Module 01 - Summary of IT Security Compliance Solutions

Module 11 Summary of IT Security Compliance Solutions & Best Practices v1.
Module 11
Summary of IT Security Compliance Solutions & Best Practices

By Kefa Rabah, krabah@globalopenversity.org
This module presents a summary on how to design, plan, implement, deploy and audit an IT infrastructure to ensure that it
conforms to regulatory compliance and partners requirements – via analyzing business problem and developing business
solutions to the problems. There are tremendous variety of open-source products and services that can be used to help
companies with regulatory compliance, business partner requirements, and industry standards and practices. These
compliance solutions can help you minimize risk, thereby enable you to focus on your core business goals, and confidently
pursue new business opportunities.
Business Problem
In the current global market and security scenarios, if your business collects or shares customer personal information, you
don’t have much choice. You have to spend time and resources to comply with government regulations and partner
requirements. In this kind of scenario:
• How do you manage multiple audits and requirements across your company?
• How do you create a process for compliance in a continuous ever evolving regulation?
Business Solution
When it comes to information access and security, the best approach is to take an integrated approach to compliance that
addresses the demands on your business while keeping an eye on the bottom line.
Action Required
To help meet the regulations and compliance requirements, companies will need to identify common requirements and
address the range of solutions required. Companies can utilize internal expertise, or they may resort expert third resources
to help in uncovering business opportunities and process improvements that could help their bottom line
Regulatory Compliance The regulations that govern your business, such as Sarbanes-
Oxley and HIPAA.
Business Partner Requirements Mandates and audits required by your business partners such as
PCI Compliance and RFID Mandates.
Standards and Best Practices Methods and processes to improve security and business
operations such ISO 17799, ITIL, and COBIT
Public Sector Regulations Security and authentication directives, standards and
requirements for government agencies and contractors.
1
© April 2007, Kefa Rabah, Global Open Versity, Vancouver Canada
www.globalopenversity.org
Module 11 Summary of IT Security Compliance Solutions & Best Practices v1.0
Sarbanes-Oxley Section 404 Compliance
Business Solutions
Section 404 of the Sarbanes-Oxley Act of 2002 (SOX) requires publicly-traded companies to establish and maintain
internal controls of financial reporting processes. Security controls are one part of the General Computing Controls (GCC)
assessed by auditors during annual 404 audits.
Mapping to Standards
Most organizations map SOX standards and requirements to the Committee of Sponsoring Organizations of the Treadway
Commission (COSO) framework for internal controls. However, COSO does not address information technology controls.
Companies, therefore, apply standards based on the IT Governance Institute’s (ITGI) document, “IT Controls for Sarbanes-
Oxley,” because it is used by many auditors to conduct their reviews.
SOX Requirements
There are various product services, both open-source and proprietary, to help you address IT controls based on COBIT
controls from ITGI standards.
Required Controls Applies To Action To Take

Requires a variety of Systems, applications, and Enterprise Compliance
assessments to be performed on infrastructure that process Assessments
a regular basis financial information
Requires the capture, monitoring, • Financial systems Log Management Service
response, and retention of file • Supporting controls
logs for at least one year.
Requires regular assessment of • Financial systems Vulnerability Management
network and application level • Supporting controls Service
vulnerabilities.
Requires intrusion detection for Intrusion prevention of financial Intrusion Detection Management
network security with events reporting systems, both host and Service (IDS)
stored for at least one year. network-based
Requires firewalls with logs that Firewalls, proxies, gateways and Firewall Management Service
are captured, monitored, and network access control devices
responded to, retained for at least that protect financial reporting
one year. systems
Best Practices
These solutions address industry best practices that can augment the above required controls.
Best Practice Applies To Action To Take

Multi-factor Authentication, e.g., Access to any sensitive or Integrated Identity Mgt for
Two-factor authentication. regulated financial data Unified Authentication (SSO)
Encryption and non-repudiation Sensitive or regulated financial Enterprise Key Mgt via:
data and the systems used for • Managed PKI for SSL
storage, processing or • Managed PKI Services
transmitting.
2
HIPAA Compliance
The Healthcare Insurance Portability and Accountability Act (HIPAA) was passed in 1996 in response to concerns about
the privacy and security of medical records. Portions of HIPAA require healthcare organizations to conduct a thorough
information technology (IT) risk assessment as well as develop and implement a plan for improving and maintaining
security.
Requirements
The following solutions can help address certain HIPAA requirements.
Key Controls Applies To Action To Take

• Requires a regular risk All systems storing, transmitting Enterprise Consulting
assessment (assumed to be or processing regulated data: Assessments
annually). electronic Protected Health
• Requires that major Information (ePHI)
infrastructure changes undergo
technical and non-technical
evaluations.
Requires logging of all access to Applications, servers, Log Management Service
personal information (by a person databases, and network devices
or user to view, read, write, or with ePHI
delete)
Requires encryption of data at ePHI in storage and in Enterprise Key Mgt via:
rest and in transmission, access transmission. • Managed PKI for SSL
to PHI, and integrity controls. • Managed PKI Services
Best Practices
Best Practice Applies To Action To Take

Periodic vulnerability scanning All systems storing, transmitting Vulnerability Management
or processing ePHI. Service
Monitoring and intrusion detection All network segments and Intrusion Detection Management
to identify and respond to security systems storing, transmitting or Service (IDS)
incidents. processing ePHI.
Two-factor authentication Useful for high level of Integrated Identity Mgt for
compliance to requirements for Unified Authentication (SSO)
remote access/VPN, Web
applications and security device
authentication
Firewall protection Network access to segments Firewall Management Service
that transmit, store or process via unified threat mgt (UTM)
ePHI.
3
Payment Card Industry Compliance

The Payment Card Industry (PCI) Data Security Standard was created by major credit card companies to safeguard
customer information. Visa, MasterCard, American Express, and other credit card associations mandate that merchants
and service providers meet certain minimum standards of security when they store, process and transmit cardholder data.
Requirements
These solutions help you address PCI standards.

Requires annual assessment for Merchants, service providers, Enterprise Consulting
Level 1 (large) merchants, annual and banks Assessments
penetration testing and
application testing Level 1 and 2
service providers.
Requires logging of all access to Credit card processing systems Firewall Management Service
credit card data.
Requires quarterly scans and Credit card processing systems • Technical Security
annual penetration tests. External and network devices Assessments
scans conducted by an approved • Vulnerability Management
vendor. Requires alerts. Service
Requires host and/or network Credit card transmission Intrusion Detection Management
intrusion detection or prevention. networks, processing and Service (IDS)
storage systems
Requires an appropriately Firewalls providing access to Firewall Management Service
configured and managed firewall. credit card processing and
storage systems
Requires two-factor Remote access to credit card Unified Authentication
authentication processing environments
Requires 128-bit SSL encryption Databases, Web servers and Managed PKI for SSL
and effective management of applications that store or
crypto key transmission and process credit card data
storage.
Best Practices
Key Controls Applies To Action To Take

Applications must be developed All credit card processing • Security Certification Program
appropriately and tested applications • Technical Security
Assessments
Respond quickly and effectively Databases, Web servers and Incident Response and Forensics
to incidents applications
Awareness and protection against Credit card transmission iDefense Security Intelligence
the latest threats networks, processing and Services
storage systems
Learn More
Visa Cardholder Information Security Links to Visa Web site for more about PCI compliance
Program requirements as well as the Payment Applications Best Practices
program
MasterCard Site Data Protection Links to MasterCard Web site for more about PCI scanning
Program requirements
Enterprise Compliance Solutions for Checkout review of PCI data security standards by VeriSign, using
4
the Payment Card Industry VeriSign PCI compliance solutions for merchants, Levels 1-4
5
ISO 17799 Standards

ISO17799 is a complex and detailed international information security standard. Compliance and certification enables
companies to show their business partners and customers that they have met a high standard of security. The
requirements, which are programmatic in nature, cover 11 core areas. There are open-source products and services that
can help companies meet standards in each core area for their enterprise security programs.
Standards of Good Practice

Core Area Description Action To Take
Security Policy Management should set a clear Security Policy and Program
policy direction in line with Services
business objectives and
demonstrate support for, and
commitment to, information
security through the issuance
and maintenance of an
information security policy
across the organization.
Security Organization A management framework • Security Policy and Program
should be established to initiate Services
and control the implementation • Enterprise Consulting
of information security within the Assessments
organization, including
management of third party
security.
Asset Management The implementation of specific • Security Policy and Program
controls may be delegated by Services
the owner, as appropriate, but • Unified Authentication
the owner remains responsible • Log Management Service
for the proper protection of
assets, including information
classification.
Personnel Security Security responsibilities should Security Policy and Program
be addressed prior to Services
employment. Employees must
also be trained on and aware of
security policies and procedures.
Physical Security Critical or sensitive information • Unified Authentication
processing facilities should be • Security Policy and Program
housed in secure areas, Services
protected by defined security
perimeters.
Communications and Responsibilities and procedures • Intrusion Detection
Operations Management for the management and Management Service (IDS)
operation of all information • Firewall Management
processing facilities should be Service
established. These procedures • Log Management Service
include the majority of the • Vulnerability Management
requirements for technical Service
security controls such as email • Technical Security
security, scanning/assessment, Assessments
network monitoring, and logging.
6
Core Area Description Action To Take

Access Control Access to information, information • Unified Authentication
processing facilities, and business • Identity and Access
processes should be controlled on the basis Management Services
of business and security requirements. • Security Policy and Program
Services
Information Systems The design and implementation of the • Technical Security
Acquisition information system supporting business Assessments
Development and process must address security • Security Policy and Program
Maintenance requirements. Services
Information Security Information security events and • Incident Response and
Incident Management weaknesses associated with information Forensics
systems should be communicated in a • Security Policy and Program
manner allowing timely corrective action to Services
be taken. • Intrusion Detection
Management Service (IDS)
• Vulnerability Management
Service
Business Continuity A business continuity management process Disaster Recovery and Business
Management should be implemented to minimize the Continuity
impact on the organization and recover
from loss of information assets to an
acceptable level through a combination of
preventive and recovery controls.
Compliance The design, operation, use, and • Enterprise Consulting
management of information systems may Assessments
be subject to statutory, regulatory, and • Security Certification
contractual security requirements. Program
• Security Policy and Program
Services
7
Retailer RFID Mandates

Some major retailers and grocery store chains have required pallet and case level RFID enablement as a condition of
doing business. There are open-source and proprietary product and services that can help you design, deploy and manage
RFID technology and systems that are used today by many of the leading companies in retail, consumer products,
manufacturing, healthcare and logistics, including a top 5 U.S. retailer, and some of Wal-Mart’s suppliers.
Typical Retailer Requirements

RFID enablement Manufacturing, packaging, and Supply Chain Consulting RFID
shipping Enablement
Systems integration to share data Product or pallet data Supply Chain Consulting Data
in a secure, timely way Management
Best Practices
In addition to the required controls above, the following technologies can be applied as best practices to support RFID
implementations.
Controls Applies To Action To Take

128-bit SSL encryption and Databases, Web servers and Managed PKI for SSL
effective management of crypto applications that store or
key transmission and storage. process product data
Two-factor authentication Remote access to shared data Unified Authentication
and applications
8

Module 01 - Summary of IT Security Compliance Solutions

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Module 01 - Summary of IT Security Compliance Solutions

Uploaded by

Copyright:

Available Formats

Module 11 Summary of IT Security Compliance Solutions & Best Practices v1.

Summary of IT Security Compliance Solutions & Best Practices

Sarbanes-Oxley Section 404 Compliance

Required Controls Applies To Action To Take

Best Practice Applies To Action To Take

Key Controls Applies To Action To Take

Best Practice Applies To Action To Take

Payment Card Industry Compliance

Required Controls Applies To Action To Take

Key Controls Applies To Action To Take

ISO 17799 Standards

Standards of Good Practice

Core Area Description Action To Take

Retailer RFID Mandates

Typical Retailer Requirements

Controls Applies To Action To Take

You might also like