Auditing The Information Security Function Kevin Wheeler, CISSP

Auditing the Information Security Function
Kevin Wheeler, CISSP, CISA

A Little About Me
• Over 17 Years of Information

Security Experience
• Founder of InfoDefense
• Frequent Speaker at Conferences
and Industry Events
• Author of IT Auditing: Using
Controls to Protect Information
Assets
Agenda
1 Information Security Level-set
2 Information Security Frameworks
3 Auditing Information Security Technical Controls
4 Auditing Information Security Governance
5 Information Security Maturity

Information Security Level-Set
Information Security Triad
Availability
Information Security Controls
Technical Access Control Systems, Multi-Factor
Authentication, Firewalls, Encryption Systems,
Uninterruptible Power Supplies, Intrusion Detection
Systems, Malware Protection Software, Redundant
Systems or System Components, Back-up Systems,
Audit and Logging Systems, System Hardening
Physical Security Guard, Card-key Physical Access Control
Systems, Alarm Systems, Safes, Fire Suppression
Systems, HVAC Systems, Fences, Lighting,
Security Cameras
Administrative Acceptable Use Policy, Business Continuity Plan,
Password Policy, Incident Response Plan, System
Baseline Configurations, Remote Access Policy, File
Recovery Procedures, Information Classification,
Security Awareness Training, Audits and
Assessments, Non-disclosure Agreements
Security Governance Lifecycle
Risk
Assessment
Measurement
and
Security
Assurance Strategy
Governance,
Risk, and
Compliance
Security Security
Management Policy
Security
Architecture
Information Security Frameworks
Information Security Frameworks
• ISO 27001
• COBIT 5.0
• NIST 800-53
• NIST Cyber Security Framework
• PCI DSS
PCI DSS 3.0
NIST Cyber Security Framework
Auditing Information Security
Information Security Program Elements
1. IT Governance, Risk and Compliance Management

• Risk Management
• Polices, Standards and Procedures
• Security Architecture
2. Identity and Access Management
3. Network Security
4. System Security
5. Application Security
6. Threat and Vulnerability Management
7. Business Continuity and Disaster Recovery
8. Data Center Security
Auditing Risk Management
Source: NIST Cyber Security Framework
Risk Analysis and Management
1. Identify Information Assets

2. Quantify and Qualify Risks
3. Assess Vulnerabilities
4. Remediate Control Gaps
5. Managing Ongoing Risk
Information Criticality Matrix
Business Process Confidentia Integrity Availabilit
lity y
Employee Records H H M
Benefits Administration M L M
Recruiting H H L
Risk Management Audit Tips
1. Business vs. Technology Focused

2. Top Down Approach (Business Function  Process  Application)
3. Use Tools to Identify the Location of Critical Information
4. Measure Confidentiality, Integrity and Availability Risk
5. Express Risk in Business Terms
18
Auditing Policies, Standards and
Procedures
IT Policy Framework
Supporting
Document
Procedure
Supporting
Standard Document
Supporting
Procedure
Document
Policy Supporting
Document
Supporting
Procedure
Document
Standard
Supporting
Procedure
Document
Policies and Procedures
[Company Logo]
Policy Title: Information Protection Policy
Policy Number: ITP-01 Version: 0.1 Effective Date: mm/dd/yyyy
Approved By: (Authorized Signer Name) Date Approved
Overview
Description
This policy contains high-level information protection mandates as set forth by executive management in
response to enterprise risk and regulatory compliance requirements. As with all corporate IT policies, supporting
standards outline the technical security requirements and procedures outline the methods used to create or
maintain security controls. The following policy statements are not meant to specify the methods of protection.
Purpose
The Information Protection Policy was set forth to protect [Company Name] from unauthorized information
disclosure and other information security risks. Many of the policy statements below have been developed in
response to regulatory requirements.
Applicability
There are two audiences for policies: general users and users that perform IT functions. This policy is directed at
users that perform IT functions.
Sanctions for Non-compliance

This policy is compulsory. Failure to comply may result in reprimand and/or employment termination.
Policy Statements
Policy
Information will be protected in a way that reduces IT risk and complies with applicable regulations.
Clarifying Policy Statements

1) System access must be strictly controlled. See the Access Control Standard for additional details.
2) Sensitive information residing on enterprise systems must be protected by appropriate security controls
according to its level of sensitivity. See the Systems Security Policy and Sensitive Information Protection
Standard for additional information.
3) Private cryptographic keys must be stored and managed in a secure manner. See the Encryption Standard
for more information.
4) New employees, contract employees and business partners that will have access to sensitive information
must undergo a background check.
21
Security Policy Audit Tips
1. Use a Standard or Framework to Ensure Proper Coverage

2. Ensure Readability and Applicability
3. Ensure that Statements are in the Proper Document Type
4. Look for References to Internal Standards
• General
• Technical Configuration
5. Look for Procedures that Map to Standards  Policies
Information Security Maturity
Security Maturity Measurement
© ISACA
How Do Most Organizations Rate?
CMM Level 2
People
• Some technical personnel trained in security
• Immature security organization (if any)
• Most employees unaware of corporate security policies
Process
• Basic processes such as change control, backup/restore, etc.
• Little or no process automation
• Immature risk and security strategy
Tools
• Firewall, Anti-virus, Spam protection and other basic security tools
• Sometimes advanced point solutions such a network IDS or multi-
factor authentication
• Little or no integration of security tools
• No real-time visibility into security
What is the Target Maturity Level?
CMM Level 3+
People
• Subject matter experts within the security organization, other IT
functions well-trained in security
• Security organization is an integral part of the business
• Employees understand and embrace security policies and information
handling best practices
Process
• IT processes are well defined
• Labor intensive processes such as password resets are automated
• IT risk is actively managed using a well defined security strategy
Tools
• Security technologies are optimized and fully integrated
• Advanced security technologies are employed according to the security
strategy (plan)
• Security personnel have real-time visibility into organizational security
at all times enabling rapid response to incidents
• Systems are highly standardized and managed efficiently
26
Security From Inhibitor to Enabler
Security (Today)
Security (Yesterday)
• Lock down systems

• Keep the bad things
out Protect Prioritized, Standardize,
• Protect only Information Risk Based Audit and
infrastructure and Approach Automate
Interactions Processes
• Disparate and
disconnected
Communicating Audit Findings
1. Express Findings in Business Terms

2. Communicate the Strengths as well as Deficiencies
3. Use Industry Standards to Back up Findings
4. Obtain Agreement from Audit Subjects
Thank You!
Kevin Wheeler, CISSP, CISA
(972) 992-3100 Ext 101
[email protected]

Auditing The Information Security Function Kevin Wheeler, CISSP

Uploaded by

Copyright:

Available Formats

Auditing The Information Security Function Kevin Wheeler, CISSP

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Auditing The Information Security Function Kevin Wheeler, CISSP

Uploaded by

Copyright:

Available Formats

Auditing the Information Security Function

Kevin Wheeler, CISSP, CISA

• Over 17 Years of Information

2 Information Security Frameworks

3 Auditing Information Security Technical Controls

4 Auditing Information Security Governance

5 Information Security Maturity

1. IT Governance, Risk and Compliance Management

1. Identify Information Assets

1. Business vs. Technology Focused

Approved By: (Authorized Signer Name) Date Approved

Sanctions for Non-compliance

Clarifying Policy Statements

1. Use a Standard or Framework to Ensure Proper Coverage

• Lock down systems

1. Express Findings in Business Terms

You might also like