Information Security in a Compliance World

Information Security in a
Compliance World
RK Dixon Tech Summit ‘12 – November 7, 2012
Presented by Evan Francen, President – FRSecure, LLC

http://www.frsecure.com | 952-467-6384

Introduction
Thank you for attending!

Thank you to RK Dixon for inviting us!


Introduction
Before we get started:
• This is not your typical presentation.
• What you have to say is as important as what I am
going to tell you.
• You are encouraged to participate!

I will ask you questions, if you don’t ask me some!


Introduction
FRSecure
• Information security consulting company – it’s all
we do.
• Established in 2008 by people who have earned
their stripes in the field.
• We help small to medium sized organizations
solve information security challenges.


Introduction
Speaker – Evan Francen, CISSP CISM CCSK
• President & Co-founder of FRSecure
• 20 years of information security experience
• Security evangelist with more than 700 published articles
• Experience with 150+ public & private organizations.


Introduction
Topics
• What drives information security in your organization?
• What is information security?
• Customer requirements
• Compliance
• Compliant = Secure?
• Solution - Strategic Information Security
• Top Five Things You Should Do (Tactically & Strategically)
• Need Help? – Contact Us!


What drives information security
at your organization?
This is a question for you?


Maybe an explanation of
information security would help…

In your opinion/words, what is
information security?


What is Information Security?


Information Security Is Not an IT Issue

The application of Administrative, Physical and Technical controls in an effort
to protect the Confidentiality, Integrity, and Availability of Information.

IT-centric information security over-emphasizes Technical Control, often at
the expense of Administrative and Physical Control.

IT-centric information security also places an over-emphasis on Availability of
systems, sometimes at the expense of Confidentiality and Integrity.


Back to our question; what drives information
security at your organization?
Customer Requirements?
Regulations?
• HIPAA, GLBA, FTC, FERPA, Computer Fraud and Abuse Act, etc.

Risk?

Really, there is only one good answer.


Customer Requirements

What’s the problem with customer
requirements?
• Different customers, different requirements
• Customers don’t know your business like you do
• Customer protection is more important than your success
• Customers are probably more confused than you are
Should the basis of your information security strategy be customer
requirements?


What’s the problem with compliance?
• You’re in business to make money, right?
• Information security is not one size fits all
• Regulators and examiners are not information security
professionals
• Compliance is confusing, yes?
Should the basis of your information security strategy be compliance?


Compliant DOESN’T mean Secure!
Today’s compliance landscape is confusing!
Federal Regulations:
• HIPAA, GLBA, FTC, FERPA, Computer Fraud and Abuse Act, etc.
State Regulations:
• Breach notification laws, data destruction laws, data protection laws
Industry Regulations:
• Payment Card Industry Data Security Standard (PCI-DSS)
Customer Requirements:
• Good luck!


Solution – A strategic approach to information
security
Principles of strategic information security:
• Alignment with business objectives
• It’s all about people – culture
• Management involvement
• Proactive vs. Reactive
• Forward-looking
• Formal
OWN IT!


Top Five Things for You To Do
#1 – Conduct a risk assessment
• Where are your most significant risks?
• What risk is the highest (priority)?
• How will we justify our existence (expenditures)?
• How do we measure what we’re doing?


#2 – Documented Policies & Procedures
• Policies are one tool we use to set culture.
• What is management’s view?
• Nobody reads policy, bummer.
• People are the biggest risk.
• Policies set direction and governance


#3 – Patch your systems & install antivirus
• Together, not one in lieu of the other
• Might be a pain, but it’s worth it (trust me)
• This is the song that never ends…


#4 – Training & Awareness
• How do users know what to do if you don’t tell them?
• Remember culture?


#5 – Incident Response


DON’T FORGET
Sometimes information security professionals forget
this fact!
• Not all risks require mitigation/remediation
• Information security must be strategic
• Information security strategy must align with business strategy
• Avoid business vs. information security scenarios
• Information security controls should be as transparent as possible


BONUS

Govern mobile devices
• Data doesn’t stay home anymore
• How do you protect data on mobile devices?


How we help – Risk Assessment


How we help – Risk Management (Build &
Manage)


Need Help? Contact FRSecure!
Some of our services:
• Information Security Assessments
• Compliance Assessments (i.e. HIPAA, GLBA, etc.)
• Customer Required Assessments
• Internal Network Vulnerability Assessments
• External Network Security Assessments
• Penetration Testing
• BC/DR Plans
• Policy Creation Evan Francen, CISSP CISM
• Outsourced Security Resources President
evan@frsecure.com
952-467-6384 (direct)
www.frsecure.com


Thank you!

Questions?


Information Security in a Compliance World

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (20)

Similar to Information Security in a Compliance World

Similar to Information Security in a Compliance World (20)

More from Evan Francen

More from Evan Francen (17)

Recently uploaded

Recently uploaded (20)

Information Security in a Compliance World