1. Measuring Compliance with Tenable Security Center
Joe Zurba | HUIT IT Security Presentation to FAS Security Liaisons May 23, 2013

2. Agenda: What is compliance and why is it important?
4/22/2017
Agenda:
What is compliance and why is it important?
What do we need to comply with?
What can we measure?
How is measurement accomplished?
What are the first steps?
What are the next steps?
Questions

3. What is Compliance? com·pli·ance
4/22/2017
What is Compliance?
com·pli·ance
/kəmˈplīəns/
Noun
1. The action or fact of complying with a wish or command.
2. The state or fact of according with or meeting rules or standards.
Synonyms
agreement - consent - accord - accordance - conformity
Compliance means conforming to a rule, such as a specification, policy, standard or law.
Dictionary definition of compliance….
Perhaps, the definition that is more salient to this presentation is…

4. Why is Compliance Important?
4/22/2017
Why is Compliance Important?
Compliance provides a baseline posture from which we can build more mature process and controls
Compliance provides standards
Compliance helps to lower risk
Compliance helps to improve the quality of work
Compliance helps to mitigate potential penalties
Compliance is a baseline. There hasn’t been a breach of data from a retailer that wasn’t compliance with the PCI DSS. Compliance is the first step in building maturity in process and
Compliance provides standards.
Standards allow us to perform our jobs more effectively and efficiently. By eliminating the number of variables that we have to deal with and setting a consistency across our processes and systems.
Compliance helps to lower risk
Compliance helps to improve the quality of work by helping to enforce a higher standard for operations
Compliance helps to mitigate potential penalties. E.G. A hard drive is encrypted in order to comply with a policy. If lost, the data lost is not reportable. (HIPAA, MA 201 CMR 17, etc)

5. What Do We Need To Comply With?
4/22/2017
What Do We Need To Comply With?
Depending on where you are within Harvard, you may need to comply with one or several of the following policies/standards:
HIPAA
FERPA
PCI
Massachusetts 201 CMR 17
Harvard Information Security Policy
Harvard Research Data Security Policy
Contractual Obligations
Health Insurance Portability and Accountability Act
Family Educational Rights and Privacy Act
Payment Card Industries Data Security Standard (PCI DSS)
MA 201 CMR 17 – protecting the PII of Mass residents
HISP
HRDSP
Contractual obligations such as Data Use Agreements. Seen in research. Can supersede or exceed the requirements of other policies

6. What Can We Measure? Government Compliance Regulatory Compliance
4/22/2017
What Can We Measure?
Government Compliance
FISMA, NIST, DISA STIG, CERT
Regulatory Compliance
HIPAA, Sarbanes-Oxley (SOX), FERPA
Corporate (Institutional) Governance, Risk, and Compliance (GRC)
Institutional Policy, PCI, ISO 27001
And…
Harvard Security Policy
FEDERAL INFORMATION SECURITY MANAGEMENT ACT
National Institute of Standards and Technology
Defense Information Systems Agency Security Technical Implementation Guide
Computer Emergency Readiness Team

7. How Is Measurement Accomplished?
4/22/2017
How Is Measurement Accomplished?
Tenable Security Center Vulnerability Scanning
Used to measure systems for vulnerabilities in Operating Systems and common applications
Uses credentialed scans to unobtrusively log into systems to analyze patch status
Tenable Security Center Compliance Scanning
Uses industry standard or custom audit files to measure system configurations
Uses credentialed scans to unobtrusively log into systems

8. 4/22/2017
Audit Files

9. 4/22/2017
Audit Files

10. 4/22/2017
Audit Files

11. 4/22/2017
Scan Policy

12. 4/22/2017
Scan Policy

13. 4/22/2017
Scan Policy

14. 4/22/2017
Add a Compliance Scan

15. 4/22/2017
Add a Compliance Scan

16. 4/22/2017
Analyze The Results

17. 4/22/2017
Analyze The Results

18. 4/22/2017
Analyze The Results

19. 4/22/2017
Analyze The Results

20. What Are The First Steps?
4/22/2017
What Are The First Steps?
Measuring systems that store or process HRCI (PII) against 10 points of the HEISP:
Private IP addressing
Host-based firewall
Vulnerability Scanning and Patching program
External logging (Splunk)
Active, up-to-date Anti-Virus software
Unique credentials, default passwords changed, shared accounts disabled
Password length and complexity
Brute force credential lock-outs
Logging of successful and unsuccessful login attempts

21. 4/22/2017
What Are The Next Steps?
Establish a process for ongoing compliance scanning, reporting and remediation
Expand the service offering to comply with other regulatory standards
HIPAA
PCI
Define standard build audit files to scan for deviation

22. 4/22/2017
Questions

23. Joe Zurba | HUIT IT Security Presentation to Security Liaisons
4/22/2017
Thank you.
Joe Zurba | HUIT IT Security Presentation to Security Liaisons
Thank you slide
May 23, 2013