USING A RISK-BASED APPROACH TO ALIGN SECURITY ARCHITECTURE WITH THE BUSINESS FOR DLP DEPLOYMENT Jeff Bardin – VP , CS O ITS olut ions j eff.bardin@ it solut ions-llc.com Insert presenter logo here on slide master
AGENDA What is Security Architecture Model for Security Architecture Development Role & Benefits of Enterprise Security Architecture Defense in Depth – A Military Comparison Sand Table Exercise What to Do Next Insert presenter logo here on slide master 2
What is S ecurity Architecture Insert presenter logo here on slide master 3
WHAT IS SECURITY ARCHITECTURE? WHO IS A SECURITY ARCHITECT? • The art and science of • A person qualified to design and designing and supervise the construction of supervising the secure business systems, construction of business usually secure business systems, usually information systems (using a business information risk-based approach). systems that are: – Free from danger and damage; – Free from fear and care; – In safe custody; – Not likely to fail; – Able to be replied upon; – Safe from attack. Insert presenter logo here on slide master 4
THAT NEED TO BE ASKED • What type of information system is it I KEEP six honest serving-men and for what will it be used? (They taught me all I knew); Their names are What and Why and When And How and Where and Who. • Why will it be used? I send them over land and sea, I send them east and west; • How will it be used? But after they have worked for me, I give them all a rest. • Who will use it? I let them rest from nine till five, • Where will it be used? For I am busy then, As well as breakfast, lunch, and tea, For they are hungry men. • When will it be used But different folk have different views; I know a person small- She keeps ten million serving-men, Who get no rest at all! She sends 'em abroad on her own affairs, From the second she opens her eyes- One million Hows, two million Wheres, And seven million Whys! Kipling Insert presenter logo here on slide master 5
RULES TO LIVE BY 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. Insert presenter logo here on slide master 6
CONFLICTING OBJECTIVES Security Cost Usability Control What does the business want compared regulatory and organizational requirements? Insert presenter logo here on slide master 7
Model for Security Architecture Development (Aligning with the Business) Insert presenter logo here on slide master 8
WHAT, WHY AND WHEN, HOW, WHERE AND WHO? Assets Motivation Process People Location Time (What) (Why) (How) (Who) (Where) (When) Contextual The Business Business Risk Business Business Business Business Time Model Process Model Organization and Geography Dependencies Relationships Conceptual Business Control Security Security Entity Security Security Attributes Objectives Strategies and Model and Trust Domain Model Related Profile Architectural Framework Lifetimes and Layering Deadlines Logical Business Security Security Entity Schema and Security Security Information Policies Services Privilege Profiles Domain Processing Model Definitions and Cycle Associations Business Security Rules, Security Users, Platform and Control Physical Data Model Practices and Mechanisms Applications and Network Structure Procedures the User Interface Infrastructure Execution Component Detailed Security Security Identities, Processes, Security Step Data Standards Products and Functions, Actions Nodes, Timing and Structures Tools and ACLs Addresses and Sequencing Protocols Assurance of Operational Security Service Application and Security of Security Operational Operational Risk Management User Sites, Operations Continuity Management and Support Management and Networks and Schedule Support Platforms Insert presenter logo here on slide master 9
SECURITY SERVICE MANAGEMENT – OPERATIONAL SECURITY ARCHITECTURE SECURITY SERVICE MANAGEMENT Assets Motivation Process (How) People Location Time (When) (What) (Why) (Who) (Where) Business Business Risk Business-driven Business Security BusinessField Business Calendar Contextual Requirements Assessment – Information Security Organization Operations and Timetable Collection – Corporate Policy ManagementProgram Management Program Management Information Making Classification Business Security Audit, Change/Release Security Training, Security Domain Security Conceptual Continuity Corporate Control, Incident Awareness, Management Operations Management Compliance, Management , Disaster Cultural Schedule Metrics, Measures Recovery Development Management & Benchmarks, SLAs Logical Information Detailed Security Intrusion Access Control Application Applications Security , Policy Making, Detection/Prevention, Security Deadlineand System Integrity Compliance, Event Monitoring, Privilege and Administration Cutoff Monitoring, Security Process Profile and Management Management Intelligence Development, Security Administration Gathering Service Management, System Dev Controls, Config Management Database Vulnerability Rule Definition, Key User Support, Network Security User Account Physical Security Assessment, Management, ACL Security HelpDesk Management,Site Aging, Password Software Penetration Maintenance, Backup Security Aging, CryptoKey Integrity Testing, Threat Admin, Computer Management Aging, Admin of Assessment Forensics, Event Log Access Control Admin,Anti-Virus Time Windows Admin Product and Threat Research, Product Procurement, PersonnelVetting, Platform, Time-out Component Tool Security Vulnerability Project Management, Supplier Vetting, Workstation and Configuration, and Integrity Research, CERT Operations User Admin Equipment DetailedSecurity Insert presenter logo Notifications Management Security Operations here on slide master 10 10 Management Sequencing
What is Data Loss Prevention Insert presenter logo here on slide master 11
RAPID RISK – WORKING WITH THE BUSINESS Insert presenter logo here on slide master 12
WHAT IS DATA LOSS PREVENTION? • Data Loss Prevention ( DLP ) refers to systems that – identify, – monitor, and – protect data • in use (e.g., endpoint actions), • data in motion (e.g., network actions), and • data at rest (e.g., data storage) through deep content inspection and with a centralized management framework. • The systems are designed to detect and prevent the unauthorized use and transmission of confidential information. Insert presenter logo here on slide master 13
DLP CAN ANSWER 3 QUESTIONS 14 Insert presenter logo here on slide master
DLP CAPABILITIES – FOR THE BUSINESS (NOT FOR INFOSEC) Discover Protect Find business specific Proactively control data data based upon their per business rules and business rules policy Create inventory of Prevent sensitive data sensitive data (or not) from loss Determine if data Enforce business data cleanup is wanted policies Monitor Understand how the business uses their data Understand the content in contextual form Gain visibility into policy violations Manage Define business data policies across the enterprise or as desired by the business Report on and remediate incidents and issues Insert presenter logo Detect business sensitive data accurately here on slide master 15
DETECT, PREVENT, MEASURE, COMMUNICATE, ALIGN Find it and fix it Educate users with automated responses Empower users to self remediate Prevent copying to removable media Block or allow based upon sensitive business rules As defined by the business, for the business Insert presenter logo here on slide master 16
WHO IS RESPONSIBLE? - RACI(S) Insert presenter logo here on slide master 17
RESPONSIBLE, ACCOUNTABLE, CONSULTED, INFORMED, SUPPORTING Insert presenter logo here on slide master 18
Role & Benefit of Enterprise Security Architecture (With the Business in Mind) Insert presenter logo here on slide master 19
ROLE OF ENTERPRISE SECURITY ARCHITECTURE Architecture takes a wider more holistic approach to solving the business problem of security by ensuring that all of the components are specifically designed, procured, engineered, and managed to work together for the benefit of the business based upon risk. It considers: Do we have all of the components? Do these components work together? Do they form an integrated system? Does the system run smoothly? Are we assured that it is properly assembled? Is the system properly tuned? Do we operate the system correctly? Do we maintain the system? Insert presenter logo here on slide master 20
ARCHITECTURAL CONSIDERATIONS FOR DLP • What is the scope of creating and successfully implementing a DLP program? • How will you determine the risk appetite of your organization? • What policies do you need to establish or modify before you move forward • Who will create the awareness and training plan? • What will you do about data classification? • Will you announce the DLP program to all employees? • What are the key roles and responsibilities that need to be defined? • How will you (or somebody) govern the process? Insert presenter logo here on slide master 21
Recommend
More recommend
