Measuring Compliance with Tenable Security Center Joe Zurba | HUIT IT Security Presentation to FAS Security Liaisons May 23, 2013

Agenda: What is compliance and why is it important? 4/22/2017 Agenda: What is compliance and why is it important? What do we need to comply with? What can we measure? How is measurement accomplished? What are the first steps? What are the next steps? Questions

What is Compliance? com·pli·ance 4/22/2017 What is Compliance? com·pli·ance /kəmˈplīəns/ Noun 1. The action or fact of complying with a wish or command. 2. The state or fact of according with or meeting rules or standards. Synonyms agreement - consent - accord - accordance - conformity Compliance means conforming to a rule, such as a specification, policy, standard or law. Dictionary definition of compliance…. Perhaps, the definition that is more salient to this presentation is…

Why is Compliance Important? 4/22/2017 Why is Compliance Important? Compliance provides a baseline posture from which we can build more mature process and controls Compliance provides standards Compliance helps to lower risk Compliance helps to improve the quality of work Compliance helps to mitigate potential penalties Compliance is a baseline. There hasn’t been a breach of data from a retailer that wasn’t compliance with the PCI DSS. Compliance is the first step in building maturity in process and Compliance provides standards. Standards allow us to perform our jobs more effectively and efficiently. By eliminating the number of variables that we have to deal with and setting a consistency across our processes and systems. Compliance helps to lower risk Compliance helps to improve the quality of work by helping to enforce a higher standard for operations Compliance helps to mitigate potential penalties. E.G. A hard drive is encrypted in order to comply with a policy. If lost, the data lost is not reportable. (HIPAA, MA 201 CMR 17, etc)

What Do We Need To Comply With? 4/22/2017 What Do We Need To Comply With? Depending on where you are within Harvard, you may need to comply with one or several of the following policies/standards: HIPAA FERPA PCI Massachusetts 201 CMR 17 Harvard Information Security Policy Harvard Research Data Security Policy Contractual Obligations Health Insurance Portability and Accountability Act Family Educational Rights and Privacy Act Payment Card Industries Data Security Standard (PCI DSS) MA 201 CMR 17 – protecting the PII of Mass residents HISP HRDSP Contractual obligations such as Data Use Agreements. Seen in research. Can supersede or exceed the requirements of other policies

What Can We Measure? Government Compliance Regulatory Compliance 4/22/2017 What Can We Measure? Government Compliance FISMA, NIST, DISA STIG, CERT Regulatory Compliance HIPAA, Sarbanes-Oxley (SOX), FERPA Corporate (Institutional) Governance, Risk, and Compliance (GRC) Institutional Policy, PCI, ISO 27001 And… Harvard Security Policy FEDERAL INFORMATION SECURITY MANAGEMENT ACT National Institute of Standards and Technology Defense Information Systems Agency Security Technical Implementation Guide Computer Emergency Readiness Team

How Is Measurement Accomplished? 4/22/2017 How Is Measurement Accomplished? Tenable Security Center Vulnerability Scanning Used to measure systems for vulnerabilities in Operating Systems and common applications Uses credentialed scans to unobtrusively log into systems to analyze patch status Tenable Security Center Compliance Scanning Uses industry standard or custom audit files to measure system configurations Uses credentialed scans to unobtrusively log into systems

4/22/2017 Audit Files

4/22/2017 Audit Files

4/22/2017 Audit Files

4/22/2017 Scan Policy

4/22/2017 Scan Policy

4/22/2017 Scan Policy

4/22/2017 Add a Compliance Scan

4/22/2017 Add a Compliance Scan

4/22/2017 Analyze The Results

4/22/2017 Analyze The Results

4/22/2017 Analyze The Results

4/22/2017 Analyze The Results

What Are The First Steps? 4/22/2017 What Are The First Steps? Measuring systems that store or process HRCI (PII) against 10 points of the HEISP: Private IP addressing Host-based firewall Vulnerability Scanning and Patching program External logging (Splunk) Active, up-to-date Anti-Virus software Unique credentials, default passwords changed, shared accounts disabled Password length and complexity Brute force credential lock-outs Logging of successful and unsuccessful login attempts

4/22/2017 What Are The Next Steps? Establish a process for ongoing compliance scanning, reporting and remediation Expand the service offering to comply with other regulatory standards HIPAA PCI Define standard build audit files to scan for deviation

4/22/2017 Questions

Joe Zurba | HUIT IT Security Presentation to Security Liaisons 4/22/2017 Thank you. Joe Zurba | HUIT IT Security Presentation to Security Liaisons Thank you slide May 23, 2013