1. ComplyCORE: Why didn’t I think of that?
Jason Hill, Director of Strategic Services, Cybriant
CISA, CISSP
15 years experience
Managed SIEM, Endpoint protection, Identity Management
vCISO, Vulnerability & Pentesting, Risk Assessments

2. COMING UP The current process is broken
Firefighting is not a solution
Each audit creates chaos
There are more and more compliance headaches every year
New regulations - GDPR, GLBA
Changes to existing
What if there were a better way?
Roll with the punches
New regulations are absorbed easily
Don’t over explain!

3. CURRENT STATE Step 1 Step 2 Step 3 Step 4 Step 5 Ignore Panic
Go through each and every requirement
Step 4
Apply every requirement to environment
Step 5
Update policies and procedures
CURRENT STATE

4. CURRENT STATE Step 6 Step 7 Step 8 Step 9 Remediate
Act as cool as Jar Jar during battle
Step 8
Undergo audit
Step 9
Repeat
CURRENT STATE

5. REGULATION ROULETTE GDPR, PCI, HIPAA, GLBA, etc.
The alphabet soup of compliance is getting thicker and thicker
Regulatory oversight is ever increasing
With each publicized breach more attention is drawn to security
There doesn’t seem to be any reprieve in sight
Each compliance framework exists in a bubble
Each framework assumes no security in place
Seemingly conflicting requirements
State by state instead of federal rules
265+ bills or resolutions: National Conference of State Legislatures

6. THERE HAS GOT TO BE A BETTER WAY!
There is!
1. Establish the Framework
4. Additional Compliances
2. Deploy Framework
5. Maintain
This is just an overview, KISS
6. Rinse & Repeat
3. Remediate

7. ESTABLISH THE FRAMEWORK
Many to chose from: NIST, PCI, COBIT, ISO, and on and on
Why NIST?
Used by every branch of government
Plenty of documentation
Required for anyone dealing with government data
NIST is adaptable
– 109 security controls
– 212 security controls
Cybersecurity Framework or Risk Management Framework 

8. DEPLOY THE FRAMEWORK Determine risk tolerance
Perform risk assessment / gap analysis based on your framework
Identify missing documentation and security controls
Establish compensating controls
Remediate 

9. ADDITIONAL COMPLIANCES
Identify overlap
Perform gap-analysis on remainder
Identify missing documentation and security controls
Establish compensating controls
Remediate 

10. MAINTAIN Perform risk assessments yearly or on major changes
Make security practices part of the change management process
Constantly stay up to date on latest industry and regulatory changes
Test security controls
Train employees on security plan
Make adjustments to security plan regularly based on the above 

11. CONCLUSION Welcome to your inner Han. There is a better way
Establish the framework
Deploy framework
Remediate
Additional compliances
Maintain
Rinse & Repeat

12. ANY QUESTIONS? Jason Hill, Director of Strategic Services, Cybriant
CISA, CISSP