All
right, let's take a look at Module 5, which deals with network security
controls, specifically administrative controls.
One of our first considerations is how to comply with industry standard regulations.
Regulatory frameworks compliance is
required for organizations to comply with some type of imposed security regulation,
be that a government regulation or be in an industry standard like PCI DSS.
Compliance with frameworks is a
collaborative effort between governments and private bodies
to encourage voluntary or mandatory improvements to cybersecurity.
So the whole idea with mandatory or
standards is that they maintain consistency, that they're required.
We're going to see that term pop up in our security policy discussion.
And if everybody is following the prescribed mandates and standards,
everybody's at the same level and we have a standard baseline of security.
It security regulatory frameworks contain
guidelines and best practices, standards, and we're going to lay out that
whole policy hierarchy here in just a second.
Regulatory frameworks compliance.
First and foremost,
you have the frameworks that dictate what you need to comply with.
So one example would be PCI DSS.
One of its requirements is to encrypt cardholder data.
You would then draft a policy that would address these requirements.
The policy example in this case would be encryption policy.
So we'll talk about more types of policies later in the module, but we would write a
policy that dictates the requirements, the purpose, the scope, etc.
Within that policy will be recommendations or references to prescribed standards.
The standards are mandatory activities.
Now, the example they give you here
is we do have standards like data encryption standard, advanced
encryption standard, R vish Shemir Adelman.
Those are well known industry standard
types of protocols and encryption algorithms.
The standard also refers to a mandatory or
compulsory activity, which means you have to do it.
The policy would say something along the
lines of, The standard is that this data is encrypted using a standard like data
encryption standard, advanced encryption standard, or R vish Shemir Adelman.
Procedures practice to and guidelines are specifics.
Operating procedures lay out step by step exactly how you accomplish a stated task.
So the standard would be something along the lines of, we require encryption.
The practice or the procedure would lay
out the specifics of how encryption keys are stored, preserved, what types of
software you're using to apply the algorithms, etc.
Guidelines are generally more flexible and the rules of thumb.
So rules of thumb give you some wiggle room, if you will, for the absence of a
standard and recommendations to follow as best practices.
So we have the policy brief, high level overview document.
The policy lays out the specific
requirements, the standards, mandatory compulsory activities.
You've got to actually adhere to these standards.
The uniform application of standards gives
you a security baseline, which we hear baseline often used in the same discussion
as policies and standards. And then the procedures, the specific step by step how
tos and practices, and then guidelines, flexible or rules of thought.
They're all interrelated and they're all part of the same hierarchy.
Why organizations need compliance?
A, to stay in business, to be allowed to continue to operate,
and they improve security, minimize loss, and maintain trust.
Improving security, there's hopefully a
reason for the requirements in the standard.
And the ultimate reason is to ensure or improve security.
The standards are developed over time.
They allow best practices, reasonable requirements.
So by applying the standard in compliance,
you should automatically get the benefit of improving security.
Help to minimize losses, pretty self explanatory, and maintain trust.
Customers will have a higher degree of confidence doing business with an
organization that adheres to best practices, industry standards, etc.
Identifying which regulatory framework to comply with.
Start with the industry.
I talk an awful lot about different regulations and different standards
throughout all the security courses I teach.
The first thing I recommend is don't dive
too terribly deep into the details initially.
So get an idea of the basics of the
regulation and the industry that it applies to.
Now you can dive into the various titles
of HIPAA, for example, but that might be way too much detail, way too fast.
So start off with, Hey, HIPAA deals with
anybody that maintains health care information, period.
And then worry about the details as they
come up in additional discussions or as a review.
So if I maintain health care information,
I am subject to HIPAA compliance, and that is not just a doctor's office.
That's insurance companies, business
associates, employers, intermediaries, patient data processors, etc.
Starbrain's Oxley.
Any publicly traded company is required to comply with Starbrain's Oxley.
This primarily deals with accuracy of accounting practices.
Organizations within scope,
US public company boards, management, public accounting firms.
The whole reason we have Starbased and Xoxley is for the For the Enron scandal.
If you remember that way back years ago, a
lot of misreporting in Enron's accounting practices, and that led to one of the big
five accounting firms going away at that point.
Federal Information Security Management
Act of 2002 or FISMA, deals with federal agencies.
They must develop a method of protecting information systems.
I always got FISMA confused with FRPA
because they both started with F and ended with A.
Something about the human brain is you book end the two letters at the beginning
of a word and your brain fills in the middle.
So for whatever reason, I used to get those two completely confused.
Fisma is Federal Systems, FRPA is educational systems.
And we'll mention that at some point during the course.
But FRPA is any information held by an
educational institution you have a right to actually review.
Gramm leach Blyley deals with finance.
Companies that offer financial products or services to individuals such as loans,
financial or investment advice, or insurance.
So that is protecting customer data for banking and mortgage lenders, etc.
So if you work in the banking and finance industry, Gramm leach Blyley.
Payment card industry data security
standard, PCI DSS is actually not a regulatory law.
It's a standard imposed by Mastercard and Visa.
Anybody that participates in merchant transaction processing, which means any
company handling credit card information, is subject to PCI compliance.
Pci is a big driver for security testing and security assessments.
Are deciding on how to comply to a regulatory framework.
Now, you should generally have a team put together for regulatory compliance since
it can be definitely a full time job and then some.
When organization falls within the scope
of certain regulatory framework, it needs to first off correctly interpret
regulatory requirements and the framework to be complied with.
When you read the standards and the regulation, it's not always really clear
on exactly how you would protect cardholder data.
So based on the requirements, you need to establish policies, procedures, and
security controls to actually make it happen.
They manage and maintain compliance.
Now, they do give a couple of examples of PCI DSS, and I'm not going to get into a
lot of the detail of the different specific criteria in PCI DSS.
It does lay out things like approving and testing network, restricting
and bound outbound traffic, and all of that requires a solution.
Your policy would map the solution to the prescribed standard, and that's where you
can benefit from the experience of an auditor or other architect or designer.
A lot of times the compliance is
outsourced to some an expert or consultant.
All right, based on those regulatory
requirements, establish your policies, procedures, and security controls.
All right, a little bit on regulatory frameworks, laws, and acts.
Pci, DSS, again, is imposed by Mastercard and Visa.
Proprietary information security standard
for organizations handling cardholder information for major debit credit,
prepaid, ePers, ATM, point of sale cards, etc.
All entities involved in payment card processing.
Here are some of the specifics of PCI.
Again, we're not going to dig too terribly
deep into the details, but if you are participating in electronic transaction
processing or your provider is, you're required to comply with PCI.
Health Insurance Portability Accountability Act.
Again, it deals with electronic
transactions and code set standards, privacy rule, security rule, national
identity requirements, and the enforcement rule
requires all health care providers, health plans, and employers have standard
national numbers that identify them to attach standard transactions.
Security rule series of administrative, physical, and technical safeguards, which
we'll be talking about in several examples of those for all covered entities.
Federal protections for personal health information by covered entities, etc.
Again, don't worry too much about picking
up every detail, every nuance in the first pass.
Get a general feel for the industry that
applies to and a general feel for some of the requirements.
Let's start with OXley.
Again, protecting investors in public by
increasing the accuracy and reliability of corporate disclosures.
Comes in three titles, title 1, title 2,
title 3, dealing with public company accounting oversight board,
auditor independence, and corporate responsibility.
And again, that comes in the wake of the
Enron scandal years ago with a huge in accuracy in Enron's accounting practices.
The Gramm Leach Bliley Act, again, is meant for financial institutions.
The objective was to ease the transfer of
financial information between institutions and banks while making the rights of the
individual more specific through security requirements.
Key points, protecting customers or consumers' personal financial inspiration
held by financial institutions and their service providers subject to
a civil penalty of not more than $10,000 for each violation.
The General Data Protection Regulation.
This is one of the more stringent
standards and it deals with organizations doing business in Europe.
One of the most stringent privacy and security laws globally.
Levy's harsh fines against those who violate its privacy and security
standards, penalties reaching tens of millions of euros.
The protection principles are lawfulness, fairness and transparency,
purpose limitation, data minimization, accuracy, storage limitation,
integrity and confidentiality, and then accountability.
Now, prior to this, there are some unknowns, how organizations are collecting
your data, how they're using your data, whether they're discarding it or
destroying it when it's no longer needed, whether that data can be portable, right
to be forgotten, and a bunch of other concerns.
So GDPR went into effect on May 25, 2018,
and is again one of the most stringent standards.
Privile and security law is globally, and we're seeing some other types of
regulations follow suit with the initial implementation of GDPR.
The Data Protection Act of 2018, this is actually another UK or European law.
It's an act to make the provision for the regulation of the processing of
information related to individuals, provision in connection with the
information commissioners functions under specific regulations, and to make
provision for a direct marketing code of practice and connected purposes.
All right, protects individuals
concerning the processing of personal data, requiring data to be processed
lawfully and fairly, conferring the rights on the data subject,
and conferring functions on the Commissioner, giving the holder of that
office responsibility to monitor and enforce their provisions.
Iso standards.
Anytime I see a table like this, the first
thing my brain does is say, Is this testable?
Do I have to memorize this?
The answer to that is in a testing
situation, you will most likely run into ISO standards.
Memorizing the entire list might be a little bit more
initiative or effort than is required at the beginning, but you don't want to be
familiar with things like 27001, 27002, 9660, 13490.
These are all things just off the top of my head that have stuck for specific
standards like CDRs or multi session support or organizational security models.
There's tons of ISO standards out there.
The standards are relating to pretty much anything globally.
It could be information systems, it could
be physical standards for device manufacturing, etc.
Lots of standards out there.
This table looks a little bit overwhelming.
When you're preparing for your exams, just
take note of what you see in your practice test questions and things like that.
That should typically highlight
the standards you're going to need to commit to memory.
But every certification exam, to some
degree, has some memorization involved, no doubt about it.
Now, certain things like port numbers,
that serves you well to have that memorized.
But memorizing all the ISO standards, you
might have bigger fish to fry as far as expanding your mental energy.
The DMCA, Digital Millennium Copyright
Act, is meant to enforce violations of digital copyright law.
When you willfully and purposely defeat
digital copy protection mechanisms, you're in violation of DMCA.
When you share software you haven't paid for or music you haven't paid for or
original works of authorship you haven't paid for, you're in violation of DMCA.
So it defines legal prohibitions against the circumvention of technological
protection measures employed by copyright owners to protect their works.
Fisma, Federal Information Security Management Act.
Now, again, I laid out the basic
definitions of most of these on the lead in slide, but FISMA is a comprehensive
framework, ensuring the effectiveness of information security controls over
information resources that support federal operations and assets.
That's pretty self explanatory, federal systems.
Again, like everything else, it gives us
standards, guidelines, and recommendations.
Standards, remember, are always compulsory.
You have to comply or there's some consequence.
Guidance is often given through guidelines, which is flexibility.
You'll see those standards and guidelines or recommendations come up over and over
in these different discussions on compliance and regulation.
A nd other information, security acts and laws.
Couple of notables, USA Patriot Act of 2001.
Now, this relaxed a lot of the
restrictions on eaves dropping on communications and monitoring in the
interests of national security in the wake of 911.
Typically, when there is a suspension of a right for a temporary period,
almost invariably, that temporary period gets drawn out longer and longer and
longer, and eventually temporary is no longer temporary, it's permanent.
Here in the United States, for example, we have certain rights
that are provided to us through our US Constitution, and infringement on those
rights can actually take place in the form of legal regulation, law, and so forth.
The idea with the Patriot Act was that you
didn't have an expectation of privacy, etc.
Our fourth amendment here in the United States says I have a reasonable
expectation of privacy and my domicile, etc.
I don't know the verbiage directly to
quote, but they just can't listen in for any old reason anytime they please.
In the wake of 911,
we had a lot of relaxing of that requirement for monitoring communications.
I'm getting on a bit of a soapbox here, so I'll step off of it.
But when this temporary legislation goes
into place, it's supposed to have a sunset clause, and here we are.
911 was a little over 20 years ago, and a lot of that stuff is still in force.
Just saying.
The Human Rights Act of 1998, not real notable.
Freedom of Information Act directly
relates to information being available through a written request.
The Electronic Communications Privacy Act, this is pretty important historically.
This equated electronic communications to
the same expectation of privacy that you had with voice communications.
Long story short, when you require a wire tap to listen on a phone call, ECPA
requires a similar court order to listen in on your electronic communications.
Freedom of Information Act, 2000.
Again, we got a couple of variants of that.
The computer fraud and abuse act, that definitely deserves an honorable mention.
That is United States Code Title 18,
Section 1030, which is our primary federal anti hacking statute.
Now that was amended through a couple of
versions to allow for writing malware and systems of infrastructure.
But that was one of our most notable anti hacking statutes.