Developing an Information Security Program
•Download as PPT, PDF•
4 likes•3,529 views
The document discusses the components and development of an effective information security program. It outlines that an information security program is needed due to factors like regulatory requirements, sophisticated attacks, and the strategic importance of security. The key components of an effective program include executive commitment, policies and procedures, monitoring processes and metrics, governance structure, and security awareness training. The document also describes standard methodologies and outlines the typical development process of plan, implement, operate and maintain, and monitor and evaluate.
Report
Share
Report
Share
![Presentation Objectives ,[object Object],[object Object],[object Object]](data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7)
Recommended
Introduction to Risk Management via the NIST Cyber Security Framework
The cyber security profession has successfully established explicit guidance for practitioners to implement effective cyber security programs via the NIST Cyber Security Framework (CSF). The CSF provides both a roadmap and a measuring stick for effective cyber security. Application of the CSF within cyber is nothing new, but the resurgence of Enterprise Security Risk Management and Security Convergence highlight opportunities for expanded application for cyber, physical, and personnel security risks. This NIST CSF can help practitioners build a cross-pollenated understanding of holistic risk.
Main points covered:
• Understand the purpose, value, and application of the NIST CSF in familiar non-technical terms.
• Understand how the Functions and Categories of the NIST CSF (the CSF “Core”) and an organization's “current” and “target” profiles are relevant and valuable in a variety of sectors and environments.
• Understand how an organization’s physical and cyber security resources and stakeholders can align with the NIST CSF as a tool to achieve holistic security risk management.
Presenters:
David Feeney, CPP, PMP has 17 years of security industry experience assisting organizations with risk management matters specific to physical, personnel, and cyber security. He has 9 years of experience with service providers and 8 years of experience within enterprise security organizations. David has worked with industry leaders in the energy, technology, healthcare, and real estate sectors. Areas of specialization include Security Operations Center design and management, Security Systems design and implementation, and Enterprise Risk Management. David holds leadership positions in ASIS International and is also a member of the InfraGard FBI program. David holds Certification Protection Professional (CPP) and Project Management Professional (PMP) certifications.
Andrea LeStarge, MS has over ten years of experience in program management, risk analysis and curriculum development. Being specialized in Homeland Security, Andrea leverages her experience in formerly managing projects to support various Federal Government entities in identifying, detecting and responding to man-made, natural and cyber incidents. She has an established track record in recognizing security gaps and corrective risk mitigation options, while effectively communicating findings to stakeholders, private sector owners and operators, and first-responder personnel within tactical, operational and strategic levels. Overall, Andrea encompasses analytical tradecraft and demonstrates consistent, repeatable and defensible methodologies pertaining to risk and the elements of threat, vulnerability and consequence.
Recorded webinar: https://youtu.be/hxpuYtMQgf0
Cybersecurity Priorities and Roadmap: Recommendations to DHS
This is a subset of the original charts, presented to DHS (November 20, 2009)
IT Security management and risk assessment
Terminology
Security Risk Assessment
Detailed Risk Analysis Process
Asset Identification / System Characterizations
Threat Identification
Vulnerability Identification
Analyze Risks / Control Analysis
Likelihood Determination
Impact analysis / Consequence determination
Risk determination
Control Recommendation & Result Documentation
Information Security Management System ISO/IEC 27001:2005
Information Security Management System - ISO/IEC 27001:2005
Introduction and Requirements
Recommended
Introduction to Risk Management via the NIST Cyber Security Framework
The cyber security profession has successfully established explicit guidance for practitioners to implement effective cyber security programs via the NIST Cyber Security Framework (CSF). The CSF provides both a roadmap and a measuring stick for effective cyber security. Application of the CSF within cyber is nothing new, but the resurgence of Enterprise Security Risk Management and Security Convergence highlight opportunities for expanded application for cyber, physical, and personnel security risks. This NIST CSF can help practitioners build a cross-pollenated understanding of holistic risk.
Main points covered:
• Understand the purpose, value, and application of the NIST CSF in familiar non-technical terms.
• Understand how the Functions and Categories of the NIST CSF (the CSF “Core”) and an organization's “current” and “target” profiles are relevant and valuable in a variety of sectors and environments.
• Understand how an organization’s physical and cyber security resources and stakeholders can align with the NIST CSF as a tool to achieve holistic security risk management.
Presenters:
David Feeney, CPP, PMP has 17 years of security industry experience assisting organizations with risk management matters specific to physical, personnel, and cyber security. He has 9 years of experience with service providers and 8 years of experience within enterprise security organizations. David has worked with industry leaders in the energy, technology, healthcare, and real estate sectors. Areas of specialization include Security Operations Center design and management, Security Systems design and implementation, and Enterprise Risk Management. David holds leadership positions in ASIS International and is also a member of the InfraGard FBI program. David holds Certification Protection Professional (CPP) and Project Management Professional (PMP) certifications.
Andrea LeStarge, MS has over ten years of experience in program management, risk analysis and curriculum development. Being specialized in Homeland Security, Andrea leverages her experience in formerly managing projects to support various Federal Government entities in identifying, detecting and responding to man-made, natural and cyber incidents. She has an established track record in recognizing security gaps and corrective risk mitigation options, while effectively communicating findings to stakeholders, private sector owners and operators, and first-responder personnel within tactical, operational and strategic levels. Overall, Andrea encompasses analytical tradecraft and demonstrates consistent, repeatable and defensible methodologies pertaining to risk and the elements of threat, vulnerability and consequence.
Recorded webinar: https://youtu.be/hxpuYtMQgf0
Cybersecurity Priorities and Roadmap: Recommendations to DHS
This is a subset of the original charts, presented to DHS (November 20, 2009)
IT Security management and risk assessment
Terminology
Security Risk Assessment
Detailed Risk Analysis Process
Asset Identification / System Characterizations
Threat Identification
Vulnerability Identification
Analyze Risks / Control Analysis
Likelihood Determination
Impact analysis / Consequence determination
Risk determination
Control Recommendation & Result Documentation
Information Security Management System ISO/IEC 27001:2005
Information Security Management System - ISO/IEC 27001:2005
Introduction and Requirements
NIST presentation on RMF 2.0 / SP 800-37 rev. 2
NIST presentation on SP 800-37 revision 2, Risk Management Framework (RMF) 2.0, as well as the upcoming SP 800-53 revision 5.
ISO 27001 Awareness/TRansition.pptx
ISO 27001:2022 Awareness Transition
What are the New Changes to ISO 27001?
SIEM : Security Information and Event Management
SIEM is a tool that collects, aggregates, normalizes the data and analyzes it according to pre-set rules and presents the data in human readable format
Cybersecurity Roadmap Development for Executives
Secrets to managing your Duty of Care in an ever- changing world.
How well do you know your risks?
Are you keeping up with your responsibilities to provide Duty of Care?
How well are you prioritising Cybersecurity initiatives?
Liability for Cybersecurity attacks sits with Executives and Board members who may not have the right level of technical security knowledge. This session will outline what practical steps executives can take to implement a Cybersecurity Roadmap that is aligned with its strategic objectives.
Led by Krist Davood, who has spent over 28 years implementing secure mission critical systems for executives. Krist is an expert in protecting the interconnectedness of technology, intellectual property and information systems, as evidenced through his roles at The Good Guys, Court Services Victoria and Schiavello.
The seminar will cover:
• Fiduciary responsibility
• How to efficiently deal with personal liability and the threat of court action
• The role of a Cybersecurity Executive Dashboard and its ability to simplify risk and amplify informed decision making
• How to identify and bridge the gap between your Cybersecurity Compliance Rating and the threat of court action
Optimizing Security Operations: 5 Keys to Success
Organizations are suffering from cyber fatigue, with too many alerts, too many technologies, and not enough people. Many security operations center (SOC) teams are underskilled and overworked, making it extremely difficult to streamline operations and decrease the time it takes to detect and remediate security incidents.
Addressing these challenges requires a shift in the tactics and strategies deployed in SOCs. But building an effective SOC is hard; many companies struggle first with implementation and then with figuring out how to take their security operations to the next level.
Read to learn:
--Advantages and disadvantages of different SOC models
--Tips for leveraging advanced analytics tools
--Best practices for incorporating automation and orchestration
--How to boost incident response capabilities, and measure your efforts
--How the NIST Cybersecurity Framework and CIS Controls can help you establish a strong foundation
Start building your roadmap to a next-generation SOC.
Introduction to NIST Cybersecurity Framework
A high-level discussion in NIST Cybersecurity Framework presented to ISC2 Quantico Chapter
A to Z of Information Security Management
The purpose of information security is to protect an organisation’s valuable assets, such as information, Intellectual property, hardware, and software.
Through the selection and application of appropriate safeguards or controls, information security helps an organisation to meet its business objectives by protecting its physical and financial resources, reputation, legal position, employees, and other tangible and intangible assets.
In this A to Z I’d like to outline some of the key focus areas for organisations wishing to pursue compliance to the ISO27001 Information Security standard.
Iso 27001 isms presentation
This cool presentation gives a brief introduction about the ISO 27001:2005
How To Present Cyber Security To Senior Management Complete Deck
This template is useful in presenting cybersecurity plan to higher authority. Cybersecurity officer will present it to top level management. It will help in determining the roles and responsibilities of senior management and executives who are responsible in handling risks. Firm will also optimize its cybersecurity risk framework. Firm will assess the current concerns that are impeding cybersecurity in terms of increase in cybercrimes, data breach and exposure and amount spent on settlements. It will also analyze firm its current cybersecurity framework. Firm will categorize various risk and will assess them on parameters such as risk likelihood and severity. The IT department will also improve their incident handling mechanism. Cybersecurity contingency plan will be initiated by firm. In this plan, firm will build an alternate site for backup maintenance. Backup site selection will be done by keeping certain parameters into consideration such as cost for implementation, duration, location, etc. The other plan essentials include business impact assessment, vital record maintenance, recovery task list maintenance, etc. The template also includes information regarding the role of personnel in terms of role and responsibilities of line managers, senior managers and executives in risk management. It also includes information related to the role of top management in ensuring effective information security governance. The information regarding the budget required for the cybersecurity plan implementation is also provided with staff training cost. https://bit.ly/3iSww5L
EDR vs SIEM - The fight is on
Many organizations and managed security providers are starting to move from SIEM, Security Information and Event Management, to EDR, Endpoint Detection and Response. The problem is this may not be the best decision for your organization. These technologies are similar but fundamentally different. This presentation also shares innovating ways to use your SIEM to catch the bad guys as well as learn some simple tricks for easing the burden of SIEM management.
Cyber Security Governance
Most organizations have good enterprise-level security policies that define their approach to maintaining, improving, and securing their information and information systems. However, once the policies are signed by senior leadership and distributed throughout the organization, significant cybersecurity governance challenges remain. In this workshop I will explain the transforming organizational security to strengthen defenses and integrate cybersecurity with the overall approach toward security governance, risk management and compliance.
NIST Cybersecurity Framework 101
Presentation for March 2017 webcast by NIST.
www.nist.gov/cyberframework
Webcast video: https://www.nist.gov/news-events/events/2017/03/cybersecurity-framework-virtual-events
This presentation introduces the audience to the Framework for Improving Critical Infrastructure Cybersecurity (“The Framework”). It provides a brief history about why and how the Framework was developed, and an understanding of each of the three primary Framework components (the Core, Implementation Tiers, and Profiles). It covers potential benefits of Framework, and how the Framework can be used. It highlights industry resources, progress in Roadmap areas, and future direction of the Framework program.
More Related Content
What's hot
NIST presentation on RMF 2.0 / SP 800-37 rev. 2
NIST presentation on SP 800-37 revision 2, Risk Management Framework (RMF) 2.0, as well as the upcoming SP 800-53 revision 5.
ISO 27001 Awareness/TRansition.pptx
ISO 27001:2022 Awareness Transition
What are the New Changes to ISO 27001?
SIEM : Security Information and Event Management
SIEM is a tool that collects, aggregates, normalizes the data and analyzes it according to pre-set rules and presents the data in human readable format
Cybersecurity Roadmap Development for Executives
Secrets to managing your Duty of Care in an ever- changing world.
How well do you know your risks?
Are you keeping up with your responsibilities to provide Duty of Care?
How well are you prioritising Cybersecurity initiatives?
Liability for Cybersecurity attacks sits with Executives and Board members who may not have the right level of technical security knowledge. This session will outline what practical steps executives can take to implement a Cybersecurity Roadmap that is aligned with its strategic objectives.
Led by Krist Davood, who has spent over 28 years implementing secure mission critical systems for executives. Krist is an expert in protecting the interconnectedness of technology, intellectual property and information systems, as evidenced through his roles at The Good Guys, Court Services Victoria and Schiavello.
The seminar will cover:
• Fiduciary responsibility
• How to efficiently deal with personal liability and the threat of court action
• The role of a Cybersecurity Executive Dashboard and its ability to simplify risk and amplify informed decision making
• How to identify and bridge the gap between your Cybersecurity Compliance Rating and the threat of court action
Optimizing Security Operations: 5 Keys to Success
Organizations are suffering from cyber fatigue, with too many alerts, too many technologies, and not enough people. Many security operations center (SOC) teams are underskilled and overworked, making it extremely difficult to streamline operations and decrease the time it takes to detect and remediate security incidents.
Addressing these challenges requires a shift in the tactics and strategies deployed in SOCs. But building an effective SOC is hard; many companies struggle first with implementation and then with figuring out how to take their security operations to the next level.
Read to learn:
--Advantages and disadvantages of different SOC models
--Tips for leveraging advanced analytics tools
--Best practices for incorporating automation and orchestration
--How to boost incident response capabilities, and measure your efforts
--How the NIST Cybersecurity Framework and CIS Controls can help you establish a strong foundation
Start building your roadmap to a next-generation SOC.
Introduction to NIST Cybersecurity Framework
A high-level discussion in NIST Cybersecurity Framework presented to ISC2 Quantico Chapter
A to Z of Information Security Management
The purpose of information security is to protect an organisation’s valuable assets, such as information, Intellectual property, hardware, and software.
Through the selection and application of appropriate safeguards or controls, information security helps an organisation to meet its business objectives by protecting its physical and financial resources, reputation, legal position, employees, and other tangible and intangible assets.
In this A to Z I’d like to outline some of the key focus areas for organisations wishing to pursue compliance to the ISO27001 Information Security standard.
Iso 27001 isms presentation
This cool presentation gives a brief introduction about the ISO 27001:2005
How To Present Cyber Security To Senior Management Complete Deck
This template is useful in presenting cybersecurity plan to higher authority. Cybersecurity officer will present it to top level management. It will help in determining the roles and responsibilities of senior management and executives who are responsible in handling risks. Firm will also optimize its cybersecurity risk framework. Firm will assess the current concerns that are impeding cybersecurity in terms of increase in cybercrimes, data breach and exposure and amount spent on settlements. It will also analyze firm its current cybersecurity framework. Firm will categorize various risk and will assess them on parameters such as risk likelihood and severity. The IT department will also improve their incident handling mechanism. Cybersecurity contingency plan will be initiated by firm. In this plan, firm will build an alternate site for backup maintenance. Backup site selection will be done by keeping certain parameters into consideration such as cost for implementation, duration, location, etc. The other plan essentials include business impact assessment, vital record maintenance, recovery task list maintenance, etc. The template also includes information regarding the role of personnel in terms of role and responsibilities of line managers, senior managers and executives in risk management. It also includes information related to the role of top management in ensuring effective information security governance. The information regarding the budget required for the cybersecurity plan implementation is also provided with staff training cost. https://bit.ly/3iSww5L
EDR vs SIEM - The fight is on
Many organizations and managed security providers are starting to move from SIEM, Security Information and Event Management, to EDR, Endpoint Detection and Response. The problem is this may not be the best decision for your organization. These technologies are similar but fundamentally different. This presentation also shares innovating ways to use your SIEM to catch the bad guys as well as learn some simple tricks for easing the burden of SIEM management.
Cyber Security Governance
Most organizations have good enterprise-level security policies that define their approach to maintaining, improving, and securing their information and information systems. However, once the policies are signed by senior leadership and distributed throughout the organization, significant cybersecurity governance challenges remain. In this workshop I will explain the transforming organizational security to strengthen defenses and integrate cybersecurity with the overall approach toward security governance, risk management and compliance.
NIST Cybersecurity Framework 101
Presentation for March 2017 webcast by NIST.
www.nist.gov/cyberframework
Webcast video: https://www.nist.gov/news-events/events/2017/03/cybersecurity-framework-virtual-events
This presentation introduces the audience to the Framework for Improving Critical Infrastructure Cybersecurity (“The Framework”). It provides a brief history about why and how the Framework was developed, and an understanding of each of the three primary Framework components (the Core, Implementation Tiers, and Profiles). It covers potential benefits of Framework, and how the Framework can be used. It highlights industry resources, progress in Roadmap areas, and future direction of the Framework program.
What's hot (20)
How To Present Cyber Security To Senior Management Complete Deck
How To Present Cyber Security To Senior Management Complete Deck
Similar to Developing an Information Security Program
Information Security between Best Practices and ISO Standards
Main points covered:
• Information Security best practices (ESA, COBIT, ITIL, Resilia)
• NIST security publications (NIST 800-53)
• ISO standards for information security (ISO 20000 and ISO 27000 series)
- Information Security Management in ISO 20000
- ISO 27001, ISO 27002 and ISO 27005
• What is best for me: Information Security Best Practices or ISO standards?
Presenter:
This webinar was presented by Mohamed Gohar. Mr.Gohar has more than 10 years of experience in ISM/ITSM Training and Consultation. He is one of the expert reviewers of CISA RM 26th edition (2016), ISM Senior Trainer/Consultant at EGYBYTE.
Link of the recorded session published on YouTube: https://youtu.be/eKYR2BG_MYU
CCISO_Certification_Training_Course-Outline.pdf
CISO, or Chief Information Security Officer, is an established top-level executive position in the industry, similar to CEO or CTO. CISO is the highest-level executive in an organization charged with information security. With the increasing awareness of digital information as an asset in the industry at large, the demand for CISOs across organizations is on a rise. The CISOs focus on the core areas pertaining to information security in an enterprise and lead the IS program.
Protecting business interests with policies for it asset management it-tool...
Where is that laptop? Who has that printer? Do we have sufficient software licenses for every user? These are the types of questions IT asset management is meant to answer. As an operational practice, IT asset management serves multiple purposes, as reflected in the list below:
Asset management practices are used to minimize the risk that investments made in technology (hardware, software and training) will be lost due to theft, destruction or other damage.
Asset management practices are used to ensure that technology assets are properly allocated to end-users to optimize usage and workplace productivity.
Asset management practices are used to simplify technical support and maintenance requirements.
Asset management practices are used to lower IT “cost of ownership” and maximize IT ROI.
Asset management practices are used to ensure that software licensing is in full compliance, minimizing the risk of legal and regulatory problems.
Asset management practices are used to support “sister” policies for disaster recovery, email usage, data security, and technology standards.
· THE INDUSTRY AND THE COMPANY AND ITS PRODUCT(S) OR SERVICE(S)A.docx
· THE INDUSTRY AND THE COMPANY AND ITS PRODUCT(S) OR SERVICE(S)
A. The industry.- Tamara
B. The company and the concept- Tamara
C. The product(s) or service(s).- Tamara
D. Entry and growth strategy.- Arturo
· MARKET RESEARCH AND ANALYSIS
A. Customers.- Richard
B. Market size and trends.- Arturo
C. Competition and competitive edges.- Arturo
D. Estimated market share and sales.- Richard
E. Ongoing market evaluation.- Richard
· MARKETING PLAN
A. Overall marketing strategy.- Ryan
B. Pricing.- Ryan
C. Sales tactics.- Ryan
D. Service and warranty policies.- Ade
E. Advertising and promotion.- Ade
F. Distribution.- Ade
Deadline sent to Team Fileshare due- Saturday of each week by 4p.
Team Members in attendance-
Ryan, Richard, Arturo, Tamara, Ade
I. System Design Principles
A network system is a collection of integrated components that works together, to
achieve a common objective. A system design is a process of defining the system architecture,
modules, interfaces, data, and components of a system, to a specified requirement.
Design principles describe the procedures that software developers, system analyst, and
system architect designers, create through the distribution of colors, texture, and the weight of
objects. This union describes the use of assets, so that there is a structured and stable system
design, including system appearance, and security against unauthorized access. Security design
principles are essential when designing any system to make sure security and integrity is tamper
proof.
Various security design principles exist and designed by the system developer, listed
below include security design principles:
1. The Principle of Least Privilege requires the system developers to
limit user access rights to use specific tools and informatio n in a system, this
privilege gives rights to access data and applications, only to special users, with
limited access to other users.
The orientation of this design principle limits the system from damaging
attacks from users of the system; whether they are intentional or not, it also limits
the changes or damages a user can make on the system, and it reduces interactions
with the system.
2. Fail Safe Defaults Principle administered by the system developer
in charge of security, and authorizes users, to access system resources, based on
granted access, rather than exclusion; this design principle permits, the users, to
access resources, if permission is granted. By default, the users do not have
access, to system resources, until authorization is given. This design principle
prevents unauthorized users, from viewing resources. (Dennis & Wixom, 2000)
3. Defense In-depth Principle is a concept used by system developers
use security layers on system resources. This principle requires users to provide
credentials when accessing a system resource. The security experts because of
the operational results and effectivene.
Cissp- Security and Risk Management
Training and Tips that are very helpful to gain knowledge in the field of information Security and passing your CISSP Exam.
Similar to Developing an Information Security Program (20)
Gs Us Roadmap For A World Class Information Security Management System– Isoie...
Gs Us Roadmap For A World Class Information Security Management System– Isoie...
Information Security between Best Practices and ISO Standards
Information Security between Best Practices and ISO Standards
Protecting business interests with policies for it asset management it-tool...
Protecting business interests with policies for it asset management it-tool...
Fissea09 mgupta-day3-panel process-program-build-effective-training
Fissea09 mgupta-day3-panel process-program-build-effective-training
· THE INDUSTRY AND THE COMPANY AND ITS PRODUCT(S) OR SERVICE(S)A.docx
· THE INDUSTRY AND THE COMPANY AND ITS PRODUCT(S) OR SERVICE(S)A.docx
Developing an Information Security Program
- 1. 2011 National BDPA Technology Conference Developing an Information Security Program Shauna Cox August 3 – 6, 2011 Chicago, IL
- 19. Scope of Authority & Need
- 35. A Day in the Life Conduct Self- Assessments Respond to Audits Train & Educate Provide Expertise Monitor Systems Manage Projects Track Compliance Gauge SLA Adherence
- 38. Questions