Isaca csx2018-continuous assurance

Fouad Khalil, Vice President Compliance, SecurityScorecard
Continuous Assurance Using
Data Threat Modeling

Copyright © 2018 Information Systems Audit and Control Association, Inc. All rights reserved.
• What’s new?
• All about the Data
• Background
• Current state
• Regulatory perspective
• Threat Modeling Case Study
• Continuous Assurance
• Putting all this into practice
• Q & A
Agenda

• Facebook prime example of privacy scandals (dating
back to 2005) most recent potential $1.6B fine – Ireland
Data Regulator
• British Airways (September 2018) PCI compliant but
breached…
• Bupa fined for malicious insider privacy breach
(£175,000 by UK regulators for “systematic data
protection failures”)
• Google exposed private data of 1000s of Google+ users.
Still under investigation.
Latest Headlines

• Connected clouds (private, public, hybrid)
• Blockchain finally understood but a mess
• Data analytics à Machine Learning à AI
• GDPR Global trend – companies measured by
compliance
• Economy boom into 2019 but 2020 is a bit
questionable
A Quick Look Ahead

• 45% of IoT buyers concerned about security (Bain & Co)
• 90% say IoT devices pose moderate to significant risk (Bain &
Co)
• IoT market size expected to reach $457B by 2020
(Growthenabler)
• SaaS application security architectures are broken
• New Compliance requirements and penalties drive pain level
higher
• So many open or misconfigured servers in the cloud (Tesla,
Walmart)
Are We Exposed?

Best example of protected data?
GDPR of course!!

Big Data
Mobile Subscriptions
Social Media Users
Enterprise Using Cloud
Internet Users
IoT Connected Devices
Tablets
Smartphones
1.5 Exabyte/yr
740M
0
0
400M
200M
0
0
1 Exabyte/day
5B
1B
15%
2B
1B
18M
300M
3 Exabytes/day
7.5B
3B
70%
4B
10B
1.3B
2.5B
Dot Com 2010 Today

• Enterprise competitiveness, regulatory considerations,
process maturity
• Data key consideration to manage and monitor risk
• Manage changes to minimize risk
• Applying application threat modeling principles to data
• Methodically analyze applications to identify and map
threats in post-prod – Take an attacker’s viewpoint.
Background – All About the Data

All About the Data
Competition Regulations
Customer
Engagements
Pursuit of
new Markets
Maturity &
Resiliency
Factor in
everything of
significance
The DATA!!

• Continuous changes impact level of risk to data
• Changes in context, environmental factors and threat
landscape
• What data changes to monitor (listing a few)
– How the data is used
– How data is protected (new, changed or removed controls)
– Threats of which data is likely to be exposed
– New or modified business activities change impact if a compromise
may now occur
What Data changes to monitor

• Fairly easy to understand why
• Enterprises want to know how to realize the hacker’s vision
• Attacker sees data as a target accessible through a number of
pathways
• Data is profit for hackers and breach potential for us
• Threat modeling exercise can help systematically evaluate an
application
• Application threat modeling discipline has developed as an
application security strategy
Adopt a Hacker’s view

• Assists in developing applications that are robust, resilient and
hardened
• Maps the threats applications might encounter in production
• Enables addressing threats and monitoring conditions
impacting data over time
• Enable better tracking of changes in data that impact risk
• Provides better visibility into data that intersects with the supply
chain
• Enterprises use this model to understand state of data (stored,
transmitted or processed).
How Does Application Threat Modeling help?

• Best to understand exiting conditions that pertain to data
• Two parallel transformations that make a thorny problem
• Practical challenges in data management as data proliferates
• Legal, regulatory and other mandatory requirements that govern how data is (or
can be) used
• Practical challenges – how data is stored, processed an transmitted is changing:
• Data consolidation: Denser data due to new data processing methods and
increased analytical capabilities.
• Data ubiquity: Data becoming more pervasive - spreads throughout the
enterprise
• Data expansion: Data becoming more plentiful.
• Processing parallelization: Data increasingly being processed in parallel
The Current State

• Organizations are witnessing transformations depending on
business activities, industry and regulatory constraints.
• Organizations with even an accurate and solid inventory of
assets, may have less clear idea of data processing.
• Poor data inventory leads to challenges ranging from resources
and time and the problem data tends to compound over time.
• Enterprises become more externalized (supply chain)
challenges may compound as new players come into play
Beyond the current state

• Several regulations and standards impact data in difficult ways
• GDPR pertains to data that intersects with operations
performed in EU
• CA first state to enact GDPR like Privacy law
• Breach disclosure requirements specify the what, how and
when to notify of a breach
• Industry specific standards add to the challenge such as PCI
DSS, HIPAA, HITECH.
Regulatory requirements add to challenges

Objectives:
1. Case Study Example based on by Antonio Fontes (Threat
Modeling, Detecting Web Application Threats Before Coding)
2. Understand the concept of Threat Modeling
3. Build an actionable Threat Model
4. Know when to build a threat model and how to document it
Threat Modeling Case Study

Newspaper that uses standard news distribution channel
• They host a website on which articles are posted all day by the
online editor
• They Distribute a printed journal every day of the week.
• Content on the website is free
• The printed version is sold
Threat Model Case Study

• The company has decided to also sell an electronic edition of
the newspaper
• Access to the content must be restricted to authorized
customers
• The team is designing a feature to enable users to authenticate
to access their account for payment.
• The board is worried about the threats associated with this
decision.
Threat Model Case Study - Continued

• Understand the application
– Review Business Requirements
– Comprehend application configuration (technologies, architecture,
functionalities components)
– Role of application in the organization
– Be Clear on the objective/drivers
» Stay compliant
» Protect against hackers
» Never want system to be compromised
» Protect user privacy
» Avoid system downtime
Threat Modeling Steps

• Understand the application…
» What are the use cases (how is the application used)?
» How are users authenticated?
» Understand the data classification
» Understand the data flow…especially financial flow

• Identify Potential Threat Sources
– Based on what we know who might be interested in
compromising the system
– Perform research to identify other sources (media, business
owners, users)
– List all potential Threats
– Hackers
– Untrained employees
– Disgruntled employees
– Government
– And so on...

• Identify Major Threat Sources
– Identify Threat Triggers
– Understand complete scenario
– Understand the likelihood
– Understand the impact
– Finalize major threat model
– Threat, Source, Description of attack

• Identify Controls
– Document Threat with identified sources and attack description
– Develop controls to mitigation the likelihood and impact of the threat
– Ensure controls are designed effectively
– Make recommendation on controls and prioritization
– Based on asset criticality and threat likelihood and impact

Threat Model - Sample
Threat Source Description Likelihood Control
Denial of Service
Attack
Hacker perpetrator seeks
to make a system
unavailable by
disrupting
services of a host
connected to the
Internet
Stealing
Intellectual
Property
Disgruntled
Employee
Copying data due
to authorized
access
Stealing Customer
Data
Competitor Social
Engineering
attack

• Case study shows how data can be used to analyze threats
• We need to move to continuous assurance understanding of
the threats
• Point-in-time view compared to continuous auditing (ongoing
validation)
• Continuous monitoring provides near real-time status of
security controls
• Continuous assurance notifies of changes that impact threats
to data
Continuous Assurance

• We need something to measure
• Perform that measurement in an ongoing way
• A retailer has different risks to measure than a bank
• First step is to determine what to measure
• Map out the threats of greatest risk
• Set up and monitor the security controls to mitigate these risks
• Automation is key – such as data shared with supply chain
Continuous view (KRIs)

• What KRI to use to measure control efficiencies?
• How will enterprises know about changes impacting threats to
data?
• How to evaluate control performance at 3rd, Nth parties?
• How to stay informed of changes at the supply chain?
• Who owns and maintains the continuous view?
• Amount of effort enterprises are prepared to invest in this?
Putting all this into practice

• Continuous assurance makes risk decisions easier
• Start small with narrow scope and build from there
• Determine approach that is best for you
• Enterprises struggling with data protection greatly benefit from
threat modeling
• No hidden problems go unexamined
• Near real-time view of what hackers see
• Flexible approach that works for every environment
In Conclusion

Thank You
Fouad Khalil
VP Compliance
585 472 2356
fkhalil@securityscorecard.com
214 West 29th St, 5th Floor
New York, NY 10001

Isaca csx2018-continuous assurance

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Isaca csx2018-continuous assurance

Similar to Isaca csx2018-continuous assurance (20)

Recently uploaded

Recently uploaded (20)

Isaca csx2018-continuous assurance