The Compliance and Security Connection

Leveraging ISO 27001 for Improving the Security, Compliance and Performance of Information Systems

Steve Wright, Senior Manager for Risk & Advisory Services at PriceWaterhouseCoopers LLP, has worked with many international organizations to complete ISO27001 Certification projects over the past eight years and has worked with many of these same corporations to establish information security management systems (ISMS) compliant with Corporate Governance requirements such as - Combined Code, HIPAA, SOX, CobiT, ITIL, PCI DSS, ISO9001 and CMMI.

Recently, Steve joined me to share his conclusions on best practices for "future-proofing" ISO27001 implementations and maximizing ROI. Steve demonstrated how leading organizations are embracing the best practices to achieve regulatory compliance and create a Management System for Internal Control. Steve also covered how to leverage an ISMS for security, risk, compliance and operational benefit.

Joining Steve was Michael Godin, Senior Systems Engineer with Ecora Software. Michael shared how Ecora's Auditor Professional 4.5 can help to establish a comprehensive understanding of your infrastructure's configuration, how to create policies and rules based on ISO27001 to determine the gaps in your present configuration, and how to effectively identify and remediate gaps that may develop to ensure compliance with your standards is sustained.

I'm pleased to let you know that a Flash recording of this presentation is available now. By simply registering here, you will be able to download the recording of Steve and Michael's presentation and be able to download a PDF of the Powerpoint slides they used. 

What you'll learn by downloading and watching this Webinar:

• How ISO 27001 ISMS is being used today
• What some of the challenges of implementing an ISMS are and how are they overcome
• How to make an ISMS the platform for the future and maximize your ROI
• Identifying cases outside of traditional security and how to choose a platform that will support them
• How an automated configuration audit and analytics solution can make ISO 27001 more successful

Contributed by Mark Tordoff

ITIL version 3: One Year Later

It's been a little over a year since the introduction of version 3 of the IT Infrastructure Library (ITIL). Gary Anthes did a great job documenting "How to Get More Out of ITIL with Version 3" in the July 21st edition of Computerworld. In today's post, I'd like to share some of the points Gary made that stood out to me.

Before we do that, let's touch on the basic difference between version 2 and 3. Megan Pendlebury, the Service Management Executive with itSMF UK, does a good job of sharing her impressions of what's different.

"V2 took a very process driven view and led to people working within their own silo rather than seeing the entire picture of what was being done within IT and the business they were underpinning. V3 in contrast takes a 'lifecycle' approach to managing services. It's closer aligned to how businesses are actually run, allowing IT to integrate more closely."

According to Pendlebury, the most common comment she is hearing is "we are still working on V2 and will not be looking at V3 for a while." Pendlebury responds to this by saying, "the truth of the matter is that if you are implementing V2 you are already implementing V3." This is reinforced by comments made in Anthes' story by Phyllis Drucker, director of consolidated services at AutoNation Inc. She said, "We'll lay v3 over our processes and see if there are any gaps", as opposed to scrapping their work on implementing V2.

Besides not abandoning V2 efforts, Anthes offers 4 other keys to gaining value from ITIL v. 3.

1. Do get started on V3. It's worth it.
2. Look at the tools.
3. Prepare for culture shock.
4. Don't expect to find everything in v3 - or like everything you find.

Anthes' article is full of valuable input from a number of IT professionals regarding their impression of V.3. Here are some to consider:

"What's so nice about v3 is that it really takes you back to the basics of business, and then you design your service to meet those."  Alan Claypool, manager of business applications, city of Tampa, FL

"We got into ITIL, and by our third year, we realized that our tools were not allowing us to do some of the things we wanted to do. In hindsight, we could have made much faster progress has we had better tools." Sheri Cassidy, manager of process engineering services, Progress Energy Inc.

"We've all talked about the loss of service in the U.S.. I think this [ITIL v3] is a way to structurally put it back in place." Dale Ott, director of service management, Sarasota County Government and Schools, Sarasota, FL

If you are looking for more information on ITIL v3, contact the U.K. Office of Government Commerce, organizations like Pink Elephant or user groups like IT Service Management Forum International.

If you are looking for a tool to help you with infrastructure configuration and change management, consider requesting a demonstration of Ecora Auditor Pro. It will help you lay a solid foundation for adopting ITIL v3 in your organization's IT infrastructure.

Contributed by Mark Tordoff

Basics on the Federal Desktop Core Configuration standards

It was the end of March that all federal agencies were supposed to meet the Federal Desktop Core Configuration (FDCC) policy for all Microsoft Windows XP and Vista systems by using the Security Content Automation Protocol, otherwise known as SCAP (pronounced S-cap).

Each agency is required to submit their FDCC reports to the National Institute of Standards and Technology (NIST). The FDCC policy came about using an interesting collaboration of numerous agencies working with Microsoft, including NIST, the Department of Homeland Security, the Defense Information Systems Agency, the National Security Agency, and the US Air Force.

While the title of the policy would lead you to believe it is primarily focused on the respective Microsoft operating systems, the policy actually extends to cover assorted components such as firewalls, antivirus, web browsers, and more.  In an article appearing in the May 23rd issue of Processor, Ron Gula, chief executive officer and chief technical officer for Tenable Security speaks well of SCAP in comparison to the Payment Card Industry Data Security Standard (PCI-DSS) when he says, "SCAP has very specific settings that are applied to specific operating systems. It's taking the ambiguity out of system configurations."

According to the article, written by Sandra Kay Miller, here are some specifics on SCAP:

"SCAP is a suite of open standards that function together to deliver automated vulnerability management, measurement, and policy compliance evaluation. The XCCDF (eXtensible Configuration Checklist Description Format) and OVAL (Open Vulnerability Assessment Language) are assessment protocols. The reference protocols include the CCE (Common Configuration Enumeration), CPE (Common Platform Enumeration), CVSS (Common Vulnerability Scoring System), and CVE (Common Vulnerabilities and Exposures).

SCAP will allow security technologies to exchange systems and vulnerability information through a common format, thus allowing individual agencies the flexibility to use configuration management and security solutions that best meet their needs and budgets."

While the FDCC was established for government agencies to establish desktop configuration standards, the SCAP standards offer a lot of value to nongovernment organizations too. According to Gula,“You’ll see organizations like credit unions and healthcare agencies—those who work with the government—implementing FDCC." It is likely that many government organizations will make this a prerequisite for doing future business with their agency, especially if any electronic data is required to be shared between the two parties as part of doing business.

The configuration audit and compliance reporting capabilities of Ecora Auditor Pro can aid both government agencies and non-government organizations in assessing current desktop configurations and identify variances from the SCAP standards. To learn more about the Federal Desktop Core Configuration policy and how to audit your desktop configurations against SCAP standards, you can view this web recording on Standardizing Windows Desktop Configurations.

Contributed by Mark Tordoff

As Data Breaches Continue to Mount, Are Regulations To Blame?

Could it be that the same oversight protections that were put in place to ensure consumer and shareholder protection are actually creating a higher degree of security risk?  A closer examination of the issue may lead you to believe that this concept isn’t as far fetched as it may seem upon first glance.

The idea behind the creation of Sarbanes-Oxley and all subsequent regulations concerning everything from financial reporting to e-discovery was so that a record would be kept of all critical information that could later be reviewed should any hint of impropriety arise.  Compliance was out to put an end to the days of companies purging critical data that could provide evidence of any corporate wrong doing.

While that is all well and good, another thing happened along the way.  By forcing corporations and other organizations to maintain large amounts of data for longer periods of time, coupled with the onslaught of data that is being created in the new digital world we live in, has created a high risk environment. 

In the past, companies would simply purge their systems of data that presented security risks for the company rather than keeping it stored in files that could ultimately be lost through either malicious or accidental occurrences.  Data leakage is currently one of the most pressing issues CIOs face and a major reason for this is the sheer volume of confidential information (data) they are forced to contend with in order to ensure compliance with the multiple regulations and other mandates they are subject to.

While I am certainly not advocating the abolishment of compliance, for it has served its purpose in restoring investor confidence in the market and along the way forced companies to clean up questionable business practices.  However, this could be a case where a review may be in order to ensure that the system created to help keep consumers safe is ultimately doing more harm than good by keeping their critical data around longer and where they may become the victim of malicious behavior.

I would suggest that along with installing the tools to meet compliance that companies also give equal time to ensuring that their environment is able to sustain the level of data required safely and securely.  One of the biggest issues I hear from CIO’s I talk to in the field is that the points of vulnerability seem to shift with every change to the company’s IT infrastructure and that trying to close the door on all areas of threat has become extremely complicated.  Getting a handle on your own environment is the first step in managing IT security in a compliance world.

Submitted by Bryan Cote

Webinar on Improving IT GRC with Forrester's Marc Othersen

Improving Enterprise Governance, Risk and Compliance Initiatives

Technology plays a vital role in governance, risk, and compliance (GRC) initiatives. An effective enterprise GRC strategy will employ technology to drive sustainability, consistency, efficiency, and transparency into GRC oversight. The practice of GRC has evolved from siloed applications, documents, and spreadsheets to more of an enterprise content management approach. Consequently, strong workflow, communication, and analysis capabilities have become essential components of the enterprise program.

In this webinar, Marc Othersen, Senior Analyst of Security & Risk Management for Forrester Research, will discuss IT's traditional role in providing the technology capabilities to the business for enterprise GRC activities and also its obligation to manage its own GRC activities and initiatives by developing processes and establishes governance structures of its own.

Event Details:
Topic: Improving Enterprise Governance, Risk and Compliance Initiatives
Date: Wednesday, May 21^st   10:00AM EDT
Duration: 60 minutes
Speakers: Marc Othersen, Senior Analyst of Security & Risk Management for Forrester Research, Mike Godin, Ecora Senior System Engineer
Register: http://www.ecora.com/ecora/webinars/webinar.asp/2008-05-21/

In this webinar, you'll learn:

• What is IT-GRC and how does it differ from Enterprise GRC?
• Why is Compliance the Basis for IT-GRC initiatives?
• What are some common issues with current compliance programs?
• Why is automation critical to the success of IT-GRC efforts?
• What are the technologies that will bring the greatest value to IT-GRC or Enterprise GRC adoption?

Register Now
http://www.ecora.com/ecora/webinars/webinar.asp/2008-05-21/

Applying Security Standards Like ISO 27002 to Compliance Requirements

One of the great challenges facing IT professionals is how to navigate through the sea of regulatory compliances, industry standards, and numerous security and IT operational best practice standards and frameworks.

A recent post on SearchSecurity.com by Richard Mackey did a great job of comparing the value of ISO 27002 to PCI DSS compliance specifically.

As you likely know, the PCI Data Security Standard is a set of 12 requirements, broken into several hundred sub-requirements, that were written by the PCI Security Standards Council on behalf of all of the major credit card companies. All organizations that store, transmit, or process payment cards are required to provide varied levels of proof of their compliance with the Standard.

ISO 27002, also referred to as ISO 17799, is a security standard of practice. As Mackey states, "it is a comprehensive list of security practices that can be applied -- in varying degrees -- to all organizations."

Mackey shares two specific benefits of applying a standard like ISO 27002 to a regulation like PCI-DSS. "First, it provides a framework that allows organizations to achieve their PCI security goals along with those from other sources, like industry or governmental regulations. Second, it provides guidance on how to fit some of PCI's governance and policy requirements into an organization's compliance program."

Conversely, Mackey states that one of the advantages a requirement like PCI DSS adds to the ISO framework is it helps organizations "define three of the most challenging aspects of ISO compliance: scope of compliance, data classification and data handling."

Mackey concludes by saying, "The beauty of using the ISO standard with specific regulations is that the regulations fill in the necessary details that the framework lacks while the framework provides structure to address multiple sets of requirements consistently. The two concepts work hand in hand and provide effectiveness, efficiency and auditability."

Where most organizations have multiple regulations to comply with and other internal pressures to adopt either ISO or ITIL-based frameworks, it makes sense for IT departments to adapt the strengths of each into cohesive, actionable plan that can be measured, not only for compliance, but the overall improvement in infrastructure performance, security and reliability it provides.

Contributed by Mark Tordoff

Do too many controls lead to breaches and compliance deficiencies? An IT Policy Compliance Group survey seems to say so.

Baseline recently ran an interesting story based on IT Policy Compliance Group research connecting data loss to the success or failure of compliance efforts.

The summation of the research was that "companies that perform well in compliance audits also excel at protecting their data." The survey was based on data collected from 2,000 companies of varying revenue sizes, and on publicly reported data losses and thefts.

The survey found that "companies with two or fewer compliance deficiencies annually are likely to have two or fewer data losses or thefts in the same time period. Conversely, organizations that lag when it comes to compliance (10 or more deficiencies in a year) are likely to experience data loss more than a dozen times annually."

However, perhaps the most interesting conclusion drawn from the research surrounds the number of control objectives a company is attempting to audit and report against. According to Jim Hurley, managing editor of IT Policy Compliance Group and leading contributor to the research firm's The ITPCG Blog, companies with fewer control objectives, usually safeguards meant to support security and other policies, actually performed better on compliance audits and had fewer data breaches.

The example given in the article should that businesses with an average of 82 control objectives had 22 or more compliance deficiencies annually and 13 or more data losses and thefts in the same year. Companies with an average of roughly 32 control objectives had two or fewer audit deficiencies and two or fewer data losses each year.

Hurley's conclusion was"businesses with fewer controls are focusing on managing exceptions rather than spending time and labor trying to manage everything."

I certainly agree that there is probably some merit to Hurley's conclusion, but there are some unanswered questions that might have made the research more compelling.

1. How many of the control objectives in either case were internal standards vs. auditor-imposed?
2. Was the number of control objectives related to past audit deficiencies vs. a history of consistent ability to validate adequate controls were in place?
3. How did the 82 control objectives compare to the 32? Were the 32 better defined to meet areas of greatest risk?

I think the PCAOB in releasing Audit Standard No. 5 also recognized that too many standards are actually a deterrent to meeting compliance objectives and providing meaningful infrastructure security by incorporating a more risk-based approach to Sarbanes-Oxley compliance.

It would just be interesting to get a little deeper into these findings to see whether well-placed controls, regardless of the number, is at the core of the reduction in data loss and reduced audit deficiencies.

Contributed by Mark Tordoff

Sometimes the Government Just Makes You Go, Huh??

I know many people who work for the government, including family members. They are hard workers who are dedicated to their jobs. So, it must be just having so many people involved in something that makes the government as a whole come out with announcements, reports, and laws that make you just go, huh? Did they REALLY say that?

Case in point, Matthew Weigelt had a story on FCW.com yesterday on the E-Government Re-Authorization Act. In his story, Weigelt reports that The Congressional Budget Office estimates that the E-Government Reauthorization Act could cost the government about $29 billion over a four-year period.

However, if you read a little further, the CBO estimates "FISMA requirements would consume $27.9 billion of the $29 billion that the legislation would cost the government between 2008 and 2012."

Ok, let's step back for a minute. The E-Government Re-Authorization Act is legislation to "authorize money for programs that improve how the government deploys services and accesses information. It also would centralize many agencies’ Internet-related activities."

ISSUE NUMBER 1: This is a bill to re-authorize additional funds because the funding and time limit for the additional bill expired this year. In other words, the job wasn't completed on time or within budget the first time around. Why not?

ISSUE NUMBER 2: How is this additional authorization going to actually accomplish the stated purpose when only 4% of the funds are actually going to fund e-government initiatives? A whopping 96% of the spend is actually going to help agencies close their FISMA compliance gaps!!

Ok, and if those two issues aren't enough, check this one out.

"CBO believes agencies could save administrative costs through e-government as they collect information from the public and provide government services. CBO has no way to calculate how much, though, according to the report."

ISSUE NUMBER 3: The CBO can't even prove that any of that paltry 4% will really improve the delivery of government services to the public! Have you ever had to cost justify an expense to your CFO? Have you ever been successful if you couldn't provide at least some ROI?

So far, The Senate Homeland Security and Governmental Affairs Committee has approved the reauthorization act, but there is no House companion bill. Might be a good time to contact your representative to the House and urge them to demand a bit more clarity on what will be accomplished and why they are funding FISMA in an e-Government Bill. So far, I'm not seeing the ROI from the first bill and I'm pretty skeptical about the next $29 billion.

Contributed by Mark Tordoff

Is Enterprise Risk Management too comprehensive to be effective?

I am continuing to highlight a report  Deloitte recently published on behalf of the Alliance for Enterprise Security Risk Management (AESRM), entitled The Convergence of Physical and Information Security in the Context of Enterprise Risk Management.

In the paper, ERM is touted as being a resource for providing "intelligence capabilities" addressing a myriad of dimensions of security risks, including governance, development and deployment of harmonized risk and compliance processes, risk identification, risk assessment, risk response, monitoring and escalation, control assurance and testing, risk intelligence performance and training, and sustainable and continuous process improvement."

In making the case for ERM, the paper states "organizations often try to meet external requirements without enterprise prioritization or without considering how security risks correlate with other enterprise risks and their potential impacts."

This is cited as a cause for a lot of redundant effort. "Most organizations continue to collect enterprise and security risk data many times (often from the same lines of business), assess and test many times, and transfer the results into reports to regulators and other interested parties."

It concludes this section by stating "this fragmented approach to managing governance, risk and compliance functions serves only to add to the ineffective and inefficient management of risk."

First of all, there are plenty of tools in use today that can automate the collection and reporting of key configuration settings critical to security. These tools, Ecora Auditor Professional is one example, can be scheduled to discover systems, collect the data and produce a variety of report analysis, all on a scheduled basis. While tools like this may not provide a full ERM solution, they are already deployed and available in many cases. You can leverage them for better risk intelligence now.

Why is that important?

According to same Deloitte report, only 35% of executives said they have a fully operational ERM program. While another third said they had one in development, the report states that "there was little consensus as to ...what should be included as part of an ERM program." Only 55% of the executives indicated that their organization's ERM objective was to integrate risk management-related processes and practices across all risk types. And, nearly two-thirds of the executives stated they were only focusing on four primary risk types:  operational, IT security, regulatory/compliance, and business continuity.

Given the existing resources in the marketplace and the massive undertaking ERM represents, it's hard to justify the resources necessary to fully embrace ERM. Tomorrow, we'll look at what Deloitte highlights as some of the value propositions for making the move.

Contributed by Mark Tordoff

Deloitte study cites four key risk factors behind focus on enterprise risk

I am focusing this week on a report  Deloitte published on behalf of the Alliance for Enterprise Security Risk Management (AESRM), entitled The Convergence of Physical and Information Security in the Context of Enterprise Risk Management.

In the study, Deloitte points out four key risk factors behind the current focus on enterprise risk. Today, I'd like to comment on some of the points they share on each of these factors.

1. Regulation

Calling the last decade the "era of regulation", the report, as you might expect highlights the impact of the passage of the Sarbanes-Oxley Act in the United States, calling it the single most important piece of legislation affecting corporate governance, financial disclosure and the practice of public accounting. However, that's not the only law the report references. It also makes meniton of the US Foreign Corrupt Practices Act of 1977, a far less publicized statute. While not a compliance per se, the Basel II Capital Adequacy framework is also credited with requiring banks to find new ways of capturing more information about the risks assumed in their full range of market events and in their operations.

Clearly, with more regulations being proposed with each legislative session, management and boards must gain greater understanding into their inherent risks and how to manage them.

2. Complexity

Cited as examples of complexity in a contemporary glboal organization are the following:

• Third parties
• Business partners
• Offshoring
• Outsourcing
• Global operations across multiple regions and time zones
• Regulatory requirements

Clearly, each of these areas adds a degree of risk to the organization and, when combined, make the management of that risk a critical component of a successful business model.

3. Connectedness

Because of many of the factors already listed above, business processes, risk and control must be seen as interrelated. As the paper states, "the silo approach has...[left] too many gaps and provides no credible means of understanding or being able to evaluate an organization's overall risk position."

4. Market Forces

The paper highlights two specific issues in the market place that have brought risk management into the collective consciousness of management and boards.

• The multimillion-dollar judgements in the Enron and WorldCom shareholder suits that forced board members to draw upon personal assets to settle
• The publicized accounts of the exorbitant severance packages awarded to executives despite failing to deliver increased shareholder value during their tenure

Now that we've addressed some of what is driving the push towards enterprise risk management, we'll spend the final two days this week addressing security as a part of enterprise risk management and the value proposition for organization's who adopt an ERM methodology.

Contributed by Mark Tordoff