composing documents, or surfing the Internet.
 Manage Network Infrastructure Through a Dedicated Network: Manage the network infrastructure across
network connections that are separated from the business use of that network, relying on separate VLANs or,
preferably, on entirely different physical connectivity for management sessions for network devices.
CIS CONTROL 12: BOUNDARY DEFENSE – I
 Maintain an Inventory of Network Boundaries: Maintain an up-to-date inventory of all of the organization's
network boundaries.
 Scan for Unauthorized Connections across Trusted Network Boundaries: Perform regular scans from
outside each trusted network boundary to detect any unauthorized connections which are accessible across the
boundary.
 Deny Communications with Known Malicious IP Addresses: Deny communications with known malicious or
unused Internet IP addresses and limit access only to trusted and necessary IP address ranges at each of the
organization's network boundaries.
 Deny Communication over Unauthorized Ports: Deny communication over unauthorized TCP or UDP ports
or application traffic to ensure that only authorized protocols are allowed to cross the network boundary in or out
of the network at each of the organization's network boundaries.
CIS CONTROL 12: BOUNDARY DEFENSE – II
 Configure Monitoring Systems to Record Network Packets: Configure monitoring systems to record network
packets passing through the boundary at each of the organization's network boundaries.
 Deploy Network-based IDS Sensor: Deploy network-based Intrusion Detection Systems (IDS) sensors to look
for unusual attack mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
 Deploy Network-Based Intrusion Prevention Systems: Deploy network-based Intrusion Prevention Systems
(IPS) to block malicious network traffic at each of the organization's network boundaries.
 Deploy NetFlow Collection on Networking Boundary Devices: Enable the collection of NetFlow and logging
data on all network boundary devices.
CIS CONTROL 12: BOUNDARY DEFENSE – III
 Deploy Application Layer Filtering Proxy Server: Ensure that all network traffic to or from the Internet
passes through an authenticated application layer proxy that is configured to filter unauthorized connections.
 Decrypt Network Traffic at Proxy: Decrypt all encrypted network traffic at the boundary proxy prior to
analyzing the content. However, the organization may use whitelists of allowed sites that can be accessed
through the proxy without decrypting the traffic.
 Manage All Devices Remotely Logging into Internal Network: Scan all enterprise devices remotely logging
into the organization's network prior to accessing the network to ensure that each of the organization's security
policies has been enforced in the same manner as local network devices.
CIS CONTROL 13: DATA PROTECTION-I
 Maintain an Inventory of Sensitive Information: Maintain an inventory of all sensitive information stored,
processed, or transmitted by the organization's technology systems, including those located onsite or at a remote
service provider.
 Remove Sensitive Data or Systems Not Regularly Accessed by Organization: Remove sensitive data or
systems not regularly accessed by the organization from the network. These systems shall only be used as stand
alone systems (disconnected from the network) by the business unit needing to occasionally use the system or
completely virtualized and powered off until needed.
 Monitor and Block Unauthorized Network Traffic: Deploy an automated tool on network perimeters that
monitors for unauthorized transfer of sensitive information and blocks such transfers while alerting information
security professionals.
CIS CONTROL 13: DATA PROTECTION-II
 Only Allow Access to Authorized Cloud Storage or Email Providers: Only allow access to authorized cloud
storage or email providers.
 Monitor and Detect Any Unauthorized Use of Encryption: Monitor all traffic leaving the organization and
detect any unauthorized use of encryption.
 Encrypt the Hard Drive of All Mobile Devices.: Utilize approved whole disk encryption software to encrypt
the hard drive of all mobile devices.
CIS CONTROL 13: DATA PROTECTION-III
 Manage USB Devices: If USB storage devices are required, enterprise software should be used that can
configure systems to allow the use of specific devices. An inventory of such devices should be maintained.
 Manage System's External Removable Media's Read/write Configurations: Configure systems not to write
data to external removable media, if there is no business need for supporting such devices.
 Encrypt Data on USB Storage Devices: If USB storage devices are required, all data stored on such devices
must be encrypted while at rest.
CIS CONTROL 14: CONTROLLED ACCESS-NEED TO KNOW-I
 Segment the Network Based on Sensitivity: Segment the network based on the label or classification level of
the information stored on the servers, locate all sensitive information on separated Virtual Local Area Networks
(VLANs).
 Enable Firewall Filtering Between VLANs: Enable firewall filtering between VLANs to ensure that only
authorized systems are able to communicate with other systems necessary to fulfill their specific responsibilities.
 Disable Workstation to Workstation Communication: Disable all workstation to workstation communication
to limit an attacker's ability to move laterally and compromise neighboring systems, through technologies such
as Private VLANs or microsegmentation.
 Encrypt All Sensitive Information in Transit: Encrypt all sensitive information in transit.
 Utilize an Active Discovery Tool to Identify Sensitive Data: Utilize an active discovery tool to identify all
sensitive information stored, processed, or transmitted by the organization's technology systems, including those
located onsite or at a remote service provider and update the organization's sensitive information inventory.
CIS CONTROL 14: CONTROLLED ACCESS-NEED TO KNOW-II
• Protect Information through Access Control Lists: Protect all information stored on systems with file
system, network share, claims, application, or database specific access control lists. These controls will enforce the
principle that only authorized individuals should have access to the information based on their need to access the
information as a part of their responsibilities.
• Enforce Access Control to Data through Automated Tools: Use an automated tool, such as host-based
Data Loss Prevention, to enforce access controls to data even when data is copied off a system.
• Encrypt Sensitive Information at Res: Encrypt all sensitive information at rest using a tool that requires a
secondary authentication mechanism not integrated into the operating system, in order to access the information.
• Enforce Detail Logging for Access or Changes to Sensitive Data: Enforce detailed audit logging for access
to sensitive data or changes to sensitive data (utilizing tools such as File Integrity Monitoring or Security Information
and Event Monitoring).
CIS CONTROL 15: WIRELESS ACCESS CONTROL-I
 Maintain an Inventory of Authorized Wireless Access Points: Maintain an inventory of authorized wireless
access points connected to the wired network.
 Detect Wireless Access Points Connected to the Wired Network: Configure network vulnerability scanning
tools to detect and alert on unauthorized wireless access points connected to the wired network.
 Use a Wireless Intrusion Detection System: Use a wireless intrusion detection system (WIDS) to detect and
alert on unauthorized wireless access points connected to the network.
CIS CONTROL 15: WIRELESS ACCESS CONTROL-II
 Disable Wireless Access on Devices if Not Required: Disable wireless access on devices that do not have a
business purpose for wireless access.
 Limit Wireless Access on Client Devices: Configure wireless access on client machines that do have an
essential wireless business purpose, to allow access only to authorized wireless networks and to restrict access to
other wireless networks.
 Disable Peer-to-peer Wireless Network Capabilities on Wireless Clients: Disable peer-to-peer (adhoc)
wireless network capabilities on wireless clients.
CIS CONTROL 15: WIRELESS ACCESS CONTROL-III
 Leverage the Advanced Encryption Standard (AES) to Encrypt Wireless Data: Leverage the Advanced
Encryption Standard (AES) to encrypt wireless data in transit.
 Use Wireless Authentication Protocols that Require Mutual, Multi-Factor Authentication: Ensure that
wireless networks use authentication protocols such as Extensible Authentication Protocol-Transport Layer
Security (EAP/TLS), that requires mutual, multi-factor authentication.
CIS CONTROL 16: ACCOUNT MONITORING & CONTROL-I
 Maintain an Inventory of Authentication Systems: Maintain an inventory of each of the organization's
authentication systems, including those located onsite or at a remote service provider.
 Configure Centralized Point of Authentication: Configure access for all accounts through as few centralized
points of authentication as possible, including network, security, and cloud systems.
 Require Multi-factor Authentication: Require multi-factor authentication for all user accounts, on all systems,
whether managed onsite or by a third-party provider.
 Encrypt or Hash all Authentication Credentials: Encrypt or hash with a salt all authentication credentials
when stored.
CIS CONTROL 16: ACCOUNT MONITORING & CONTROL-II
 Encrypt Transmittal of Username and Authentication Credentials: Ensure that all account usernames and
authentication credentials are transmitted across networks using encrypted channels.
 Maintain an Inventory of Accounts: Maintain an inventory of all accounts organized by authentication system.
 Establish Process for Revoking Access: Establish and follow an automated process for revoking system access
by disabling accounts immediately upon termination or change of responsibilities of an employee or contractor.
Disabling these accounts, instead of deleting accounts, allows preservation of audit trails.
 Disable Any Unassociated Accounts: Disable any account that cannot be associated with a business process or
business owner.
CIS CONTROL 16: ACCOUNT MONITORING & CONTROL-III
 Disable Dormant Accounts: Automatically disable dormant accounts after a set period of inactivity.
 Ensure All Accounts Have An Expiration Date: Ensure that all accounts have an expiration date that is
monitored and enforced.
 Lock Workstation Sessions After Inactivity: Automatically lock workstation sessions after a standard period
of inactivity.
 Monitor Attempts to Access Deactivated Accounts: Monitor attempts to access deactivated accounts through
audit logging.
 Alert on Account Login Behavior Deviation: Alert when users deviate from normal login behavior, such as
time-of-day, workstation location and duration.
CIS CONTROL 17: SECURITY AWARENESS & TRAINING-I
 Perform a Skills Gap Analysis: Perform a skills gap analysis to understand the skills and behaviors workforce
members are not adhering to, using this information to build a baseline education roadmap.
 Deliver Training to Fill the Skills Gap: Deliver training to address the skills gap identified to positively impact
workforce members' security behavior.
 Implement a Security Awareness Program: Create a security awareness program for all workforce members
to complete on a regular basis to ensure they understand and exhibit the necessary behaviors and skills to help
ensure the security of the organization.
 Implement a Security Awareness Program: The organization's security awareness program should be
communicated in a continuous and engaging manner…
 Update Awareness Content Frequently:…Ensure that the organization's security awareness program is
updated frequently (at least annually) to address new technologies, threats, standards and business requirements.
CIS CONTROL 17: SECURITY AWARENESS & TRAINING-II
 Train Workforce on Secure Authentication: Train workforce members on the importance of enabling and
utilizing secure authentication.
 Train Workforce on Identifying Social Engineering Attacks: Train the workforce on how to identify different
forms of social engineering attacks, such as phishing, phone scams and impersonation calls.
 Train Workforce on Sensitive Data Handling: Train workforce on how to identify and properly store, transfer,
archive and destroy sensitive information.
 Train Workforce on Causes of Unintentional Data Exposure: Train workforce members to be aware of
causes for unintentional data exposures, such as losing their mobile devices or emailing the wrong person due to
autocomplete in email.
 Train Workforce Members on Identifying and Reporting Incidents: Train employees to be able to identify
the most common indicators of an incident and be able to report such an incident.
CIS CONTROL 18: APPLICATION SOFTWARE SECURITY-I
 Establish Secure Coding Practices: Establish secure coding practices appropriate to the programming language
and development environment being used.
 Ensure Explicit Error Checking is Performed for All In-house Developed Software: For in-house developed
software, ensure that explicit error checking is performed and documented for all input, including for size, data
type, & acceptable ranges or formats.
 Verify That Acquired Software is Still Supported: Verify that the version of all software acquired from
outside your organization is still supported by the developer or appropriately hardened based on developer
security recommendations.
 Only Use Up-to-date And Trusted Third-Party Components: Only use up-to-date and trusted third-party
components for the software developed by the organization.
CIS CONTROL 18: APPLICATION SOFTWARE SECURITY-II
 Use Only Standardized and Extensively Reviewed Encryption Algorithms: Use only standardized and
extensively reviewed encryption algorithms.
 Ensure Software Development Personnel are Trained in Secure Coding: Ensure that all software
development personnel receive training in writing secure code for their specific development environment and
responsibilities.
 Apply Static and Dynamic Code Analysis Tools: Apply static and dynamic analysis tools to verify that secure
coding practices are being adhered to for internally developed software.
 Establish a Process to Accept and Address Reports of Software Vulnerabilities: Establish a process to accept
and address reports of software vulnerabilities, including providing a means for external entities to contact your
security group.
CIS CONTROL 18: APPLICATION SOFTWARE SECURITY-III
 Separate Production and Non-Production Systems: Maintain separate environments for production and
nonproduction systems. Developers should not have unmonitored access to production environments.
 Deploy Web Application Firewalls (WAFs): Protect web applications by deploying web application firewalls
(WAFs) that inspect all traffic flowing to the web application for common web application attacks.
 For applications that are not web-based, specific application firewalls should be deployed if such tools are
available for the given application type. If the traffic is encrypted, the device should either sit behind the
encryption or be capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based
web application firewall should be deployed.
 Use Standard Hardening Configuration Templates for Databases: For applications that rely on a database,
use standard hardening configuration templates. All systems that are part of critical business processes should
also be tested.
CIS CONTROL 19: INCIDENT RESPONSE & MANAGEMENT-I
 Document Incident Response Procedures: Ensure that there are written incident response plans that defines
roles of personnel as well as phases of incident handling/management.
 Assign Job Titles and Duties for Incident Response: Assign job titles and duties for handling computer and
network incidents to specific individuals and ensure tracking and documentation throughout the incident through
resolution.
 Designate Management Personnel to Support Incident Handling: Designate management personnel, as well
as backups, who will support the incident handling process by acting in key decision-making roles.
 Device Organization-wide Standards for Reporting Incidents: Device organization-wide standards for the
time required for system administrators and other workforce members to report anomalous events to the incident
handling team, the mechanisms for such reporting, and the kind of information that should be included in the
incident notification.
CIS CONTROL 19: INCIDENT RESPONSE & MANAGEMENT-II
 Contact Information For Reporting Security Incidents: Assemble & maintain information on third-party
contact information to be used to report a security incident, such as Law Enforcement, relevant govt departments,
vendors, etc
 Publish Information Regarding Reporting Computer Anomalies and Incidents: Publish information for all
workforce members, regarding reporting computer anomalies and incidents to the incident handling team. Such
information should be included in routine employee awareness activities.
 Conduct Periodic Incident Scenario Sessions for Personnel: Plan and conduct routine incident response
exercises and scenarios for the workforce involved in the incident response to maintain awareness and comfort
in responding to real world threats.
 Exercises should test communication channels, decision making, and incident responders technical capabilities
using tools and data available to them.
 Create Incident Scoring and Prioritization Schema: Create incident scoring and prioritization schema based
on known or potential impact to your organization. Utilize score to define frequency of status updates and
escalation procedMaintainures.
CIS CONTROL 20: PENETRATION TESTS & RED TEAM EXERCISES-I
 Establish a Penetration Testing Program: Establish a program for penetration tests that includes a full scope
of blended attacks, such as wireless, client-based, and web application attacks.
 Conduct Regular External and Internal Penetration Tests: Conduct regular external and internal penetration
tests to identify vulnerabilities and attack vectors that can be used to exploit enterprise systems successfully.
 Perform Periodic Red Team Exercises: Perform periodic Red Team exercises to test organizational readiness
to identify and stop attacks or to respond quickly and effectively.
 Include Tests for Presence of Unprotected System Information and Artifacts: Include tests for the presence
of unprotected system information and artifacts that would be useful to attackers, including network diagrams,
configuration files, older penetration test reports, e-mails or documents containing passwords or other
information critical to system operation.
CIS CONTROL 20: PENETRATION TESTS & RED TEAM EXERCISES-II
 Create Test Bed for Elements Not Typically Tested in Production: Create a test bed that mimics a production
environment for specific penetration tests and Red Team attacks against elements that are not typically tested in
production, such as attacks against supervisory control and data acquisition and other control systems.
 Use Vulnerability Scanning and Penetration Testing Tools in Concert: Use vulnerability scanning &
penetration testing tools in concert. The results of vulnerability scanning assessments should be used as a
starting point to guide & focus pen testing efforts.
 Ensure Results from Penetration Test are Documented Using Open, Machine-readable Standards:
Wherever possible, ensure that Red Teams results are documented using open, machine-readable standards (e.g.,
SCAP). Devise a scoring method for determining the results of Red Team exercises so that results can be
compared over time.
 Control and Monitor Accounts Associated with Penetration Testing: Any user or system accounts used to
perform penetration testing should be controlled and monitored to make sure they are only being used for
legitimate purposes, and are removed or restored to normal function after testing is over.
CHAPTER # 6 Ppt: 190 to 258
What Is IT Governance?
The primary goals of IT Governance are to assure that the investments in IT generate business value, and to mitigate
the risks that are associated with IT
 Simply put, it’s putting structure around how organizations align IT strategy with business strategy, ensuring that
companies stay on track to achieve their strategies and goals, and implementing good ways to measure IT’s
performance.
 It makes sure that all stakeholders’ interests are taken into account and that processes provide measurable results.
 An IT governance framework should answer key questions such as how the IT dept is functioning overall, what
key metrics management needs and what return IT is giving back to the business from investments
Frameworks which cover IT Governance:
 ISO27001: 2013 (Information Security Management System - ISMS)
 ITIL (IT Infrastructure Library)
 COBIT (Control Objectives for Information & Related Technology)
What is COBIT?: Simply stated, COBIT 5 helps enterprises to create optimal value from IT by maintaining a
balance between realising benefits and optimising risk levels and resource use.
What Is Information Security Governance?
 "Security governance is the set of responsibilities and practices exercised by the board and executive
management with the goal of providing strategic direction, ensuring that objectives are achieved, ascertaining
that risks are managed appropriately and verifying that the enterprise's resources are used responsibly."
 Information Security governance is the mechanism how the information security function is managed by the
organization
IT GOVERNANCE: Information Sec governance, Bussiness continuty and DR, IT service mangmnet and
performance management, IT Project managemnet……..Daigram
 The leading framework for Information Security governance is ISO27001:2013 (ISMS): Considered gold
standard, Most widely deployed Information Security governance framework , “Provides a model for
establishing, implementing, operating, monitoring, reviewing, maintaining and improving an information
security management system.”
 Clauses 4 to 10 of ISO27001:2013: 4: Organization & context, scope, 5: Leadership & commitment, policy,
organizational roles & responsibilities, 6: Planning; Infosec objectives and planning to achieve them
 Clauses 4 to 10 of ISO27001:2013: 7: Support; resources, competence, awareness, 8: Operations; risk
assessment and risk management
 Clauses 4 to 10 of ISO27001:2013: 9: Performance evaluation; monitoring, measurement & analysis; internal
audit, 10: Non-conformities & corrective actions, continual improvement
Why Is InfoSec Governance At Stage 4?
Security Transformation Model: 1. Sec harderning, 2. vulnerability managmnet, 3. Sec Engr, 4. Sec governance
Why is security governance at stage 4? First build a building and then manage it, First 2 stages build up the
essential foundation, 3rd stage implements advanced security measures
Then (4th stage) it is time to manage Limited organizational bandwidth ?: Governance is a broad function, May
get lost in governance if implement at the wrong time, Spend limited resources where they count most (in security
hardening)
Once the basic foundations of security hardening, vulnerability management, and security engineering are in place it
is time to manage the “system”. If we try to establish governance first, our entire energies will be consumed in
managing a system that has not yet been built…
 Organizational security maturity…when does governance make sense?
 Governance is important but only after security hardening & controls (stage 1, 2, and 3) are in place…
Can InfoSec Governance Be Before Stage 4?
• Implications of implementing Stage 4 before first 3 stages: Expending project energy, resources, and time
in governance whereas they should have been spent on building fundamental security foundation (which later
requires management), Getting caught up in intangible “governance” activity, Getting caught up in policy &
management without essential and fundamental underlying security controls, Setting unrealistic expectations, Note
that governance consists of documentation and process which tends to bog down and dis-interest tech resources,
Security controls (Stage 1-3) once they are implemented by following security hardening & vulnerability
management international best-practices can be better documented and regulated through governance (policy,
SOP)…
Why?: We know what works and is implementable in terms of security controls, Controls are implemented
incrementally (practical), Minimal policy in place at initial stages as a starting point
However: Certain projects may have governance stipulations by the regulator/customers, Deadline to achieve certain
governance or security milestones, In such cases tailor security transformation project
The sequence of the security transformation model (stages 1 through 4) should be followed wherever possible as
it is a tried and tested model. The security transformation model may be tailored as per your unique requirements

PAKISTAN’S INFO SECURITY POSTURE & CHALLENGES

• Let’s have a look at the typical IT & Information Security challenges….Daigram….infosec, audit, risk,
compliance
IT CHALLENGES SUMMARY
• IT is complex and difficult to manage
• IT under pressure frome business groups
• Lack of sufficient ( trained) resources
• Lack pf process culture
• It is clearly not aligned to perform diligent security work
INFORMATION SECURITY CHALLENGES
• Silos and lack of security ownership
• Time and energy wasted in traversing depts
• Info security is tough work enabling environment missing
• Fundamental security hardening of IT assets in the trenches is glaringly absent
INFOSEC GOVERNANCE BUILDING BLOCKS
INITIAL GOVERNANCE BUILDING BLOCKS
• Policy, Responsibility, Resource & Priority, Periodic Review
• INTERMEDIATE GOVERNANCE BUILDING BLOCKS
• CHANGE MANAGEMENT, SOPs, AWARENESS, MONITORING
• MATURE GOVERNANCE BUILDING BLOCKS
• RISK MANAGEMENT, INTERNAL AUDIT, INCIDENT MANAGEMENT
• CONTINUAL IMPROVEMENT CYCLE: Daigram….continual improvement (arrow goes with 2 heads)
correction (arrow goes with 2 heads) assessment (rrow goes with 2 heads) continual improvement
• Governance implementation should be broken up into phases
a. Essential (initial) activities first
 b. Gradually progress with activities that match organizational readiness & maturity
Whose Responsibility Is InfoSec Governance ?
• Information security governance has responsibilities at different layers of the organization
• In Pakistan, the governance functions are slightly different than practice in more mature markets
TYPICAL ORGANIZATIONAL TIERS AND MEMBERS, TYPICAL ORGANIZATIONAL TIERS AND
RESPONSIBILITIES

TIER MEMBERS
TIER RESPONSIBILITY
BOARD BOARD MEMBER, CIO,
CISO, IT MANAGEMENT, BOARD ORGANIZATIONAL
(STEERING (SOME KEY BUSINESS COMMITMENT,
COMMITTEE) MEMBERS) (STEERING APPROVE BUDGET,
COMMITTEE) DIRECT
IT GMs BELONGING TO IT
MANAGEMENT MANAGEMENT, CISO IT MANAGEMENT REVIEW, MONITOR,
(CIO) (CIO) PROPOSE

CISO/SECURITY CISO AND ISMC CISO/SECURITY PLAN, BUILD, RUN

HEAD HEAD

IT & SECURITY IT TEAMS AND PROJECT IT & SECURITY IMPLEMENT/EXECUTE

TEAMS TEAMS TEAMS

 Based on experience with real Information

Security Transformation projects in the Pakistan industry, we have set a more practical structure as shown in the
following slides
 Well-suited to drive the Security Transformation project successfully
 When working in the practical industry in a market where the security posture is sub-par, we should be open to
adopt structures and strategies relevant for such a level of market
 ISACA and other frameworks propose mechanisms that do not always make sense in an unprepared market
How Is InfoSec Governance Implemented ?
INITIAL GOVERNANCE BUILDING BLOCKS

ACTIVITY RESPONSIBLE DETAIL

POLICY DEVELOPED BY CISO SETS THE SCOPE, OBJECTIVES,

FRAMEWORK, REQUIREMENTS
SIGNED OFF BY
BOARD/EXECUTIVE

RESPONSIBILITY & BOARD/EXECUTIVE ASSIGNS ROLES, RESPONSIBILITIES, AND

AUTHORITY AUTHORITY FOR INFOSEC PROGRAM
RESOURCE BOARD/EXECUTIVE ALLOCATION OF RESOURCES AND
ASSIGNMENT & BUDGET FOR THE INFOSEC FUNCTIONS
PRIORITY SETTING

PERIODIC REVIEW BOARD/EXECUTIVE MONITOR AND REVIEW THAT THE GOALS

OF THE INFOSEC PROGRAM ARE BEING
MET

INTERMEDIATE GOVERNANCE BUILDING BLOCKS

ACTIVITY RESPONSIBLE DETAIL

CHANGE IT ESTABLISHING AND ENFORCING A CHANGE

MANAGEMENT MANAGEMENT MANAGEMENT PROCESS

SOPs IT DEVELOPING STANDARD OPERATING PROCEDURES

MANAGEMENT BASED ON ACTUAL PRACTICE

AWARENESS CISO/ CONDUCTING SECURITY AWARENESS TRAINING

SECURITY
TEAMS

MONITORING/ IT GAUGING THE PERFORMANCE AND PROGRESS OF

REVIEW MANAGEMENT THE INFOSEC PROGRAM AGAINST AGREED PROJECT
PLAN/MILESTONES

MATURE GOVERNANCE BUILDING BLOCKS

ACTIVITY RESPONSIBLE DETAIL

RISK DRIVEN BY INFOSEC RISK ASSESSMENT, RISK TREATMENT & RISK

MANAGEMENT MANAGEMENT LIFECYCLE
SUPPORTED BY IT
MANAGEMENT

INTERNAL AUDIT INTERNAL AUDIT IMPLEMENT PERIODIC AUDIT PROGRAM

DEPT, OR INFOSEC
INCIDENT IT MANAGEMENT & INCIDENT MANAGEMENT LIFECYCLE
MANAGEMENT INFOSEC

CONTINUAL IMPROVEMENT CYCLE

ACTIVITY RESPONSIBLE DETAIL

CONTINUAL BOARD/ CONTINUAL STEPS FOR THE EFFECTIVENESS OF

IMPROVEMENT EXECUTIVE INFOSEC PROGRAM

CORRECTIVE IT MANAGEMENT CORRECTIVE ACTIONS FOR NON-CONFORMITIES

ACTIONS / INFOSEC AND GAPS

THIRD-PARTY BOARD/INFOSEC CONDUCT THIRD-PARTY ASSESSMENTS SUCH AS

ASSESSMENTS VA/PT, GAP ANALYSIS

 The key is to align Information Security governance as closely as possible with ISO27001:2013 (ISMS), and to
go for crisp clear actions which are always measurable
 Certify against ISO27001:2013 (ISMS) for best-practices implementation
How To Build Effective InfoSec Governance ?
Key success factors: Leadership, Strategy, Structure, Reportin, Project management, Culture
 Leadership: Executive management role, Tone at the top , Drive pressing priority, Approves budgets and
resources, Periodic review of progress
 Strategy:: How the objectives will be practically achieved while achieving the technical, governance, and
performance goals, How the organization will gear up and focus for the security transformation
 Structure: What hierarchies, team structures, reporting lines, and resources will come together , How will
different teams work together to achieve the common goals ?
 Reporting: What will be reported?, What will be the frequency of reports?, Who will perform review and
assurance?, Who will monitor and track progress?
 Project Management: How will an exceptional execution discipline be built ? How will milestones and
performance be tracked How will project management best-practices be utilized?
 Culture: How will an open, cooperative, authentic, and committed culture be built ?, How will contention and
conflict be eliminated ?, How will a performance driven culture be promoted? Building effective information
security governance or an effective information security transformation project are based on good management,
execution and project management skills
InfoSec Dept Structure (Large-Sized Org) see Ppt 199
• Lets look at the recommended structure for a large organization
• A large organization can have an Infosec team ranging between 25-30 staff
• 10% of IT (250 to 300 IT staff)
InfoSec Dept Structure (Mid-Sized Org) see Ppt 200
• Lets look at the recommended structure for a mid-sized organization
• A mid-sized organization can have an Infosec team ranging between 10-15 staff
• 10% of IT (100 to 150 IT staff)
InfoSec Dept Structure (Small Org) see Ppt 201
• Lets look at the recommended structure for a small organization
• A small-sized organization can have an Infosec team ranging between 2-4 staff
• 10% of IT (15 to 50 IT staff)
ROLE OF CISO IN DRIVING INFOSEC PROGRAM
The CISO plays a crucial role in successfully driving the Information Security program
• Two factors: CISO skills, Placement in organizational hierarchy
1. Leadership & strategy: Good understanding of IT & Information security challenges, Experience of driving
critical projects in organizations , Ability to build program strategy, structure, reporting mechanism , and
execution discipline to achieve results, Ability to work with Board and senior executive management to drive
program, Ability to motivate and communicate security vision to team, Ability to infuse credibility &
authenticity in IT environment, Ability to build team work & cooperation culture
2. Technology Domain Knowledge: CISOs or security heads usually have 5-10 years experience in IT
followed by 3-5 years in Information Security, CISOs are typically strong in 2-3 domain areas such as
networking + infrastructure OR software + databases OR software QA & process engineering, A good CISO is
able to build a good team to cover all major domain areas and all functional reqmts, Having a solid technical
base, good CISOs are able to easily build a security competence layer on top of it
3. Governance domain knowledge: Working with regulators & compliance, Policies & SOPs, Frameworks &
standards, A passion for training & awareness, A process oriented mindset to successfully build a strong InfoSec
program, Ability to balance people, process, and technology
4. Good people skills: A CISO requires good people management skills as the security transformation project is
all about motivating, directing, and organizing people to achieve a focused goal, Personal discipline &
commitment
5. Placement: Within IT, Within risk, Reporting to board committee
Key Inhibitors For Security Program Failure
There may be several inhibitors to achieving a successful security transformation project
Reasons of failed prjects: Poor execution, Poor structure and startegy, poor execution
i. Executive management, Allocates budget and approves resources, Sets organizational priority & “tone at the
top”, Even if you start a program without executive management support, it may not last long, Periodic reviews
by executive management drive the execution in the IT organization, Organizational priorities may change
quickly if executive management does not sustain its commitment
ii. Strategy & structure:, A good or poor strategy & structure will make or break any project, in any discipline,
in any organization, Addressing the needs and inter-linkages to make the entire machinery work in a streamlined
manner, Understanding roles of various stakeholders and taking them all along, Having sufficient experience to
work at various levels of the organization
 iii. Execution: All information security projects boil down to strong execution & project management once
leadership commitment and strategy/structure issues are addressed, Allocating tasks to run different phases in
parallel & sequentially, Prioritizing tasks, Tracking progress, Reporting dashboards, Team/Steering
Committee/Board presentations, Failure of the Information Security program will be imminent if any one of
these three elements (leadership, strategy/structure, execution) is not adequately addressed
InfoSec Strategy For Smaller Organizations
• Smaller & newer organizations face unique challenges which may require a creative approach to implement a
successful security transformation program
Smaller organizations: Limited budget, untrained starff, ahoc culture
1. Limited budget: Limited priority with limited resources, Break up project into phases matching resource
allocation & organizational bandwidth available, Limit scope to 1 location, department, team, or even to 1
application, Consider hiring one competent security or IT member in the team, Provide management support and
periodic review, 12 to 15 months for security transformation
2. Untrained staff: Consider hiring a consultant, Train, incentivize, and motivate team, Give time to the team to
adopt the security culture & processes, Periodic management reviews & corrective actions
3. Adhoc culture: Smaller & newer organizations may have a chaotic and adhoc culture, Lack of process approach,
Resources not disciplined for consistent delivery, Rapidly changing focus and attention span, May be resolved with
a good project leader or competent consultant, Training & setting organizational vision
 The leaders of small organizations are usually aware of their organizational capacity and limitations with
experience
 Work with the organizational leadership to deploy competent project lead and team members
COMMON CHALLENGES: SECURITY DOCUMENTATION
As we have seen in the previous modules, policies, SOPs, checklists, guidelines, and records are all important parts
of the Information Security Management System (ISMS) and are based on documentation usually with an associated
process.
Documnetation challenges: roles and responsibilites, training and awarness, process culture absent, defective and
voluminous documnets
i. Process culture absent: Adhoc culture, Rapidly changing priorities, Inhibits time & concentration required for
documentation, Requires executive support to build process oriented culture , Requires business transformation as
well as security transformation as the style in which the organization works needs to be addressed, New focus on
quality, process, and assurance for results
ii. Defective & voluminous documentation: Effective writing & documentation is a rare skill No one likes to read
long, winding, poorly structured documentation, No one likes to read !: Documentation appetite & organizational
maturity, Gradually build organizational appetite for documentation with extremely concise documents,
Documentation has a close relationship with process culture and quality – is your organizational going after the right
goals with balance ?
iii. Training & awareness: There may be a fear for documentation, and staff may be unaware or not possessing the
skills or experience of documentation, Train and raise awareness in a friendly environment , Incentivize, Create
working templates which are easily accessible on organizational portal, Create how-to videos & FAQs, etc, Invest in
raising competence & skills of staff
iv. Roles & responsibilities: Is right person working at the right place ?, Do key people tasked with security
governance & documentation have the right skills and experience to build documentation ?, Are staff aware of their
responsibilities related to security governance documentation …policies, SOPs, checklists, etc ?, Is documentation
and process approach part of staff JDs & appraisal ?
SECURITY DOCUMENTATION: POLICIES
• Policies
• Standards
• Procedures
• Guidelines

 POLICIES
Policies are formal statements produced and supported by senior management. They can be organization-wide,
issue-specific or system specific. Your organization’s policies should reflect your objectives for your information
security program.
Your policies should be like a building foundation; built to last and resistant to change or erosion.
1. Driven by business objectives and convey the amount of risk senior management is willing to accept.
2. Easily accessible and understood by the intended reader
3. Created with the intent to be in place for several years and regularly reviewed with approved changes made as
needed.
SECURITY DOCUMENTATION: STANDARDS
STANDARDS
 Standards are mandatory actions or rules that give formal policies support and direction. One of the more
difficult parts of writing standards for an information security program is getting a company-wide consensus on
what standards need to be in place.
 This can be a time-consuming process but is vital to the success of your information security program.
1. Used to indicate expected user behavior. For example, a consistent company email signature.
2. Might specify what hardware and software solutions are available and supported.
3. Compulsory and must be enforced to be effective. (This also applies to policies!)
SECURITY DOCUMENTATION: PROCEDURES
PROCEDURES
 Procedures are detailed step by step instructions to achieve a given goal or mandate. They are typically
intended for internal departments and should adhere to strict change control processes.
 Procedures can be developed as you go. If this is the route your organization chooses to take it’s necessary to
have comprehensive and consistent documentation of the procedures that you are developing.
1. Often act as the “cookbook” for staff to consult to accomplish a repeatable process.
2. Detailed enough and yet not too difficult that only a small group (or a single person) will understand.
3. Installing operating systems, performing a system backup, granting access rights to a system and setting up
new user accounts are all example of procedures.
SECURITY DOCUMENTATION: GUIDELINES
GUIDELINES
 Guidelines are recommendations to users when specific standards do not apply. Guidelines are designed to
streamline certain processes according to what the best practices are.
 Guidelines, by nature, should be open to interpretation and do not need to be followed to the letter.
1. Are more general vs. specific rules.
2. Provide flexibility for unforeseen circumstances.
3. Should NOT be confused with formal policy statements.
HOW TO DEVELOP EFFECTIVE SECURITY POLICIES
6 Steps To Security Policy Excellence
Purpose Of Policies & Procedures: Policies and procedures establish guidelines to behavior and business
processes in accordance with an organization's strategic objectives. While typically developed in response to legal
and regulatory requirements, their Purpose Of Policies & Procedures…primary purpose should be to convey
accumulated wisdom on how best to get things done in a risk-free, efficient and compliant way.
Policy Pitfalls
1. Poorly worded policies
2. Badly structured policies
3. Out-of-date policies
4. Inadequately communicated policies
5. Unenforced policies
6. Lack of management scrutiny
SIX STEPS:
1. Create & Review: Documents must be written using language that is appropriate for the target audience and
should spell out the consequences of non-compliance. Smaller, more manageable documents are easier for an
organization to review and update, while also being more palatable for the intended recipients.
2. Distribute: Organizations need to effectively distribute policies, both new and updated, in a timely and
efficient manner. These need to be consistently enforced across an organization.
3. Achieve Consent: A process needs to be implemented that monitors users' response to policies. Policy
distribution should be prioritised, ensuring that higher risk policies are signed off earlier by users than other lower
risk documents. For example, an organization may want to ensure that a user signs up to their Information
Governance policy on the first day that they start employment, whilst having up to two weeks to sign up to the Travel
& Expense Policy. Systems need to in place to grant a user two weeks to process a particular document, after which
the system should automatically force the user to process it.
4. Understanding: To monitor and measure staff comprehension and effectiveness of policies and associated
documentation, organizations should test all, or perhaps a subset of, users. Any areas that show weaknesses can be
identified and corrected accordingly. Additional training or guidance may be necessary or, if it's the policy that is
causing confusion, it can be reworded or simplified.
5. Auditability: The full revision history of all documents needs to be maintained as well as who has read what,
when & if possible, how long it took; who declined a policy and why. This record should be stored for future
reference & may be stored in conjunction with test results
6. Reporting: To affect change and improve compliance it helps if key performance indicators relating to policy
uptake are clearly visible across all levels of an enterprise. Dashboard visibility of policy uptake compliance by
geographical or functional business units helps to consolidate information and highlights exceptions.
ISMS: LEADING INFOSEC GOVERNANCE FRAMEWORK
• ISO27001:2013 (ISMS): Specifies the requirements for establishing, implementing, maintaining and
continually improving an information security management system…Ten short clause…Long annex
• ISO27001:2013 MANDATORY CLAUSES

• ISO27001:2013 DISCRETIONARY CONTROLS

• Merits of ISO27001:2013 (ISMS): Exceptional framework with comprehensive coverage of mandatory

requirements (clauses 4-10) and discretionary controls (annex), Highly beneficial as a framework for security
program, Covers all domain areas, Provides a structure and organized sequence for security controls , Complements
security transformation model as serves as a reference and guideline for activities and controls
• DE-MERITS OF ISO27001:2013 (ISMS): Very broad, Generic framework – leaves it to organization how
to implement the measures and controls, Not suited for orgs that are new to security program
• How to best use advantages of ISO27001:2013 (ISMS): Implement security transformational model, Cap
off security transformation project with ISO27001:2013 (ISMS) certification, ISMS as a complementary reference
and checklist rather than main framework
CLAUSES 4-6 OF ISO27001:2013 (ISMS)
4: CONTEXT: Understanding org and its context; internal and external issues relevant to its purpose and that affect
its ability to achieve intended outcomes of ISMS, Needs and expectations of interested parties (e.g. legal and
regulatory reqmts and contractual obligations), Scope (boundaries); interfaces and dependencies
5: LEADERSHIP & COMMITMENT: Policy & objectives are established and are compatible with strategic
direction of org, Integrating ISMS into org processes, Resources for ISMS available, Communicating importance,
Ensuring ISMS achieves intended outcomes, Directing & supporting persons, Promoting continual improvement,
Assign and communicate roles, responsibilities & authorities
6: PLANNING: Address org risks & opportunities & prevent or reduce undesired effects, Ensure risk assessment is
conducted, Identify, analyze, evaluate risks, Ensure risk treatment is effective, Ensure information security objectives
are measurable, communicated, For objectives determine what will be done, what resources reqd, who will be
responsible, when completed, how to evaluate results
CLAUSES 7-10 OF ISO27001:2013 (ISMS)
7: SUPPORT: Org shall provide the resources necessary for the establishment, implementation, maintenance and
continual improvement of the ISMS, Ensure competence of staff for the ISMS, Awareness related to the policy and
ISMS will be ensured among staff, Communication mechanisms related to ISMS internal and external to the org,
Documentation with appropriate identification, description, format, review & approval mechanism, Documentation
change control, protection, distribution, retention, & disposal
8: OPERATIONS: Plan, implement, and control processes, Control planned changes, Outsourced processes
controlled, Risk assessment and risk treatment & retain documented information
9: PERFORMANCE EVALUATION: Monitoring, measurement, analysis, and evaluation , What needs to be
monitored, methods, who will monitor, when to monitor, who shall analyze and evaluate results ?, Internal audit
implemented at planned intervals, Define audit criteria and scope for each audit, Reporting of auditing results, Retain
auditing docs
9: Management Review: Planned intervals, Status of actions, Changes in external and internal environment, Review
non-conformities and corrective actions, monitoring & measurement results, audit reports, other
10: IMPROVEMENT: Non-conformities and corrective actions, Continual improvement
ISO27001:2013 CONTROLS APPENDIX; PART 1 For A5 to A18 refer to PPT 214 - 226
HOW TO USE ISO27002:2013
What is ISO27002:2013 ?: Information technology -- Security techniques -- Code of practice for information
security controls…..Renamed from ISO 17799
0.1 Background & Context: This Int’l Standard is designed for orgs to use as a reference for selecting controls
within the process of implementing an Information Security Management System (ISMS) based on ISO/IEC 27001;,
or as a guidance document for organizations implementing commonly accepted information security controls.
• STRUCTURE OF ISO27002:2013

Lets have a look at control A.5.1.2 (Review Of The Policies Of Information Security) ppt 214
27002: Implementation Guidance: Each policy should have an owner who has approved mngmt responsibility for
the development, review and evaluation of the policies. The review should include assessing opportunities for
improvement of the org’s policies and approach to managing Infosec in response to changes to the org environment,
business circumstances, legal conditions or tech environment.
• Practically: ISO27001:2013 controls are brief and generic, 27002 clarifies further what is being referred to,
gives further context & very useful implementation guidance
PCI DSS V3
• PCI Data Security Standard (DSS): Designed to ensure that ALL companies that accept, process, store or
transmit credit card info maintain a secure environment, Managed by Security Standards Council, SSC is an
independent body that was created by the major payment card brands (Visa, MasterCard, American Express,
Discover and JCB, 6 Broad goals and 12 requirements

REQMT TEST PROCEDURES GUIDANCE

7.1.4 Require 7.1.4 Select a sample of user IDs &

documented approval compare with documented approvals
by authorized parties to verify that: Documented approval (for example, in
specifying required writing or electronically) assures that
privileges. -Documented approval exists for the
assigned privileges those with access and privileges are
known and authorized by management,
-The approval was by authorized and that their access is necessary for
parties their job function.
-That specified privileges match the
roles assigned to the individual.

8.1.4 Remove/ disable Accounts that are not used regularly are
inactive user accounts often targets of attack since it is less
within 90 days. 8.1.4 Observe user accounts to verify likely that any changes (such as a
that any inactive accounts over 90 days changed password) will be noticed. As
old are either removed or disabled. such, these accounts may be more easily
exploited and used to access cardholder
data.

• PCI is specific to the card environment to protect cardholder data

• PCI controls are very specific and in-depth compared to generic and high-level controls of ISO27001
SANS/CIS CRITICAL SECURITY CONTROLS
• A very useful collection of controls for improving security posture
For Sans/Cis Critical Security Controls See PPT 229
NIST FRAMEWORK
 The Computer Security Resource Center (CSRC) website guides users to NIST resources on computer, cyber,
and information security and privacy.
 Its content includes publications, projects, research, news and events from the NIST Information Technology
Laboratory's (ITL) two security divisions.
 SP800, Computer Security (December 1990-present):
NIST's primary mode of publishing computer/cyber/information security guidelines, recommendations and
reference materials
(SP 800s are also searchable in the NIST Library Catalog);
 NIST has a tremendous library of free documentation on a diverse range of topics
 Relevance is often average, however, depth and detail of material is extra-ordinary

COBIT
COBIT: ISACA framework for IT Governance, COBIT 5 helps enterprises to create optimal value from IT by
maintaining a balance between realising benefits and optimising risk levels and resource use (ISACA). COBIT 5
brings together five principles that allow the enterprise to build an effective governance and management framework
(ISACA), Based on a holistic set of seven enablers that optimises IT investment and use for the benefit of
stakeholders (ISACA)

 Governance ensures that enterprise objectives are achieved by evaluating stakeholder needs, conditions &
options; setting direction through prioritisation & decision making;
 …& monitoring performance, compliance and progress against agreed direction and objectives (EDM)
 Management plans, builds, runs and monitors activities in alignment with the direction set by the governance
body to achieve the enterprise objectives (PBRM)
 COBIT 5 is a detailed framework for IT governance developed by ISACA which has principles, enablers, and
processes
 These tools assist implementers and customer organizations to successfully deploy the framework
 Certifiable framework
CMMI
 The Capability Maturity Model (CMM) is a methodology used to develop & refine an org's software dev process.
The model describes a five-level evolutionary path of increasingly organized & systematically more mature
processes.
 CMM was developed and is promoted by the Software Engineering Institute (SEI), a research and development
center sponsored by the U.S. Department of Defense (DoD)
 Now CMMI Institute (ISACA)
 The Capability Maturity Model Integration (CMMI®) is a performance improvement model for competitive
organizations that want to achieve high-performance operations.
 Building upon an org’s business performance objectives, CMMI provides a set of practices for improving
processes, resulting in a performance improvement system that paves the way for better operations and
performance.
 More than any other approach, CMMI doesn’t just help to improve org processes. CMMI also has built-in
practices that help to improve the way you use any performance improvement approach, setting you up to
achieve a positive return on your investment
 CMMI does not provide a single process. Rather, the CMMI provides guidance on what to do to improve your
processes, not define your processes. CMMI is designed to compare an organization’s existing processes to
proven best practices developed by members of industry, govt, & academia; reveal possible areas for
improvement; & provide ways to measure progress.
 CMMI helps you to build & manage performance improvement systems that fit your unique environment.
 CMMI is a very well regarded framework especially in the software industry
 Very useful for demonstrating process & quality capabilities to customers, partners, and investors

ISO31000:2018 – RISK MANAGEMENT – AN INTRO

Framework 5 components 8 PRINCIPLES RISK MANAGEMENTPROCESS
ISO31000 OBJECTIVES: ISO 31000 states that the guidelines should be used by people who create and protect
value in organisations by managing risks, making decisions, setting and achieving objectives and improving
performance.
ISO31000 PURPOSE: ISO 31000 states that the purpose of risk management is the creation and protection of value.
ISO31000:2018 – RISK MANAGEMENT – 8 PRINCIPLES:
PRINCIPLES:
1. Framework and processes should be customized and proportionate.
2. Appropriate and timely involvement of stakeholders is necessary.
3. Structured and comprehensive approach is required.
4. Risk management is an integral part of all organizational activities.
5. Risk management anticipates, detects, acknowledges and responds to changes.
6. Risk management explicitly considers any limitations of available information.
7. Human and cultural factors influence all aspects of risk management.
8. Risk management is continually improved through learning and experience.
The first five principles provide guidance on how a risk management initiative should be designed, and principles
six, seven and eight relate to the operation of the risk management initiative.
The latter principles confirm that the best information available should be used; human and cultural factors should
be considered; and the risk management arrangements should ensure continual improvement.
The first five principles are concerned with the design and planning of the risk management initiative and these
principles are often summarized as proportionate, aligned, comprehensive, embedded and dynamic (PACED), as
shown in Table 1.

ISO31000:2018 – RISK MANAGEMENT – FRAMEWORK:

 The principles of risk management and the framework are closely related.
 For example, one of the principles is that risk management should be integrated and one of the components of
the framework is integration.
 The principle outlines what must be achieved, and the framework provides information on how to achieve the
required integration.
 The ISO 31000 guidelines are centered on leadership and commitment.
 The effectiveness of risk management will depend on its integration into all aspects of the organization,
including decision-making.
 The remaining components of the framework are design, implementation, evaluation and improvement. This
approach is often represented in management literature as plan-do-check-act.
 ISO 31000 provides narrative description of how the framework should support risk management activities in an
organization.
ISO31000:2018 – RISK MANAGEMENT – PROCESS:
 At the center of the risk management process are the activities of risk assessment and risk treatment.
 Risk assessment is described as having the three stages of risk identification, risk analysis and risk evaluation.
 Each of the three stages is described in detail in ISO 31000 and it provides valuable insight into how risks can be
identified, how they can be analyzed in terms of likelihood and consequences and finally, how they can be
evaluated in relation to the established risk criteria (risk appetite) to determine whether additional action is
required.
 Risk treatment is also a vitally important part of the risk management process and ISO 31000 provides
information on the selection of risk treatment options, the preparation and implementation of risk treatment
plans.
 ISO 31000 states that the selection of risk treatment options involves balancing the potential benefits of
introducing further risk treatment (controls) against the associated cost, effort or disadvantages.
 The risk treatment plan should clearly identify the timescale and responsibilities for implementing the selected
risk treatments.
ISO31000:2018 – RISK MANAGEMENT – HOW TO IMPLEMENT
Successful implementation of a risk management initiative is an ongoing process that involves working through 10
activities below on a continuous basis. These activities relate to: (1) Plan; (2) Implement; (3) Measure; and (4) Learn.
INCIDENT MANAGEMENT-I
Objective: “To ensure a consistent and effective approach to the management of information security incidents,
including communication on security events and weaknesses.”
Audit & Due Diligence Performing an audit will let you know how well prepared the organization is for Incident
Response​ in terms of: People, Process, Equipment
Create Response Team: An Incident Response team should consist of people with sufficient technical skills. It is
important that the team members consist of SME's (Subject Matter Experts) or Knowledge Engineers from different
domains across the organization, Team lead, Triage officer, Incident handler
• Create Documented IR Plan : An organization should have a well-documented IR plan that would guide the
IR Team during an incident. A comprehensive plan at minimum , should cover Roles & Responsibilities,
Investigation, Triage and Mitigation, Recovery, and Documentation process.
• Identify Indicators & Triggers: What would be categorized as an incident at your organization? , How
important or weighty are the factors that would trigger an incident?
Investigate the Problem: Establishing , clearly what has occurred, Identify what systems, people or processes have
been compromised or affected based on incident, Determine what happened & what was compromised, Determine
the point of origin of the incident where possible. This infers that you establish the source of the threat or attack
vector, Specify your investigation objectives, triage and resolution methodology
INCIDENT MANAGEMENT-II
Triage & Mitigatio: Investigation leads to the triage and resolution process. As the team identifies potential
exposure, they should plan and execute effective mitigation accordingly: Classification of Incident, Incident
Prioritization, Assigning specific tasks to specific people
Recovery: Once a thorough investigation has been carried out, recovery is a significant step for restoring services or
materials that might have been affected during an incident. This could be the task of the technical team (transition
from active incident to standard monitoring)
 Documentation & Reporting: A comprehensive incident report is required in keeping with best practices and with
the Incident Response plan. The type of reports that might be required might vary but should help in managing and
reviewing incidents satisfactorily.
Process Revie: Make intelligent decisions about important factors:Should I increase or decrease the number of
Incident Handlers? , What risks did we identify during the incident that needs to be followed up for action and
monitored closely ?
Practice, Practice, Practice !: Do not wait until an incident occurs before you put your team to work. Once the
organization has a workable plan in place, it is advisable to run through part or all of it as a tabletop exercise, and run
through various scenarios and drills.
CHANGE MANAGEMENT-I
ITIL change management is a process designed to understand and minimize risks while making IT changes.
Businesses have two main expectations of the services provided by IT:
1. The services should be stable, reliable, and predictable.
2. The services should be able to change rapidly to meet evolving business requirements
These expectations are in conflict. The objective of change management is to enable IT service management to meet
both expectations—to enable rapid change while minimizing the possibility of disruption to services.
Types Of Changes
1. Standard changes are changes to a service or to the IT infrastructure where the implementation process and
the risks are known upfront. These changes are managed according to policies that are the IT organization already
has in place. Since these changes are subject to established policies and procedures, they are the easiest to prioritize
and implement, and often don’t require approval from a risk management perspective.
2. Normal Changes: Those that must go through the change process before being approved and implemented.
If they are determined to be high-risk, a change advisory board must decide whether they will be implemented.
3. Emergency Changes: Arise when an unexpected error or threat occurs, such as when a flaw in the
infrastructure related to services needs to be addressed immediately. A security threat is another example of an
emergency situation that requires changes to be made immediately.
CHANGE MANAGEMENT-II
Mission: The mission of the IT change management process is to implement changes in the most efficient manner,
while minimizing the negative impact on customers when changes are implemented. KPIs for tracking success of the
IT change management process are:
i. Successful changes: The number of changes that have been completed successfully compared to the total number of
completed changes. The higher the percentage of successful changes, the better.
ii. . Backlog of changes: The number of changes that are not yet completed. While this absolute number depends on
the size of the organization, it should not grow over time.
iii. Emergency changes: The number of completed “emergency” changes. This absolute number depends on the size of
the organization and should not increase over time.
Scope: The scope of the IT change management process is limited to change implementations that will cause:
1. A service to become unavailable or degraded during service hours
2. The functionality of a service to become different
3. The CMDB to require update Other IT changes don’t usually require formal change management. Instead, they can
be tracked as standard IT activities.
IT Change Management Procedures
a. Request for change review: Change coordinators use this procedure when they are dealing with requests for
change.
b. Change planning: Change coordinators and specialists employ this process to prepare the implementation
plans for changes.
c. Change approval: The change manager and approvers (e.g., customer representatives and service owners)
follow this procedure to approve planned changes.
d. Change implementation: Specialists use this process to implement infrastructure changes.
e. Change closure: Specialists follow this procedure when they perform production tests after changes have
been implemented, and change coordinators employ it to close out changes.

CHANGE MANAGEMENT-III
CHANGE MANAGEMENT ROLES
 The change initiator recognizes and identifies the need for change: The initiator should be someone who works
directly with support services tools. Members of your team who provide support services to customers may be
best suited for this position due to their frequent interaction with the system.
 The change coordinator assesses requests for change that originate from incident management, problem
management, release management, or continuity management. The change coordinator registers changes as
needed to handle requests for change or receives change requests from other change initiators; determines the
risk and impact for requested changes; prepares implementation plans by creating tasks; and monitors the
progress of changes.
 The change manager is generally needed in mid-sized and larger organizations. If your IT department is part of
a larger company, you will need to pick one or multiple persons to perform the role of change manager. These
individuals are responsible for managing change procedures, receiving and prioritizing change requests,
evaluating the risk level associated with requests, and keeping thorough records of the outcome of each change.
 The change advisory board is responsible for authorizing changes and further evaluating requests when the
change manager determines that there is a high risk associated with these requests. The board takes into account
the impact that a requested change may have on all affected parties. When these high-risk changes are brought to
the attention of the change advisory board, the board will schedule a meeting with a detailed agenda to
determine how to proceed.
 The approver decides whether to approve or reject changes.
 The change implementation team consists of the specialists on your team who are responsible for actually
making changes. You will likely be part of this team and employees directly under you may also be assigned to
implement changes. As an IT manager, you will often be responsible for overseeing changes.
PROJECT MANAGEMENT FOR INFOSEC: PART 1
IMPORTANCE OF PROJECT MANAGEMENT FOR INFORMATION SECURITY
 CYBER SECURITY CHALLENGES: Reactive, Superficial, Contention, Box-Approach, Governance-
Overkill, Denial During The Last 10 Years
 Effective project management makes or breaks any project: Project management is the sum-total of
managing, organizing, and prioritizing all resources, and tasks in order to achieve a successful outcome within
the stipulated timeframe
 Successful Security Transformation Implementation is heavily dependent upon the project being in the hands
of an experienced project manager: Has authority, Has domain knowledge, Has ability to suggest solutions
 In a nut-shell, effective project management for Security Transformation is about understanding the landscape,
understanding what is required to solve the problem, and being fully committed to ensure that the successful
outcome is achieved within time Common Challenges During Projects: Discipline during the one year
duration, Prior shortage of resources, New initiatives (diversions), Constant slippage of tasksLack of
commitment by team members
 Without bold, well-organized, disciplined, and committed project management, the Security Transformation
cannot be achieved within an organization
 Effective project management is the cornerstone of achieving success for Security Transformation projects.
PROJECT MANAGEMENT FOR INFOSEC: PART 2……see ppt
 STRUCTURE: Structure refers to the hierarchy and organization of teams, their interaction along with
frequency, reporting, and problem-resolution mechanisms
PROJECT MANAGEMENT FOR INFOSEC:
An effective project manager has a thorough understanding of what needs to be achieved, and is able to orchestrate
resources, teams, hierarchy, and reporting in order to achieve a successful project outcome.
REPORTING
Reporting is a critical component of effective project management and has the following objectives:
• Reporting Objectives:
1. Creating visibility
2. Keeping resources engaged for their inputs and involvement
3. Keeping management informed of successes & challenges
4. Creating credibility
5. Ensuring team members are on their toes
Dashboard Objectives:
1. Provide simple & single view of all project tracks, and where the project stands
2. Highlight problem areas for management intervention and support
3. Monthly Steering Committee & Quarterly Board reports

Forum Frequency Report Format Objectives

PDF MINS OF IDENTIFY TASKS, RESPONSIBILITY,

ISMC WEEKLY
MEETING TIMELINE

STEERING PPT INFORM RELEVANT HEADS OF PROGRESS,

MONTHLY
COMMITTEE PRESENTATION IDENTIFY CHALLENGES
 CRITICAL LOOK AT PROGRESS ACHIEVED,
BOARD PPT
QUARTERLY IDENTIFY CHALLENGES & SOLUTIONS,
MEETING PRESENTATION
SEEK ASSISTANCE

• By creating an accurate, honest, and disciplined reporting mechanism, the project manager ensures that all
project stakeholders are informed, involved and helping where necessary for project success
PROJECT MANAGEMENT FOR INFOSEC: PART 4
LEADERSHIP: The Security Transformation requires significant effort over a one year period, All resources have
to be tightly focused on the successful outcome , Without leadership, the transformation cannot take place
Leadership:
1. Authenticity
2. Openness and transparency
3. Respect for all individuals and teams
4. Creating motivation
5. Integrity
6. Boldness to take a stand
 Technical resources will always respect a leader who has knowledge of his/her domain, and is able to provide a
clear and effective strategy
 Security Transformation Leadership is about creating trust, and a team environment to facilitate efforts
resulting in positive outcome
 Security Transformation Leadership is about working with people, at all levels to create a credible and
successful project
Capacity Management – Part 1
 ISO27001:2013 : 12.1.3: The use of resources should be monitored, tuned and projections made of future
capacity requirements to ensure the required system performance
 What is capacity management ?: Aims to ensure that the capacity of IT services and the IT infrastructure is
able to deliver the agreed service level targets in a cost effective and timely manner. The Capacity Management
process considers all resources required to deliver the IT service, and plans for short, medium and long term
business requirements.
 ITIL suggests three sub-processes:
1. Business capacity management: Translates business plans and needs into requirements for IT services and
architecture: As customers’ business changes, so are service requirements changing. Change in service
requirements usually has an impact on demand for capacity.
2. Service capacity management: Service capacity mngmt focuses on management, control and prediction of end-
to-end performance of live IT services usage and workloads. Its about measuring performance and comparing it
to reqmts that are set in Service Level Agreements (SLAs) or Service Level Requirements (SLRs).
3. Component capacity management: Focuses on mngmt, control, performance prediction, utilization &
capacity of technology components (e.g. a hard disc, processor, etc.).
Capacity Management – Part 2
• ISO27002 guidance: Capacity requirements should be identified, taking into account the business criticality
of the concerned system
 System tuning and monitoring should be applied to ensure and, where necessary, improve the availability and
efficiency of systems.
 Detective controls should be put in place to indicate problems in due time.
 Projections of future capacity reqmts should take account of new business and system reqmts and current &
projected trends in the organization’s info processing capabilities
 Particular attention needs to be paid to any resources with long procurement lead times or high costs;
therefore managers should monitor the utilization of key system resources.
 Providing sufficient capacity can be achieved by increasing capacity or by reducing demand.
 A documented capacity management plan should be considered for mission critical systems
 Also consider human resources & offices/facilities
Examples of managing capacity demand include:
a) deletion of obsolete data (disk space);
b) decommissioning of applications, systems, databases or environments;
c) optimising batch processes & schedules;
• ITIL looks at capacity management more in-depth under service design phase
• ISO27002 provides some useful guidance
• In the industry we find that capacity management is not formalized as a process and lacks documentation
RISK MANAGEMENT & INTERNAL AUDIT-I
Three Lines of Cyber Defense:
i. Business & IT Functions (Management Control): The first line encompasses the information security
department as well as various business units that own their cyber risks. These entities need to understand how their
assets are vulnerable and actively manage their cyber risks within organizationally acceptable tolerances.
Sometimes called management control, this function is tasked with managing cyber risks by executing various
controls. This means handling risk events, updating key risk indicators (KRIs), and deploying and managing
controls that affect people, processes and technology.
ii. Risk ManagementThe second line of defense is composed of risk managers looking at aggregate risks at
an enterprise level. It is often simply termed risk management but can also include compliance, legal, quality control
and financial control. The second line looks at cybersecurity control frameworks, defines KRIs and metrics,
creates risk assessments, and tests and reviews conformance by tracking the actions of the first line of defense and
analyzing the impact of those actions to determine their effectiveness in mitigating cyber risks. In other words, this
function monitors how management is doing in its handling of cyber risks by determining the extent that risks are
actively monitored and appropriately managed. It is often performed under an umbrella of senior management and
some board directors or a board-level committee, such as the audit committee or a risk committee. And, importantly,
this second line can challenge the first line.
iii. Internal Audit: The third line of defense is internal audit. It may also include input from external auditors
and/or regulators. This function, sometimes termed independent assurance, evaluates the overall process of cyber
risk governance for the entire organization. It ensures that the organization’s internal control framework is adequate
for dealing with the risks the organization faces. As with the second line of defense, the third line can push back on
the assertions of the previous lines regarding the adequacy of the controls in place. This function usually reports
directly to the board or the audit committee.
MANAGEMENT REVIEW
Purpose: The purpose of the Management Review is to ensure the ISMS and its objectives continue to remain
suitable, adequate and effective given the organisation’s purpose, issues and risks.
Results: The results of the management review will enable senior management to make well informed, strategic
decisions that will have a material effect on information security and the way the organisation manages it.
What should be covered ?
a) the status of actions from previous management reviews;
b) changes in external and internal issues that are relevant to the information security management system;
c) feedback on the information security performance, including trends in: nonconformities and corrective actions;,
monitoring and measurement results;, audit results; and fulfilment of information security objectives.
d) feedback from interested parties;
e) results of risk assessment and status of risk treatment plan; and
f) opportunities for continual improvement.
Who Should Attend ?: For the ISMS to be effective in an organisation, it needs senior management commitment
and, as such, it makes sense for the members of an ISMS “Board’ to have authority in matters pertaining to
information security. Typically an ISMS Board might include the Chief Information Security Officer (CISO), Senior
Information Risk Owner (SIRO), Chief Technical Officer and maybe even the [Link] outputs of the management
review will include decisions related to continual improvement opportunities and any needs for changes to the
information security management system.
Human Resource Security
Prior to employment (ISO27001): Screening, Terms & conditions of employment
ISO27002 guidance (Screening):
 availability of satisfactory character references, e.g. one business and one personal;
 a verification (for completeness and accuracy) of the applicant’s CV;
 confirmation of claimed academic and professional qualifications;
 independent identity verification (passport or similar document);
 more detailed verification, such as credit review or review of criminal records
During employment (ISO27001): Management responsibilities, Awareness, education, and training
ISO27002 guidance (Disciplinary Process): The disciplinary process should not be commenced without prior
verification that an infosec breach has occurred. The formal disciplinary process should ensure correct and fair
treatment for employees who are suspected of committing breaches of info security. The formal disciplinary process
should provide for a graduated response that takes into consideration factors such as the nature and gravity of the
breach and its impact on business.
Termination or change of employment (ISO27001): Infosec responsibilities & duties are defined, communicated
to employee or contractor & enforced
 ISO27002 guidance (termination/change): The communication of termination responsibilities should
include on-going infosec reqmts & legal responsibilities &, where appropriate, responsibilities contained within any
confidentiality agreement & the terms & conditions of employment continuing for a defined period after the end of
the employee’s or contractor’s employment
SBP CIRC. # 5, TECHNOLOGY GOVERNANCE FRAMEWORK
SBP TECHNOLOGY GOVERNANCE AND RISK MANAGEMENT FRAMEWORK
OBJECTIVES: The framework aims to provide enabling regulatory environment for managing risks associated
with the acquisition, development, deployment and use of technology and shall serve as SBP's baseline requirements
for all FI(s). The FI(s) shall upgrade their systems, controls and procedures to ensure compliance with this
framework latest by June 30, 2018. The FI(s) shall assess and conduct a gap analysis between their current status &
this framework and draw a time-bound action plan to address the gaps and comply with the guidelines in this
framework
OVERVIEW: The instructions are focused on enhancing the proactive and reactive environments in FI(s) to various
facets and dimensions of technology including information security, technology operations, audit, business continuity,
project/performance management and related domains (pg 5) FI(s) shall adopt an integrated risk management
approach to identify, measure, monitor and control technology risks (page 5) The Framework consists of 6 domains
and 35 sub-domains Overall the Framework is a combination of COBIT, ITIL, and ISO27001:2013 (ISMS)
Implementation Mechanism
a. Gap analysis
b. Documentation
c. Implementation
CYBER SECURITY MATURITY MATRIX (CSMM)– OVERVIEW
Industry Security Challenges: Grass-roots security controls have not been implemented, Haphazard, reactive
security approach Not following any structured security architecture or framework
What challenges does CSMM address ?: 5 characteristics of Information Security in Pakistan: Reactive,
Superficial, Box approach, Contention, Governance overkill
How is the local industry coping with security implementation ?: Large organizations, Medium sized
organizations, Small organizations
Issues with large organizations: Missed out on security hardening, Vulnerability management effectively not being
done as per Int’l best-practice, Attempting automation or box approach
Issues with medium sized organizations: Don’t have sufficient security expertise and knowledge, Security was
never a focus, Have built insecure IT networks just like the large organizations, VM and hardening missing here too
Issues with smaller organizations:, Mostly have pirated software, Enterprise antivirus and Microsoft Active
Directory (AD) mostly missing, Not enough budget for security, No personnel allocated for security
The industry status: Industry lacks a standard & authentic roadmap of how to achieve security, No mechanism to
measure or certify security, Divergent understanding of how security will be achieved
How does CSMM help ?: Offers a proactive, structured, sequential model to implement security, Model is
certifiable, Cyber Security Certification Board (CSCB) will certify security status of organizations
CSMM - LAYER 1 - FOUNDATION

1.1: LICENSED WINDOWS OR OPEN SOURCE: Licensed windows (MS) , Ubuntu open source, Other
numerous open source alternatives, Basic requirement for a secure IT setup, Pirated software infested with malware
1.2: LICENSED ENTERPRISE ANTI-VIRUS: Users usually do not update their AV, Visibility dashboard, &
central mngmt reqd, Consistent mngmt of hundreds or thousands of anti-virus agents , Many anti-virus agents are
out-of-synch with the update-server
1.3: ACTIVE DIRECTORY (AD): Active Directory (AD) is essential not only to regulate account management
(authentication and authorization) but also to enforce and manage security controls
1.4: Edge FW With Filtering: Forms first line of perimeter defense, Filtering of incoming and outgoing traffic,
DMZ for hosted services, Policy enforcement for security
CSMM - LAYER 2 - FUNDAMENTALS

2.1: LICENSED OR OPEN SOURCE VM TOOL: Vulnerability management or patch management is a

foundational layer of security practice, Open source: OpenVAS, Licensed: Qualys, Nessus, Rapid7
2.2: MIN QUARTERLY CREDENTIAL BASED VM CYCLE: For those organizations that have not conducted
VM practice before, International best-practice is weekly VM cycle
2.3: Edge NGN FW With Web, Email, Anti-malware Filtering: Typical NGN FW: Fortinet, Features: VPNs, web
filtering, email anti-spam filtering, Antivirus, anti-malware, application visibility & control, access-lists
2.4. Network Segmentation With VLANs by Dept./Service & DMZ: Network segmentation helps create separate
broadcast domains , Separate policies and filtering possible for each separate VLAN, Helps manage traffic,
Segregates traffic into traffic-types
CSMM - LAYER 3: HARDENED

3.1: Minimum Monthly Credential Based VM Scan: Now moved to monthly scan from quarterly scan, Credential
based scan from non-credential scan
3.2: CIS BENCHMARKS HARDENING OF ALL IT ASSETS: Hardening covered in detail in this course,
Planning, pilot, production implementation, Usually takes 6-8 months depending upon size of organization
3.3: NGN FW At Datacenter Entry Point With Filtering: Filtering and malware protection at datacenter entry
point often ignored, All traffic including internal user traffic entering or exiting data center needs to be filtered
3.4: Software Security Hardening Program: Software security program needs to be developed, Software security
hardening: controls identification, pilot controls implementation, validation, testing, change mngmt, PROD
CSMM - LAYER 4: PROTECTED

4.1: CIS 20 CRITICAL SECURITY CONTROLS: Aggregate control set covering all aspects of IT, CIS
benchmarks covered individual asset hardening, Excellent set of security controls , Sets out International best-
practices
4.2: Software Source Code Review For Critical Applications: Source code review is a specialized activity which
may be conducted in a manual or automated manner, Specific to the software technology platform, Peer or third-
party
4.3: External/Internal Penetration Test (Critical Assets): Penetration test most beneficial after the internal VM
program is functional, and security hardening has been performed, Third-party review of vulnerabilities and hacker-
view of assets
4.4: ISO27001:2013 (ISMS) Certification: Global gold standard for Information Security governance, Needs to be
wisely used as it is both deep and broad, Utilize as security governance framework leveraging VM and security
hardening
CSMM - LAYER 5: MONITORED

5.1: SIEM SOLUTION FOR SECURITY EVENTS DETECTION: SIEM solutions provide security log
collection, dashboard reporting, root-cause analysis, and correlation, Leading SIEM solutions: LogRhythm, IBM Q-
Radar, Splunk, Elastic Search
5.2: DATA LOSS PREVENTION (DLP) SOLUTION: Classification, visibility, and control of data, Monitoring
and blocking of data leakage and data exfiltration, Network DLP and system DLP (agent)
5.3: CRITICAL DATA ENCRYPTION: Protect intellectual property and confidential information, Confidentiality
and integrity of dataEncrypt data at rest, in transit, and in use….., Laptop HDD and removable media
5.4: SECURITY OPERATIONS CENTER (SOC) IMPLEMENTATION: After implementation of the first four
layers, its time to consolidate security operations, People, process, and technology/tools, Similar to a NOC but for
security purposes, SIEM is starting point
CSMM - LAYER 6: SECURED

6.1: THREAT SIMULATION: Platform such as Redwolf Security ([Link]) , Security testing,
load testing, and DDOS testing, Misconfigured security devices and incident response
6.2: THREAT PROTECTION: Various threat protection solutions, Best solutions will map to the vulnerability
condition of your IT assets e.g. Qualys Threat Protect, Helps to pinpoint most critical assets and prioritize patching ,
Qualys Threat Protection Live Threat Intelligence Feed displays the latest vulnerability disclosures and maps them to
your impacted IT assets. You can see the number of assets affected by each threat, and drill down into asset details.
6.3: SECURITY ORCHESTRATION, AUTOMATION, AND INCIDENT RESPONSE: Solution such as
Cybersponse ([Link]) , From triaging and investigating alerts to collaboration and remediation
between team members, CyberSponse takes your security operation team to the next level.
6.4: RED TEAM PENETRATION TESTING: Red team and blue team, Attack & defense simulation,
Continuously find holes in security defenses, Uncover security vulnerabilities before hackers exploit them
CHAPTER # 7 Ppt: 261 to 284
INFOSECURITY LIFECYCLE – SECURITY VALIDATION
• Lets have a re-look at the 8-Step Security Hardening Methodology

Validation during security hardening: Purpose here is to only validate or confirm that the intended controls have
been correctly and completely applied in the pilot setup. Nothing mentioned for production environment. Nothing
mentioned for BUSINESS LAUNCH (GO-LIVE)
Now lets look at the more comprehensive Information Security Lifecycle (7 stages) which is not specific to
security hardening

 In the Information Security Lifecycle chart, we have already gone into production “environment” with Stage 4
 However, formal approval for BUSINESS LAUNCH (GO-LIVE) has not yet been issued
 Security accreditation has not taken place
 In the Information Security Lifecycle chart Stage 5 & 6:
 …Refer to activities carried out in PRODUCTION “environment”
 …But before Business launch (GO-LIVE) has taken place
 The formal business launch or GO-LIVE only takes place after Information Security team accredits that the new
application/portal or service is secure
 Business launch or GO-LIVE also has business related activities as dependencies such as marketing, & other
Business launch or GO-LIVE dependencies: UAT & application bug testing and feature testing, Facilities
readiness, Sales & marketing Launch ceremony, Partner readiness, Org service readiness
Lets look at the following steps in more detail and granularity in the following modules:
a. Security validation
b. Security testing
c. Security accreditation
What is Security Validation ?
What does security validation mean ?: To confirm via walk-through of system or device that the security controls
implemented by an IT team have actually been implemented correctly
Who implements the security controls ?: Under the Security Transformation Model, security controls are
implemented by the IT teams
Who conducts security validation ?: Security controls are validated by the Information Security team or by a third-
party consultant following the principle of segregation of duty
Why do we need to validate security controls ?
i. To check the completeness of the controls: Usually 100’s of controls need to be implemented, There may
be genuine omissions by technical team members ,There may have been errors made
ii. To check the correctness of the controls: Technical capabilities of teams vary, Technical capabilities of
team members vary, A technical issue may not have been understood correctly
iii. As an overall assurance: Ability, integrity and diligence of team members are key factors, Healthy
technical debate and cross-checks have a positive outcome on the program…..IT team may not have sufficient
resources to ensure 100% completeness and correctness. Implementation by IT and validation by Information
Security team forms a healthy team relationship. This is also referred to as maker-checker principal, Some of the
controls may have been designated as “not-applicable” or “not possible” and the reasons and justification needs to
be reviewed
 Significant resources are allocated to the security transformational program; even one control missed may
affect the security posture
 The Information Security team or the ISMC is tasked with the overall responsibility of the success of the
program
 Any lapses discovered later fall squarely under the responsibility of InfoSec/ISMC
 Security validation becomes an essential activity and needs to be established in an environment of healthy &
professional commitment to ensure the 100% complete and correct implementation & upkeep of the
controls
How is Security Validation Performed ?
Ownership of security validation lies with Information Security team, alternately with an Information Security
consultant
Driven by ISMC or Head of Information Security
Security validation is the same irrespective if performed specific to 8-Step Security Hardening (Model) or to the
Information Security Lifecycle: Decide Scope, Study Controls, Conduct Review, Remove errors
1. Decide Scope: Acquire checklist of applied controls from IT team, Decide stakeholders who will conduct
review (IT & InfoSec), Schedule the review and send formal email to IT (plus calendar invite)
2. 2. Study Controls: Information Security team to acquire original controls from CIS/DISA/other, Study &
understand the controls, Mark the checklist & ensure correctness, Prepare docs & notes for actual review
3. 3. Conduct Review: One person to conduct review & one to take notes, Walkthrough of each control, Random
sampling of controls (20-30%) , Agree on any action items for shortcomings with timeline, Important to discuss
& understand controls marked by IT team as: Not-applicable and Not-possible, Understand reasoning, Verify
dependencies if any, Challenge the IT team view wherever appropriate
4. 4. Remove Errors: IT team to remove any shortcomings or omissions in control implementation , IT team
reports back to InfoSec team when all shortcomings fixed
5. 5. Confirm Validation: InfoSec team schedules another session with IT team to confirm that all shortcomings
have been removed, InfoSec team adds a confirmation column & comments column to checklist , Status of
validation communicated to relevant IT teams & stakeholders , Records updated to register the validation
activity, Project management stats updated accordingly (% complete)
WHAT IS SECURITY TESTING ?
What is security testing ?: Security testing is a process intended to reveal flaws in the security mechanisms of an
information system that protect data and maintain functionality as intended
Security testing is not validation: Security testing consists of running tests through a manual process or automated
tools to discover weaknesses, flaws, or bugs in the software, application or device
Types of security testing:
1) Vulnerability assessment: VA scanners have various tests built-in such as for malware, vulnerabilities,
web application flaws (e.g. OWASP top ten), Compliance scanning against CIS/DISA benchmarks
2) Penetration Testing: Penetration testing (also called pen testing) is the practice of testing a computer
system, network or Web application to find vulnerabilities that an attacker could [Link] outsourced to a
third-party depending on nature and criticality of the application or service being launched , Highly specialized
skill not commonly found in-house, Pen tests can be automated with software applications or they can be
performed manually. Either way, the process includes gathering information about the target before the test
(reconnaissance), identifying possible entry points, attempting to break in (either virtually or for real) and
reporting back the findings
3) Other security tests: If the testing is being conducted in-house, the tests should be conducted in the
pilot/testing/staging environment and re-validated in the Production environment, If the testing is being
conducted by a third-party specialist (such as for penetration testing), it will normally be conducted only in the
Production environment (prior to GO-LIVE)
4) Other security tests (in-house): In-house testing capability & experience, Conduct the tests (e.g. OWASP
ZAP tool), Report findings, Re-confirm once remediation done by IT
5) Other security tests (outsourced): As mentioned, will most likely be conducted in Production
environment, prior to GO-LIVE, Follow same sequence as for in-house testing
6) Code review: Code review examines flaws and vulnerabilities in programming source code, A complete
cycle, initiated early and in pilot testing phase, May be conducted for production applications as well, Requires a
mature internal process, experience and capability, May be integrated with software QA testing
WHAT IS SECURITY ACCREDITATION ?
What is security accreditation ?: Accreditation is the formal acceptance of the adequacy of the system’s overall
security by the management (SANS)…………..Lets have another look at the Information Security Lifecycle… see 7
stage cyle
 Whenever a new, significant portal, application, or service is launched, management requires Information
Security team to certify after carrying out the required security validation & security testing that the…
 Security of the new portal/application or service has been thoroughly examined & tested and meets the min
requirements as per organizational security policy
 That the new portal/application is safe & secure & is free from security risks
SECURITY ACCREDITATION SEQUENCE (ppt 265)
1. Organize: Collect all security requirements, related security policy & SOPs, hardening checklists,
validation status reports, test reports, completion status reports, Information Security team ensures that the full
context of the security risks/impact are understood, Subsequent security hardening & testing has been fully covered
2. Prepare Checklist & Share With Stakeholders: Checklist should cover all activities & their status for
completion of accreditation, Share with stakeholders for feedback
WHAT IS SECURITY ACCREDITATION – PART 2
SECURITY ACCREDITATION SEQUENCE
3. Confirm Tests: Core activity: confirm that all test reports are satisfactory, All tests and follow-up remediation
measures have been completed
4. Documentation & Processes (Complete): Reconfirm correct versions, Re-check checklists, SOPs, Backups &
DR, All change control measures & sign-offs, Re-check all management approvals, Re-check UATs, customer sign-
offs, Check application performance issues
5. Team Meeting: Call team meeting and report status of all activities, List any snags & decide completion dates,
Seek stakeholder sign-off on accreditation form, Clarify & recap security requirements & SOPs, Clarify what actions
will invalidate the security accreditation
6. Issue Accreditation: Once all details completed on accreditation sign-off form issue accreditation, Business has
GO-LIVE permission using tested versions, Enter activities for accredited IT assets into IT audit program, Update
Operations teams, incident management, and risk management register
EMBEDDING INFOSEC LIFECYCLE INTO SDLC for detail see Ppt 267
SDLC: The systems development life-cycle (SDLC) should embed the Information Security activities forming a sec-
SDLC (secure SDLC). Software Assurance Maturity Model (SAMM) developed by OWASP. A guide to building
security into software development. 96-page PDF, Four critical business functions, For each business function there
are three security practices, For each security practice, three maturity levels as objectives, The Software Assurance
Maturity Model (SAMM) is an open framework to help organizations formulate and implement a strategy for
software security that is tailored to the specific risks facing the organization.
The SAMM document sections:
1) Understanding the model
2) Applying the model
3) Security practices
4) Case studies
SOFTWARE SECURITY TESTING & VALIDATION–1 for detail see Ppt 268
• The OWASP Software Assurance Maturity Model (SAMM) undertakes software security testing & validation
during the following phases:
SOFTWARE SECURITY TESTING & VALIDATION–2…..
• SAMM is an excellent model for software (security) assurance
• OWASP also has a multitude of additional materials, guidance, and tools for software and seb application
security
EMBEDDING INFOSEC INTO PROJECT MANAGEMENT
PMIs five phases of project management: for this see Ppt 270
1. Initiate
2. Plan
3. Executing
4. Controlling
5. Closing
 Senior management needs to ensure that security is integrated with IT project plans
 Sufficient security resources should be made available to manage the security aspects of projects
How To Conduct Internal Security ASSESSMENT
What is an internal security assessment ?: An effort to assess the security posture, risks, or vulnerabilities for any
project, service, application, or device
When is an internal security assessment required ?: Launch of a new IT project or service, When an incident has
occurred, On change of leadership, Regulatory or compliance reqmts
Sequence of security assessment:
1. Management approval or communication
2. Assign resources
3. Build plan, scope and objectives
4. Conduct assessment
5. Report findings & remediation measures
Management approval or communication:
1. Authority of the assessment
2. Cooperation from stakeholders
3. Determine & communicate timeline
4. Determine appropriate report format
Assign resources:
 Assign information security resources with relevant experience
 Identify respective resources for IT asset to be assessed
 Hold initial meeting with respective stakeholder POC
Build plan, scope & objectives
o Study IT asset & gather background security docs
o Clear scope boundary
o Clear objectives
o Determine assessment method based on report format
o Build plan
Conduct assessment: Conduct the necessary activities such as system walkthrough, vulnerability assessment,
security testing, evaluation of security controls, review of process and documentation, etc
Report findings & remediation measures
o Assimilate and analyze findings
o Determine level of severity, risk and appropriate remediation
o Tailor findings to report format & appropriate to forum
o Share report
A few pointers:
o Security should not be reactive
o Security transformation project should address security loopholes
o Align the security assessment with benchmarks established already
DIFFERENT TYPES OF SECURITY ASSESSMENTS
• Vulnerability assessment, Penetration test, Audits, Whitebox/greybox/ blackbox assessments, Risk
assessment, Threat assessment, Bug bounty, Red team
Vulnerability assessment: Technical assessment to yield as many vulnerabilities as possible in an environment
along with severity and remediation priority information. Best when security maturity is low to medium, need a
prioritized list of everything that’s wrong, goal is to fix as many things as possible as efficiently as possible
Penetration test: A Penetration Test is a technical assessment designed to achieve a specific goal, e.g., to steal
customer data, to gain domain administrator, or to modify sensitive salary information. Penetration Tests are for
testing security that is assumed to be strong. No point in wasting the effort if hardening and vulnerability assessment
have not been done
VA & PT difference:
 Vulnerability assessments look for security problems when you know/assume they exist, and penetration
testing validates a configuration when you believe it to be secure
Audit: An audit can be technical and/or documentation-based, and focuses on how an existing configuration
compares to a desired standard. Orgs use audits to demonstrate compliance, Importantly, compliance should not be
used to demonstrate security, Compliant orgs more likely to be secure, Secure orgs are significantly more likely to be
compliant (if checked), but compliant orgs should lay no claims to being secure just because they are in accordance
with standard X or Y.
Risk assessment: Should involve determining what the current level of acceptable risk is, measuring the current risk
level, and then determining what can be done to bring these two in line where there are mismatches. Risk
Assessments commonly involve the rating of risks in two dimensions: probability, and impact. Umbrella term for
determining what you have of value, how it can be attacked, what you would lose if those attacks were successful,
and what should be done to address the issues.
Threat assessment: The driver for the assessment is to determine how many resources—if any—should be spent on
addressing the issue in question. A threat assessment is best used in situations where someone has made a claim
around performing an attack in the future, or such a potential is uncovered somehow.
Bug bounty: A Bug Bounty is a type of technical security assessment that leverages crowdsourcing to find
vulnerabilities in a system. The central concept is simple: security testers, regardless of quality, have their own set of
strengths, weaknesses, experiences, biases, & preferences, & these combine to yield different findings for the same
system when tested by different people. Best used when you have done multiple Vulnerability Assessments already
and have already found the easy stuff. Bug Bounties excel at finding issues not found using other methods.
Red team assessment: “Red team” is: an independent group that challenges an organization to improve its (security)
effectiveness, Services should be continuous rather than point-in-time, Best used when an org has covered the basics
of strong vulnerability management and has at least some capability to detect and respond to malicious or suspicious
behavior in the environment
Note: the term red team is taken from the military maneuvers where a red team simulates attacks and a blue team
takes evasive measures against those attacks
STAGES OF 3RD PARTY PENETRATION TEST
1. SYSTEM PORT SCANNING
2. IDENTIFICATION OF SYSTEM SERVICES
3. IDENTIFICATION & VERIFICATION OF SYSTEM VULNERABILITIES
4. PENETRATION TESTING (SYSTEM EXPLOITATION)
1. SYSTEM PORT SCANNINGL Port scanning is one of the most important phases of a vulnerability assessment
exercise prior to a penetration test. This will be the first tool used by an attacker once he has identified the IP address
to be targeted. The key part here is to use a multiple of port-scanning tools in order to ensure the least false positives
and the maximum information that can be gathered.
2. IDENTIFICATION OF SYSTEM SERVICES: Once the open ports have been enumerated, it is important to
determine the services that are keeping those ports open. - This is typically done by analyzing the banners thrown
back when a default connection is made to the open port. The latest nmap version allows this to be done using the –
sV switch.
3. IDENTIFICATION & VERIFICATION OF SYSTEM VULNERABILITIES: During vulnerability
identification, an assessor will perform several activities to detect exploitable weak points. These activities
include:Identify vulnerable services using service banners. Perform vulnerability scan to search for known
vulnerabilities. Information regarding known vulnerabilities…Information regarding known vulnerabilities can be
obtained from the vendors’ security announcements, or from public databases such as SecurityFocus, CVE or CERT
[Link] false positive and false negative verification (e.g. by correlating vulnerabilities with each other
and with previously acquired information). Enumerate discovered vulnerabilities. Estimate probable impact (classify
vulnerabilities found). Identify attack paths and scenarios for exploitation.
4. PENETRATION TESTING (SYSTEM EXPLOITATION): Following the approvals of individual attacks by
Customer, the assessor tries to gain unauthorized access by circumventing the security measures in place and tries to
reach as wide a level of access as possible. This process will have the following steps: Find proof of concept
code/tool Find proof of concept code available in your own repository or from publicly available sources to test for
vulnerabilities. If the code is from your own trusted repository and… …thoroughly tested, you can use it, otherwise
test it in an isolated environment. Develop tools/scripts Under some circumstances it will be necessary (and cost
effective) for assessors to create their own tools and scripts.…Test proof of concept code/tool in an isolated
environment . The proof of concept code/tool is used against the target to gain as many points of unauthorized access
as [Link] findings
SECURITY TRANSFORMATION: FAILURE ? CH # 8 Ppt 276
Let us examine the reasons for proposing a security transformation in the first place: Information security almost one
generation behind, Arduous to catch up with Information Security posture unless there is a “transformation”
Guaranteed failure: Cosmetic commitment, Not willing to invest in resources, Deficient program structure, Lack of
effective project management
Cosmetic Commitment:: Lack of awareness & understanding, Short-term vision, Lack of priority, Poorly managed
organization
Not Willing To Invest In Resources: Deficient allocation of funds for Information Security Program,Not willing to
allocate time for IT to perform security tasks, Loss-making organization
Deficient Program Structure: Ineffective Information Security Management Committee (ISMC), Not taking along
other stakeholders, Inexperienced IT or security leadership, IT team not incentivized
Lack Of Effective Project Management:, Any project will fail without effective project management, Effective
planning, execution, monitoring, and reporting, Experience & domain knowledge
BENEFITS OF THE SECURITY TRANSFORMATION
Key Benefits: Prevention of attacks, Prevention of fraud & pilferage, A reliable & robust IT setup
Impact of attacks: Loss of market goodwill, Loss of customer confidence, Regulatory fines, legal consequences
Prevention Of Fraud & Pilferage: An effective Information Security Program makes it harder to conduct fraud,
abuse, or misuse without getting detected, Controls in business process, Audits
• A Reliable & Robust IT Setup: Business continuity & DR, Redundancy, Backups, Capacity management,
Change management, Incident management
SECURITY TRANSFORMATION TIMELINE
Recommended timeline for security transformation project
Month 1: Planning: Understand organization & security issues, Develop ISMC, Identify stakeholders for InfoSec
Steering Committee, Identify assets for various phases, Project kickoff and awareness trainings
Months 2-3: Pilot (Phase 1) : Perform hardening of key IT assets in test environment (Pilot), Validate the hardening
in the test environment, Prime IT & InfoSec teams for their roles, Vulnerability management pilot
Months 4-5 (Phase 2): Hardening of IT assets (minimum security baseline) identified for phase 2, Validation of
hardening and moving the hardened IT assets to PROD environment through change management process
Months 6-7 (Phase 3): Hardening of IT assets (minimum security baseline) identified for phase 3, Validation of
hardening and moving the hardened IT assets to PROD environment through change management process
Months 8-10 (Phase 4): Technical teams continue the IT assets hardening in phase 4, Raise vulnerability
management program frequency to monthly …Focus on governance (policies, SOPs, etc)
Months 11-12 (Phase 5): ISO27001:2013 stage 1 and stage 2 certification, Stage 1 mostly documentation review,
Stage 2 mostly implementation review
SECURITY TRANSFORMATION RESPONSIBILITY
 Responsibility for the security transformation is a balance between management & security team
 IT team led by the CIO plays an instrumental role in the success of the program
Management role:
 Commitment
 Sets the tone at the top
 Allocates resources
 Assigns responsibility & roles
 Conducts periodic performance review
Information Security Team:
 Builds an effective strategy & structure for the program
 Identifies key players to enroll in ISMC
 Ensures effective execution & project management
 Conducts transparent reporting
IT Team:
 Mobilizes the resources for implementation of the security program
 Ensures quality and process during the security transformation program
 Resolves roadblocks in implementation
ACTIONS TO RAISE MANAGEMENT SUPPORT
What can you do if your organizational management is not supporting for the Information Security Transformation
Program ?
a. Understand the organizational business requirements and potential impact
b. Understand regulations & sector best-practices
c. Evaluate the security posture
d. Assess the extent of work and resources required
e. Present your report

KEY QUESTIONS TO ASSESS SECURITY POSTURE…..See Ppt: 282

What are the key questions that can be used to assess the security posture of the organization ?
By evaluating the security posture and comparing with a few other organizations (through a limited survey), the
security posture can be portrayed in a quantitative manner
KEY LEADERSHIP QUALITIES OF INFOSEC HEAD
Lets examine the key leadership qualities of the Information Security Head or the key resource driving the Security
Transformation Program: Authenticity, Candidness, Fairness & fair play, Team environment, Recognizing talent and
hard work, Celebrating success !
1. Authenticity: IT is complex, No one person “knows-it-all”, Communicate that each individual has limitations ,
Admit mistakes and failures, Give credit where it is due
2. Candidness: Call a spade a spade, Honesty and straight-talk, Hear feedback and give respect to views of
everyone
3. Fairness & Fair Play: Promote performance and merit, Adjust players in the right positions based on their
strengths, Coach and guide team to perform and achieve results
4. Team Environment: Discourage solo-flight and promote team consensus, team reviews, and team achievements,
Single out and coach individuals playing turf tactics
5. Recognize Talent & Hard Work: Identify self-promotion versus talent combined with hard work, Encourage
hard workers who are team players
6. Celebrate Success ! Hold team celebrations, Recognize quiet workers and background workers as well,
Promote team achievements