1 K P M G L L P A D V I S O R Y Information Security: Policy, Awareness and Training, and Compliance Graham J. Hill IT Advisory Services November 21, 2007

2 Overview Information Security Governance - Policy and Procedure and their Relationship with Training and Awareness Security Awareness and Training Business Drivers Program Framework Compliance Audit and Assessment: Methodology Different types

3 Objectives Gain an understanding of: Relationships between corporate policy and training and awareness The business drivers Manage Risk Promote a culture of awareness Empower employees Protect the Company and its Assets!!! Components of an effective awareness program Assessing or auditing the program

4 The Corporate Information Security Policy The “House Rules” Conveys Senior Management expectations to employees Helps to show Due Diligence in Security Meant to address risk the company faces Address Malicious or non-malicious activity Sets a baseline for behavior Conveys enforcement criteria Sets the stage for development of procedures, standards and guidelines

5 Information Security Policy - Development Considerations in the development of Security Policy: Business Risk Profile Protection of assets (tangible and non-tangible) Legal, Statutory, Regulatory, and Contractual SOX, HIPPA, GLBA, etc., etc., etc, Business Requirements for Information Processing that support operations Inter-connectivity profile IT usage profile Leveraging Industry Accepted Standards: ISO – International Standards Organization CoBIT – Control Objectives for IT NIST – National Institute of Standards for Technology Series (800-50, ) Security Trends in the industry Emerging cyber-threats The “human” factor

6 The Relationship between Corporate Policy and Awareness & Training Business drivers for implementing an awareness program: Communicate policy Explain risks the organization faces Communicate risk mitigation tactics for known threats Social engineering, Phishing/Pharming, Dumpster Diving Address typical security issues in the workplace: Physical security Mobile Devices – PDA’s, Laptops, etc. Acceptable usage Identity Theft!!! Hotlines, Call Trees, Key Internal Contacts Outline employee responsibility and accountability Empower employees!!!

7 Information Security Awareness & Training Always on the move…

8 What is the difference between Awareness, Training, and Education? Characteristics of Awareness – This is the “What” “For your information” Meant for recipient to “recognize and retain” Delivered via sessions, webinars or CBTs, s, incentives, visible marketing materials Short term retention Characteristics of Training – This is the “How” Knowledge and skill Delivered via practical instruction Meant for intermediate retention – training on a specific role Characteristics of Education – This is the “Why” Insight and understanding Delivered via theoretical instruction – study, research Long term retention

9 Just some figures…. Currently, 8 of SANS “Top 20” list end-user Awareness and Training part of the solution A laptop belonging to Fidelity Investments, one of the largest mutual fund companies in the world, was stolen recently Result: The laptop contained financial information on almost 200,000 current and former Hewlett Packard employees….. The Department of Veterans Affairs (VA) recently learned that an employee, a data analyst took home data from the VA, which he was not authorized to do. Result: This resulted in over 26 MILLION veterans having their personal information stolen, including social security numbers and disability ratings when the employee’s home was burglarized. This included one of our Seattle-based Senior Managers

10 Auditing and Assessing Methodology To test the “design” of the program: Analyze the Program Its history and background Ideological foundation – does it reflect the policy, industry standards, regulatory concerns? Its framework – is it following a specific standard or ad hoc? Content The method of accountability – do training recipients sign off? Method(s) of delivery Incorporates Awareness AND Training Awareness, role-based, performance based Is the program curriculum reviewed periodically for relevance?

11 Auditing and Assessing Methodology To test the “effectiveness” of the program: Sample a set of recipients and test their knowledge Did they sign-off? Test the curriculum that is taught Are awareness recipients able to identify threats? Are they able to stop the threat prior to realization? Do they report the attempt?

12 Third-Party Assessments Provide an independent view of the current state of the Security Program Provides a “snapshot in time”, health check Typically leverages accepted Industry Standards (i.e. ISO and ISO 17799/27002) Prioritizes risk areas, provides direction, and provides business case

13 Standards-Based Audits Payment Card Industry (PCI) Compliance Assessment ISO17799/27001 Certification AICPASystrustWebtrustNIST

14 Other Audits and Assessments Vendor and Partner Security Assessments Security in Mergers and Acquisitions Planning an IT Merger Security? Regulatory Compliance?

15 On the Horizon Regulation “Du Joir” Increased legislation for businesses Changes in frameworks and standards Use of automated “performance measurement” tools Integrating security other standards such as ITIL

16 Questions and Comments???

17 Thank you Graham Hill,CISSP, CISM, ITIL Manager, IT Advisory – Information Protection Services KPMG LLP - Seattle, WA

18 References ISO 17799/27001 NIST 800 Series CoBIT v4.0 “A DESIGN THEORY FOR INFORMATION SECURITYAWARENESS”, Petri Puhakainen