Integrate ASV data directly into your IT-GRC System

Through our award-winning IT-GRC platform, SecureAware®, we recently completed an asset-based ASV proof-of-concept demonstration to a very large merchant. This organization has over 3,000 locations globally and manage over 90,000 network assets. The consideration for the integration of asset scan data was two-fold. First, our objective was to prove the ability to automate the process of integrating the raw scan data, by asset type, identified vulnerability, and recommended remediation plan. The remediation plan was also linked (by type / class) to the policy set for instantaneous access by the asset owner. The second objective was to demonstrate the ability to integrate this information into the workflow by assigning the vulnerability to a specific asset owner along with a scheduled completion date and the ability for the task to be tracked by not only the asset owner but also the supervisor and any other designated observers / interested parties. This is all being done in an environment that captures timestamp and associated documentation for complete auditability.

Our next steps with this merchant are to collect the specifications for integration of this data into their now-current network asset compliance system to augment internal tracking, improve workflow, increase visibility into IT risk management posture – all in an effort to reduce their costs of compliance in the long-run.


Gary B. Blume
Senior Vice President - Corporate and Business Development

Lightwave Security, Inc.
Atlanta, GA

Office: 404.939.8875
Mobile: 404.276.6192
Fax: 404.751.2830
E-mail: gblume@lightwavesecurity.com
Linkedin: http://www.linkedin.com/in/garyblume

How to implement ISO 27001 - Free Webinar!

Hello,

I wanted to let you know that we are organizing a free webinar called "How to implement ISO 27001?".

This free one-hour training is designed for organizations that plan to implement ISO 27001, and have no previous experience in such projects. This session will explain all the steps in ISO 27001 implementation, and provide tips on how to proceed with this complex task.


This webinar is in English, and covers the following topics:

• Plan - Do - Check - Act cycle
• ISMS scope
• ISMS policy
• Risk assessment and treatment
• Risk assessment report
• Statement of Applicability
• Risk treatment plan
• Annex A - overview of controls
• Four mandatory procedures
• Document management
• Records management
• Internal audit
• Management review
• Corrective and preventive actions
  

The webinar is delivered by Dejan Kosutic, the author at Information Security & Business Continuity Academy.

To register for this webinar, please visit: https://www3.gotomeeting.com/register/794135934
About the organizer: Information Security & Business Continuity Academy is the leading online resource for ISO 27001 and BS 25999-2 implementation. Visit http://www.iso27001standard.com/.


Best regards,

Dejan Kosutic

HIPAA Violations Not Always Due to Data Breaches

Contributed By:
Jack Anderson

On an early album George Carlin (RIP) talked about being raised Irish Catholic. Remarking on mortal sins he observed that if you woke up in the morning and decided to go across town and commit a mortal sin, you could save your bus fare because you already committed a mortal sin just by thinking about committing a mortal sin.

Similarly you don't have to have a patient data breach to be in violation of HIPAA rules and regulations. By doing nothing, not even thinking, you probably have already committed a violation.

For example, if you have a business associate (BA) agreement in place you are required to be compliant with the terms of that agreement, now . If you don't have a breach notification program in place you are in violation, now.

If you don't have a privacy program in place you are in violation, now.

But, you say, I am a small company and how would they know? Let me count the ways:

1.Your covered entity detects a pattern of non-compliance, like you sending unsecured PHI and is required to either help you fix the problem, or sever your contract, and report you to HHS.
2.A whistleblower, (employee, ex-employee, patient, ex-patient, wife, ex-wife, etc) reports you in hopes of collecting the reward offered by HHS.
3.An unannounced audit by OCR, the enforcement arm of HHS. They are required by Congress to audit and have hired an outside firm to begin auditing in Q4 2010.
4.A state attorney general files suite in federal court as allowed by The HITECH Act.
5.A patient data breach which must be reported.

The good news is that just starting on a compliance program earns you a lot of points. Also new cloud computing solutions are cost effective and efficient for even the smallest companies. A small company can get started for only $125 and can stay compliant and prove it for only $35 per month. This is less than your latte budget.

ISO 27001 vs. ISO 27002

Contributed By:
Dejan Kosutic


If you came across both the ISO 27001 and the ISO 27002, you probably noticed that ISO 27002 is much more detailed, much more precise - so, what's the purpose of ISO 27001 then?

First of all, you cannot get certified against ISO 27002 because it is not a management standard. What does a management standard mean? It means that such a standard defines how to run a system, and in case of ISO 27001, it defines the information security management system (ISMS) - therefore, certification against ISO 27001 is possible.

This management system means that information security must be planned, implemented, monitored, reviewed, and improved. It means that management has its distinct responsibilities, that objectives must be set, measured and reviewed, that internal audits must be carried out and so on.

All those elements are defined in ISO 27001, but not in ISO 27002.

The controls in ISO 27002 are named the same as in Annex A of ISO 27001 - for instance, in ISO 27002 control 6.1.6 is named Contact with authorities, while in ISO 27001 it is A.6.1.6 Contact with authorities. But, the difference is in the level of detail - on average, ISO 27002 explains one control on one whole page, while ISO 27001 dedicates only one sentence to each control.

Finally, the difference is that ISO 27002 does not make a distinction between controls applicable to a particular organization, and those which are not. On the other hand, ISO 27001 prescribes a risk assessment to be performed in order to identify for each control whether it is required to decrease the risks, and if it is, to which extent it should be applied.

The question is: why is it that those two standards exist separately, why haven't they been merged, bringing together the positive sides of both standards? The answer is usability - if it was a single standard, it would be too complex and too large for practical use.

Every standard from the ISO 27000 series is designed with a certain focus - if you want to build the foundations of information security in your organization, and devise its framework, you should use ISO 27001; if you want to implement controls, you should use ISO 27002, if you want to carry out risk assessment and risk treatment, you should use ISO 27005 etc.

To conclude, one could say that without the details provided in ISO 27002, controls defined in Annex A of ISO 27001 could not be implemented; however, without the management framework from ISO 27001, ISO 27002 would remain just an isolated effort of a few information security enthusiasts, with no acceptance from the top management and therefore with no real impact on the organization.

Can A Business Continuity Strategy Save You Money?

Contributed By:Dejan Kosutic



You are thinking about implementing the business continuity management/BS 25999-2 standard? But then you hear it will cost you a lot? It probably will cost you, but not necessarily as much as you thought - this you can solve with good business continuity strategy.
Business continuity strategy, as defined in BS 25999-2 standard, is an "approach by an organization that will ensure its recovery and continuity in the face of a disaster or other major incident or business disruption".

Therefore, the point is to prepare yourself in the best possible manner to counteract a disaster if such would occur. This preparation can include organizational measures (drawing up plans, making contracts with suppliers/partners, exercising, reviewing, awareness raising, etc.), and measures including investment in equipment, infrastructure etc.

Time is a very important factor in recovery - if you do not recover your business in time, you will probably lose your customers and consequently lose your business as well. So the business continuity strategy must set the recovery time objective (RTO) for each of your critical activities, whereas RTO can be different for each of those.

One important consideration: the shorter the RTO, the bigger the investment you will need - for instance, if you want to recover your data centre in less than one hour, you will have to invest in an alternative location almost the same equipment as in the primary location; on the other hand, if you want to recover your data centre in two weeks, the investment will be much lower because it would be enough to store the backup tapes at the alternative location, allowing you two weeks to obtain the necessary equipment. All this means that your RTO must not be too long, but not too short either.

Once the RTO is set, you will still need to make some investment; however, with a good business continuity strategy you will be able to decrease that investment, while still being able to recover your critical activities within the recovery time objective. Here are some examples:

■you might not need your own data centre at an alternative location - in most countries you can rent such a location from a specialized company, which means you don't need to invest in infrastructure, maybe not even in equipment or software,
■you might not need offices at an alternative location - employees who do not have to meet customers face-to-face can work from their homes,
■you might not need an alternative location at all if you have other business units at different locations which could take over the critical activities affected by the disaster,
■you might not need to purchase equipment in advance if you can find the supplier that could guarantee the delivery of equipment within your RTO
In all these examples you will need to increase your organizational capabilities, but if you want to save some money, it sure is something worth thinking about.


Cross posted from ISO 27001 & BS 25999 blog - http://blog.iso27001standard.com

Advice for Merchants on PCI DSS

Contributed By:
PCI Guru

Barring the card brands developing a truly secure card processing process, the PCI DSS and related standards are likely to be with us for quite a while. That said, what is the future of complying with the PCI DSS?

For merchants, if you are not seeking out point-of-sale (POS) solutions that do not store cardholder information, you should be as soon as you possibly can. That includes finding card processors that do not require you to store cardholder information and can provide you access to cardholder information when you need it for resolving disputes and chargebacks.

According to Robert McMullen, CEO of TrustWave, the majority of breaches TrustWave investigated occurred with POS systems. So the rational approach to resolving this problem is to get rid of the cardholder data stored on these systems.

The problem with this is that most merchants, large or small, think that they need to store this information for some reason. If you are a merchant in the United Kingdom, France, Italy and other select European countries, then you do need to have the PAN unencrypted, however it only is required on an original printed receipt, it is not required to be stored anywhere else.

So, all merchants need to put POS solutions in place that do not store cardholder data. You do not need it and it puts you at risk if you do store it.

The next thing merchants need to do is to find a card processor that does not require the merchant to store cardholder data. This can be a processor that uses tokenization or whatever, but the bottom line is that the processor does not return cardholder data to the merchant’s systems.

These processors typically provide secure Web-based systems that allow the merchant to view all of their transactions processed and, if necessary, provide a method to decrypt the PAN for dispute research and chargebacks.

Merchants need to restrict access to the processor’s applications to only those people that absolutely need access to perform their job. These people should be reviewed at least quarterly to ensure that they continue to require access.

For those of you that just cannot get rid of cardholder data, there is the option of hashing. Hashing allows applications such as fraud discovery, member tracking, rewards programs and similar functions to continue, they just do not have access to the actual PAN.

A hashed PAN results in the same hashed value, so research and analysis of PANs can still occur. It is just that if you need to see the real PAN, you will have to go to the processor’s system to obtain the real PAN.

The travel industry, in particular hoteliers, are really behind the eight ball on PCI because of their need to keep the PAN for sometimes years because of the way reservations work. However, this is where tokenization can earn its keep.

If a hotel takes a reservation and gets back a token when the credit card is authenticated, then the hotel can use the token however many times in the future for check in and check out. Again, there is no reason for the hotel to need to retain the actual PAN.

The bottom line to all of this is that there are ways to minimize your organization’s PCI compliance efforts just by getting rid of the data in the first place. So, stop putting forth efforts to comply and get with the movement to get rid of the cardholder data in the first place.

I have had a few clients go down this road and PCI compliance is now a piece of cake. Their networks are still in scope for transmission, their applications in some cases do process cardholder data, but there is not storage which makes them much, much less of a target.

Communicating with Busy Business People

contributed by: Jeff Snyder - SecurityRecruiter.com

Communication Overload

Our world has been overrun with automated phone calls, emails, facebook alerts, invitations to connect, text messages, tweets, newsletters, webinar invitations and the list goes on and on.


Though it is likely hard to believe, this security recruiter receives in excess of 500 emails per day. Add to that additional messages on various social networks like facebook and LinkedIn and pretty soon, the amount of data I review over the course of a day is overwhelming.


I’m not by any means alone in this world of data overload. Think for a moment about a busy human resource professional’s potential to be overloaded and quite frankly overwhelmed with data. I’ve been told by hiring authorities that they’ve been the recipient of 300-500 resumes when they post a job to a major job board.


Too Many Emails

If they experience what I’ve recently experienced, these hiring authorities are likely overwhelmed as well. Consider this recent example and then multiply it many times over. A security job seeker sent a resume to my office at 3 PM on a Friday afternoon. By that time in the day on a Friday, the rest of the day is booked and I’m trying to get out of the office by 6 PM to spend time with my family.


This resume that arrived at 3 PM was not reviewed on Friday afternoon. Having not received an instant response, the security job seeker sent another resume at 8 AM on Monday morning. Add this email to the Friday email and there is a small pile building. Monday mornings in the office of a security recruiter, a human resources representative or a hiring decision maker are very busy.


On Monday afternoon, the security job seeker who sent an email on Friday afternoon and then again on Monday morning sent another email asking about the status of his resume that had yet to be reviewed. Add these emails to the hundreds of other messages that accumulated in our office between Friday and Monday and anyone can soon see how data overwhelmed we can become.


A Different Approach


On a practical level, may I suggest that a resume sent to anyone anywhere late on a Friday afternoon will likely not be reviewed until Monday. Sending another resume on Monday morning before the recipient has a chance to clean up a weekend’s worth of junk mail to get their Inbox down to relevant business communication is probably not a good idea.


Consider instead waiting until later in the day on Monday and leaving a carefully thought out voice mail. The right voice mail left at the right time for the right person just might cause that person to go into their overflowing Inbox where they just might look for the Friday email mentioned politely in the carefully thought out voice mail.


Consider This Approach


Here is another idea. I recently followed up on a security job opening at the “C” level. The position has been open since January so while I didn’t know what was wrong, I knew that something was wrong with this company’s search process. Rather than sending email, I placed a strategically timed call with the company’s global CSO. Even thought I caught the CSO in a meeting, we were on the phone long enough for me to get the CSO’s permission to send an email. He even stopped long enough to give me his email address.


I followed with a well-written email that briefly introduced my company. Remember, the CSO was now expecting my email even though he didn’t know me prior to the moment when I made his phone ring.


A couple of days went by without any communication from this prospective new client. I had a suspicion that the CSO was traveling and I was correct. After several days, I sent another email to the CSO. This email was different from the first email and it quickly caught the CSO’s attention. While sitting in another country, the CSO communicated with an HR Director in the US and asked her to schedule a call with me.


Setting a business appointment happens this way all the time, but a carefully planned communication approach with thoughtfully spaced-out communication attempts will be appreciated by busy business executives more often than not.


Connecting With Busy Business People


The next time you’re trying to reach a busy recruiter or a busy human resources representative or a busy hiring manager, stop and think about the data overload the person you’re reaching out to might be experiencing. As silly as it might sound, try calling the person you’re trying to reach and asking for permission to use their Inbox. Since this type of call rarely comes in to my office, I guarantee you that you’ll be setting yourself apart in a good way by asking permission before adding another email to a busy person’s Inbox.