1. Risk Mitigation & Incident Response Week 12

2. Getting close to the end
House keeping items
Getting close to the end
Thanksgiving – Week 13
No quiz November 24th or 25th
DR and Business Continuity – Week 14
Add WebEx meet-up on November 27th?
Maturity Models / Wrap-up – Week 15
Audit project due Dec 4 – week 15
Final Exam – Canvas (75 questions), Tuesday, 12/18

3. Comprehensive security: elements from three frameworks

4. Security Governance Tree

5. Clear distinction IT Security Information Security
Concerned with building secure and reliable platforms
Concerned with the control of information; electronic or physical

6. Gartner’s Security Processes You Must Get Right
Security’s Responsibility
Security Governance
Policy Management
Awareness & Education
Identity & Access Management
Vulnerability Management
Incident Response
IT’s Responsibility
Change Management
Disaster Recovery & Business Continuity
Project Life Cycle Management
Vendor Management
Information security governance consists of the functions and processes that ensure that the right actions are taken to balance the needs to protect the organization against the needs to run the business.
Security policies define and document the enterprise's established position about the security risks that must be controlled to meet the risk appetite of the business, which will ultimately fund security controls and bear any residual risk.
Enlightened awareness is achieved in part through education and aids in reshaping enterprise cultures that do not fully understand or appreciate the impact that inadequate security can have on all other IT and business processes.
IAM is the systematic management of a user's identities and access throughout the life cycle of his or her engagement with the organization.
This is the process of identifying, assessing and resolving security weaknesses in the enterprise. Often, the focus is on the organization's technical infrastructure; however, the CISO must also be alert to vulnerabilities in process weaknesses and other common staff practices.
It is therefore critical for the security organization to have a well-documented incident response process that has been successfully (and, if possible, repeatedly) exercised prior to an actual incident.
Getting change management right is critical to the enterprise's ability to execute changes in a controlled and auditable manner.
Their purpose is to ensure that, in the event of a serious disruption to the enterprise, business operations can continue, and systems and processes can recover in a considered and orderly manner.
To avoid introducing serious, expensive and possibly immutable security risks into the enterprise, it is critical to ensure that phase gate reviews include formal assessments of project documentation, with sign-off approvals from the security organization with regard to the architecture, design and any other relevant artifacts, such as postoperational plans.
The vendor's processes must incorporate the enterprise client's security requirements in a way that extends beyond unrealistic promises from the vendor, which amount to little action and less visibility.

7. Gartner’s Security Processes You Must Get Right
Security’s Responsibility
Security Governance
Policy Management
Awareness & Education
Identity & Access Management
Vulnerability Management
Incident Response
IT’s Responsibility
Change Management
Disaster Recovery & Business Continuity
Project Life Cycle Management
Vendor Management
Information security governance consists of the functions and processes that ensure that the right actions are taken to balance the needs to protect the organization against the needs to run the business.
Security policies define and document the enterprise's established position about the security risks that must be controlled to meet the risk appetite of the business, which will ultimately fund security controls and bear any residual risk.
Enlightened awareness is achieved in part through education and aids in reshaping enterprise cultures that do not fully understand or appreciate the impact that inadequate security can have on all other IT and business processes.
IAM is the systematic management of a user's identities and access throughout the life cycle of his or her engagement with the organization.
This is the process of identifying, assessing and resolving security weaknesses in the enterprise. Often, the focus is on the organization's technical infrastructure; however, the CISO must also be alert to vulnerabilities in process weaknesses and other common staff practices.
It is therefore critical for the security organization to have a well-documented incident response process that has been successfully (and, if possible, repeatedly) exercised prior to an actual incident.
Getting change management right is critical to the enterprise's ability to execute changes in a controlled and auditable manner.
Their purpose is to ensure that, in the event of a serious disruption to the enterprise, business operations can continue, and systems and processes can recover in a considered and orderly manner.
To avoid introducing serious, expensive and possibly immutable security risks into the enterprise, it is critical to ensure that phase gate reviews include formal assessments of project documentation, with sign-off approvals from the security organization with regard to the architecture, design and any other relevant artifacts, such as post operational plans.
The vendor's processes must incorporate the enterprise client's security requirements in a way that extends beyond unrealistic promises from the vendor, which amount to little action and less visibility.

8. Incident Response Preparation Detect and Expose Triage
Classify and Contain
Remediate
Report and Post-Mortem
Preparation – more the better – create a response process with clear roles – test it using tabletop exercises with the people who will be performing the roles – know where all your sensitive data is located and what you have done to protect it. Employ standard precautions: inventory sensitive data, patch all your systems, test vulnerabilities, implement the full process, test often
SANS APRIL 3 & 7 FEDERAL AGENCY RESPONSE INADEQUATE 65% OF THE TIME – KEY FINDING, NOT ENOUGH PRACTICE
Detect and Expose – Given high number of attacks automate your detection process and work the data
Triage – Scope the threat and identify the greatest exposure risks – this is where the map of sensitive data provides a great starting point
Classify and Contain – cyber forensics team looks to contain the intrusion – how to eradicate malware
Remediate – remove malware, survey what has been breached
Report and Post-Mortem – public statements in accordance with law, etc. – take additional remediation steps – conduct a post mortem and focus on lessons learned.

9. The iPremier Case Take 30 minutes
How well did the iPremier Company perform during the seventy-five minute attack? If you were Bob Turley, what might you have done differently during the attack?
The iPremier Company CEO, Jack Samuelson, had already expressed to Bob Turley his concern that the company might eventually suffer from a “deficit in operating procedures.” Were the company’s operating procedures deficient in responding to this attack? What additional procedures might have been in place to better handle the attack?
Now that the attack has ended, what can the iPremier Company do to prepare for another such attack?
In the aftermath of the attack, what would you be worried about? What actions would you recommend?