Program Maturity - Cyber-security and Operational Risk Maturity

The Balancing Act

In reviewing my LinkedIn notifications I was wonderfully surprised to find  an article written by Gideon T. Rasmussen, VCISO topic: Cyber-Security and Operational Risk Maturity.  As soon as I saw it I was thinking this is center to our consulting business I better pay attention. So here we go.

As Gideon T. Rasmussen comments on leveraging risk I immediately get hooked.  How can you even begin to understand your operational and situational awareness with out at first understanding your risk.  At Integris Security we advise our clients if not done within the past twelve months get a solid risk assessment done ASAP!  This risk assessment can then help you set priorities, establish tactical and strategic budgeting, technology goals and priorities and help you weigh your operational risk.  We at Integris believe this will improve the overall maturity of your cyber and operational approach.  But let's go on and see what else Rasmussen's nicely laid out article reveals.

Rasmussen's talks about U.S. Department of Commerce's,  N.I.S.T. (National Institute for Science and Technology).  For a great many of us in the IT security practice N.I.S.T. for years has been the go to "tool shed" for in-depth building blocks.  Their publications can take you from the very beginning of ....   What should I do? Where do I start? To a polished well informed presentation.   N.I.S.T. has a great many publications and they are 100% free.

The F.F.I.E.C., also provides great free guidance.  The men and women of the Northeast Chapter of the F.F.I.E.C., are your local financial services regulators.  You should get to know them, work with them and understand how they are approaching many of the same issues we all are trying to tackle every day.  Integris Security highly recommends you  review the regulators guidance and find answers to your company's compliance problems. These tools are also 100% free and incredibly useful information.

I do take issue with Rasmussen regarding this statement:

"There are no requirements for disaster recovery or business continuity. The card brands do not care if your business goes under, as long as their payment card data is secure." 

This is a nit, and can also be style but the point has to be made.  Their are literally hundreds of best practices for disaster recovery and business continuity and they should be put to use, despite the lack of attention by card brands to advise this.  Promotion of best practices is something we owe to the industry as a whole in our writings and presentations.  Taking on the Card Brands for lack of attention to Rasmussen's legitimate concerns would do better as a separate article, another a day and time in my eyes. We're talking Cyber-Security and Operational Risk Maturity.  At Integris Security we push all to stay focused.  Good practice is too important to relegate to tomorrow's news.  Let's keep it up front and worthy of continual presence and persuasion in our discussions in how to improve cyber-security and operational risk maturity.

In maturity level II, I love this discussion of controls and it reminds me of C.O.B.I.T., as well as the many information security joint forums held with ISACA in years past and their auditor/members.  You gotta love the structure that these individual professionals have developed and the principles that they follow.  This is a serious group of security professionals and we could all learn allot from them.  Rasmussen then lays out the common controls read: GAP analysis, and Risk based deployment of controls, while not much new here he provides a great review.  All solid material for a CEO and others within the organization to read and understand when weighing decisions on investment in the security program or cutting the fat off an already lean program.  These decisions will not be easy ones for sure.

My own note here:

The Cyber-Security and Operational Risk Maturity discussions can not be left alone to the operational business units, departments or divisions of your company.  These discussions need to expand and involve audit committee's at the board level and become a fluid ongoing discussions lead by the chair of the audit, technology and other important committees as the board and operational personnel try to achieve a balance of risk Vs reward and continue to build market value for the company's shareholders and investors.

 Joseph R. Concannon             

In maturity level III, Risk Management, Rasmussen covers it nicely and I smiled as he stated:

"It is necessary to tailor controls to the organization and to adapt to changes in the threat landscape."

Nicely done Gideon T. Rasmussen, these words couldn't be truer.  It also reminds me to tell our readers to remember that each organization has its own culture.  Some are very risk sensitive and others not so much so.  I often use Johnson and Johnson and Martha Steward Living as examples.  Two great companies but their approach to security was night and day.  Johnson and Johnson a security controls organization (almost war like) and Martha Steward Living a creative design firm.  The cultures were completely different at the time of my interview with security personnel.  Management of your and the company expectations are very important.  Don't get ahead of your skates or you  may get caught off balance.  Knowing the culture of your organization is key and very important.  Now that you have new security and risk management information in hand how do you operationalize it?  The best advice is work with your team and leader and try to introduce incremental improvements to improve your organizations overall security/risk posture.  This will work to your benefit for the short term tactical business operations as well as long term strategic planning for important improvements.

Your threat and vulnerability map will be constantly evolving, as targets and priorities come and go.  The risk assessment report provides you with items for your to-do list.  The report will show best practices and offer a target rich list for you to prioritize.  Rasmussen I believe understands this and covers it nicely and provides some bonus points by laying out some bullets for a prospective slide deck to communicate your findings and setting some future objectives.

The Risk Register is a platform to inform and Rasmussen points this out clearly.  Want to know more about your risk?  The Risk Register is a place you want to go to identify, define, understand impact, respond, prioritize, and take notes.  Its an invaluable tool given to us by the folks from project management.

Maturity level IV, Strong Risk Management, Rasmussen lays out a ten step program.

Rasmussen says:

1. There is appropriate separation of duties in the CISO’s reporting structure, such as reporting to the CEO, Chief Risk Officer or Board of Directors. When the CISO reports to the CIO, it is a conflict of interest  2. Cyber-security metrics, KPIs and KRIs feed into an Enterprise Risk Management program.  3.The CISO provides updates to the Board of Directors or similar executive group.  4.The cyber-security program maintains controls specific to line of business products, services and assets. 5. A process management program is in place, to include policy, an inventory and process risk analysis.  6. A fraud prevention program is in place, to include fraud risk assessments conducted by an independent third party. 7. An operational risk management function maintains a risk scenarios inventory and conducts quantitative risk analysis. 8.The organization leverages the Three Lines of Defense Model, with active support from operational management, risk management and compliance functions and internal audit. 9.  Operational functions and lines of business are required to declare self-identified audit issues, with metrics in place to demonstrate the control environment is improving continuously 10. Incident response and business continuity exercises are conducted annually to include senior executives, lines of business leaders, information technology, legal, public relations and critical suppliers

This information is a like having a great cyber-security road map.  However, just like any road map their are going to be detours, accidents, potholes and your going to need the awareness, patience and skills to work around it all.  If you follow the program laid out by Rasmussen you'll be in a better position to mitigate those great unknowns and navigate your way freely from obstructions.

At Integris Security we say: you make it, we make it secure!  We look forward to having these and many other important discussions with you and really enjoyed our read of Gideon T. Rasmussen's LinkedIn article concerning Program Maturity - Cyber-Security and Operational Risk Maturity and hope that you will too!  Their is much to learn and many experiences to endure before we can truly say we're secure.


#Cyber-Security  #HomelandSecurity  #InfraGard #ISSA #ISACA #FFIEC #NIST

Zooming not so fast....slow down

Video Conferencing Software/Weak Security?

Never Share Passwords

Keep Meeting ID’s Private

Make Use of Waiting Rooms

Zoom, the video conferencing software maker learned a lot of lessons this past month as a result of legions of new visitors who stopped by and signed up as new customers.  The software company literally exploded with new customers during Mid March 2020 as a result of the COVID -19.  However a number of security incidents started happening and with that a fire hose of commentary poured into their email boxes, security blogs, conference calls and forums.  Security professionals came on strong.  One security practitioner commented that the right out of the box the default settings needed serious review and the general public was at the point of the spear - buyer beware.  Waiting rooms, passwords, and many other enhancements all focused on security and reducing risk were heard from all quarters.  

To the credit of Zoom, now known as that easy, cheap video conferencing software have made the changes to improve security (change to many of the default settings, like requiring password as a default for all meetings, establishing a waiting room so you can verify participants and sprinkling of the message not to share passwords, etc) and reduce the risks to many of its users. Zoom has taken it on the chin for many in this functional area: "Video Conferencing Brands" while the rest of the pack gets the opportunity to take another look at security.  Zoom brought on a security professional and kinder days seem to be in the future. Zoom also has a HIPAA compliant application separate from what general users get to use.  See the photo above for the last known update from Zoom.  Zoom is growing and has been sending out improvements as they become available.

Video Conference Software:

Never Share Passwords

Keep Meeting ID’s Private

Make Use of Waiting Rooms

Here are some additional products for consideration:

• GoToMeeting
• Webex Teams
• Skype for business
• Google Hangouts
• Join.Me LogMeIn
• Amazon Chime
• Microsoft Teams
• Cisco Webex Meetings
• Updox
• Vsee
• Zoom for healthcare
• Spruce health care messenger
• Apple Face Time
• Doxy.me
• Face Book Messenger Chat
• Blue Jeans - recently purchased by Verizon

Check out each of these products and note well during a declared national emergency many if not all maybe used without compliance penalty.  However, after the emergency is over please do use HIPPA compliant software.  See shorturl.at/fijHL for future updates at U.S. H.H.S. dot gov.


NIST - Navigating the Conference Call Security Highway

Today 4/25/20 I reviewed an article from Dr Eric Cole, Secure Anchor Consulting. These are some of his thoughts:

Zooming now household word	Due to pandemic March/April 2020 video conferencing increases 1000 fold.  "Zooming" takes on a life of its own for all brands of video conference calling software.
ZOOM BOMBING:  DEFINED	Is where a person joins into Zoom video conferencing calls uninvited and either 1.) listens in, 2.) gathers important info to use at a later time or 3.) become disruptive to your meeting or event.
How do you protect a Zoom call?	Remember you are a target, 2. Cyber security is your business, 3. Make sure your software is up to date.  Make sure your computer operating system is up to date Make sure your Zoom app is up to date and other apps as well Make sure you are using anti-virus software and its up to date Do not post Zoom links in the public eye Don't click on links you don't know Setting up meetings: Use strong passwords Do not share the meeting ID Use a non obvious meeting ID Use the waiting room function Lock the meeting once everyone is in

New Post: 5/5/20

Jeff Furman my "go to guy" for Project management hosts a blog and has some Zoom fun and other suggestions check it out here:  https://www.linkedin.com/pulse/so-your-internet-crashes-middle-zoom-session-what-you-jeff-furman/

Take a peek at the: Project Management Answer book click the link.

New Post: 5/7/20 am

On a conference call today.  Discussion of fat client verses thin client again for VT software (for the young at heart this seems to reoccur every 5-10 years), functionality services were discussed (I think more of what you are used to using drives the most favorite product discussion) and end to end encryption took place.   Zoom came up and given that it is slowly improving its security posture some note it is moving into the "pack" of other VT implementations given that it will become less of a pick up and use utility because of security concerns.  Those with more security concerns and less functionality can look here: https://www.infosecnews.org/national-security-agency-releases-guide-to-secure-video-conferencing

New Post: 5/7/20 pm

Take a look at this very comprehensive post from Citizen Lab:
https://citizenlab.ca/2020/04/faq-on-zoom-security-issues/

Then this video by none other than: Dr Eric Cole

A few weeks ago there was a lot in the news about ZOOM Bombing. So ZOOM took action and set up some default security to 'appease the masses'. But here's the thing... they did too little, too late AND ZOOM meetings are still being targeted.

It's not over! The adversary is still on the prowl and creating havoc.

I recorded a quick video for you to share with your organization to help keep the awareness around how to protect against ZOOM Bombing.

Dr Coles Tips:

#security  #cybersecurity @Zoom @NIST #VideoConferenceCalling #VT #DrEricCole  #zoombombing

Last edit: Monday, 5/5/20 0930 hours

Cyber Security Month: Looking for Answers Part II?

NEW YORK METRO JOINT CYBER SECURITY CONFERENCE

NY Metro Joint Cyber Security Conference

I recently attended the Third Annual New York Metro Joint Cyber Security Conference (http://nymjcsc.org/), held in mid-town Manhattan.  Security conferences are now a dime-a-dozen, but this event is unique in that it is a collaborative effort developed by a consortium of eight leading security, audit, and risk focused, NY metropolitan area, not-for-profit professional associations. Each organization brings its best to the table, creating a rare combination of expertise and diversity of talent.  

There were many informative sessions – some standing room only – but some of the greatest value was in the interaction with the other professionals.  For example, in sessions, we learned that security professionals must adopt the language of Directors to be understood by a Board.  The Internet Security Alliance is even working on metrics for Boards to use in evaluating security risks and controls.  But, after all the talk of security maturity models, cyber risk management frameworks, and “cyber balance sheets,” CISOs (Chief Information Security Officers) will tell you that Boards still “just don’t get it” and don’t seem to be that interested.  Perhaps CISOs as a group aren’t very good at explaining how greater focus on preventing and mitigating cyber threats is in the self-interests of very diverse sets of Directors.  Maybe, despite approaching the problem with the best of business concepts and lingo, CISOs just don’t have influence with Directors.  (As one CISO put it, “formulas don’t work.  Relationships do.”) Or, perhaps it’s because, as one speaker put it, there is not a single instance of a cyber breach that has been demonstrated to have a material impact on a company.  In the end, the surprising takeaway may not be that CISOs are becoming more adept at speaking the language of the Board, but that some Boards are beginning to listen at all.

This sold-out event offered excellent, high-quality presentations with plenty of actionable content.  If you weren't able to attend, you can still benefit from the recordings of many of the sessions.  They are available at http://livestream.com/internetsociety/nymjcsc/.  Presentation slides may be found at http://tinyurl.com/z3fz44d. I would highly recommend reviewing them.

And, don't forget to sign up early for next year's conference.  It's one of the best values in information security education that you'll find anywhere.  Follow www.nymjcsc.org and @NYMJCSC for details.

Phil Froehlich is Chief Operating Officer of Integris Security and a member (who listens) of the Executive Board of New York Metro InfraGard.

Careful What You Wish for

Trust is at the core of
Integris Security LLC

Have you ever wondered where to start in securing your computer operations?  Its natural to be concerned and to suffer from some anxiety. Careful what you wish for because when some people apply for CSO, CISO jobs they may suddenly find that they got what they wished for.  Now what?  Where do I start, what comes first, yikes I need priorities, but where?

Integris Security LLC with the help of some of our friends from the NY InfraGard Thursday Conference Call came up with some great resources which you should become familiar with.  We also discussed at some length ISO 27001.  It was the conclusion of the of the callers that the ISO standards are written to be very broad and do not focus the security professional on what needs to be done with any given priority.  The ISO standard could lead you down a road unfocused and without clear priorities of what's really important for your organization.

Here are some focused security and risk management resources:

• Security Affairs Blog Post
• NIST Cyber Framework
• Council on Cyber Security
• Tripwire Executive Guide Top 20 Security Controls

Security professionals need to have a full understanding of the environment which they are securing.  These men and women need to be able to explain to others why we need this control, that defensive tool, etc...  The security professional needs to be intimately involved with the infrastructure and provide a solid understanding of every facet of the operation.  This work takes dedication - endless time and energy that becomes the life and work product of a CSO/CISO.

CSO's and CISO's would do well to build a set of books which would consist of the environment that they have been hired to protect.  In these books should be the SANS twenty controls.  Each control should be explained in detail and record of examination clearly maintained so that each fresh security face  looking at the systems will not have to hunt for the documentation.  This is part of your audit trail.

Why SANS? The SANS organization has distinguished itself as an expensive but outstanding security organization from which excellence is derived from.  The SANS top 20 security controls are maintained and updated so that security professionals can be assured they are addressing the top known threats.

How can a true security professional even begin to contemplate securing an organizations assets without knowing the environment inside / out?  It is impossible.  If your organization needs assistance in understanding these and other security issues, give Integris Security a call and let's get started today.

Trust is at the core of Integris Security. We can be counted upon to provide you with the services and intelligence to keep your information, systems and institution secure. Call us and let's get to work on improving your security/risk posture.