Rob kloots auditingforscyandbcm
1 like303 views
This document discusses auditing security and business continuity. It begins with definitions of internal auditing, business continuity management, and related terms. It then covers topics like information security governance, access controls, user awareness, and dealing with IT system crashes. Standards and best practices for areas like availability, service continuity management, and incident response are presented. Finally, key sections of the ISO27001 standard related to auditing security and ensuring business continuity are highlighted.
Rob kloots auditingforscyandbcm
- 1. Auditing Security and Business Continuity Management Rob Kloots CISA CISM CRISC, Owner, TrustingtheCloud Berlin, June 2012 1
- 2. Content 2012 Risk Landscape Some definitions, models & standards Audit & Control Information security governance Administration of user access, passwords Access security controls Remote access and third parties User awareness How to deal with an IT system crash? What to do and how to continue? Auditing Security and Business Continuance 2
- 3. 2012 Risk Landscape PWC Global Internal Audit survey 2012: The risks ahead Intensifying economic and financial market uncertainty Increased regulation and changes in government policy Data security threats and reputation Mergers and acquisitions risks Auditing Security and Business Continuance 3
- 4. More attention required Auditing Security and Business Continuance 4
- 5. Importance of IA's contribution to monitoring each risk Auditing Security and Business Continuance 5
- 6. More IA audit capacity planned Auditing Security and Business Continuance 6
- 7. Definition of Internal Auditing The Definition of Internal Auditing states the fundamental purpose, nature, and scope of internal auditing. Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes. Auditing Security and Business Continuance 7
- 8. Definition of Business Continuity Management BCM is defined by the British Standards Institute (BSI) as: 'an holistic management process that identifies potential impacts that threaten an organisation and provides a framework for building resilience and the capability for an effective response that safeguards the interests of its key stakeholders, reputation brand and value creating activities'. Business Continuity is defined by the International Standards Organization as the: "capability of the organization to continue delivery of services or products at acceptable predefined levels following disruptive incidents"* *Source ISO 22300 Vocabulary Auditing Security and Business Continuance 8
- 9. Principles of ICT Continuity ProtectProtecting the ICT environment from ... DetectDetecting incidents at the earliest opportunity ... ReactReacting to an incident in the most appropriate manner ... RecoverIdentifying and implementing the appropriate recovery strategy will ensure the timely resumption of services and maintain the integrity of data. OperateOperating in disaster recovery mode until return to normal is possible may require some time and necessitate scaling up disaster recovery operations to support increasing business volumes that need to be serviced over time. ReturnDevising a strategy for every IT continuity plan allows an organization to migrate back from disaster recovery mode to a position in which it can support normal business. Auditing Security and Business Continuance 9
- 10. Business Continuity within Management Auditing Security and Business Continuance 10
- 11. BCP details BUSINESS CONTINUITY 2. BUSINESS ASSESSMENT PLANNING Risk Assessment 1. Project Foundation Information Protection 2. Business Assessment Protection 3. Strategy Selection Detection 4. Plan Development Response 5. Testing and Maintenance Business Impact Analysis (BIA) 1. PROJECT FOUNDATION 4. PLAN DEVELOPMENT Business Continuity Planning #1-Develop Response and Recovery Evaluation Teams Plan Management #2-Develop Draft Action Plan Business Impact Analysis #3-Prioritize Action Plan Execution Recovery Strategies #4-Document General Plan Sections Plan Development #5-Document the Technical Recovery Plan Maintenance Processes Plan Testing Auditing Security and Business Continuance 11
- 12. Basic terms used in a standard Business Continuity Management System (BCMS) part of an overall management system that takes care business continuity is planned, implemented, maintained, and continually improved Maximum Acceptable Outage (MAO) the maximum amount of time an activity can be disrupted without incurring unacceptable damage (also Maximum Tolerable Period of Disruption MTPD) Recovery Time Objective (RTO) the pre-determined time at which an activity must be resumed, or resources must be recovered Recovery Point Objective (RPO) maximum data loss, i.e., minimum amount of data that needs to be restored Minimum Business Continuity Objective (MBCO) the minimum level of services or products an organization needs to produce after resuming its business operations Auditing Security and Business Continuance 12
- 13. Trust Services Principles and Criteria Security - The system is protected against unauthorized access (both physical and logical). Availability - The system is available for operation and use as committed or agreed. Processing Integrity - System processing is complete, accurate, timely, and authorized. Online Privacy - Personal information obtained as a result of e- commerce is collected, used, disclosed, and retained as committed or agreed. Confidentiality - Information designated as confidential is protected as committed or agreed. Auditing Security and Business Continuance 13
- 14. Best Practices For IT Availability And Service Continuity Management 1) Classify systems for criticality. 2) Develop tiers of service for both availability and IT service continuity. 3) Measure availability from the end-user perspective. 4) Include availability and continuity considerations in application development and testing. Auditing Security and Business Continuance 14
- 15. Incident timeline Auditing Security and Business Continuance 15
- 16. BS25777 IT Continuity Auditing Security and Business Continuance 16
- 17. Information Risk Component The confidentiality, integrity and availability of information systems must be ensured to protect the business from the risks relating to information technology. An IS audit helps to identify areas where these are vulnerable or inadequately protected through systematic examination and evaluation. Every organization should have a business continuity plan that seeks to ensure that its information systems are available and running at all times to support and enable the business to function and grow. In spite of all precautions and preventive controls, disasters can occur. Approach to Auditing Business Continuity The audit of business continuity can be broken into three major components: Validating the business continuity plan Scrutinizing and verifying preventive and facilitating measures for ensuring continuity Examining evidence about the performance of activities that can assure continuity and recovery Auditing Security and Business Continuance 17
- 18. BIA focus Recovery Time Objective Target time set for resumption of product, service or activity delivery after an incident BS 25999:1 Maximum Tolerable Period of Disruption Duration after which an organisations viability will be irrevocably threatened if product and service delivery cannot be resumed BS 25999:1 Auditing Security and Business Continuance 18
- 19. Risks related to technology Auditing Security and Business Continuance 19
- 20. Information Assurance Structure Auditing Security and Business Continuance 20
- 21. Crash and Restart ISO 27001 Security Infosec governance Crash and Restart User awareness Remote access 3rd pty Access security ctls User access/pw Auditing Security and Business Continuance 21
- 22. Risk and Controls Business Continuity risk profile is prepared for each business function Controls are set to address risk, in consultation with the support / business function Weight are assigned to each control according to type of the control (e.g. A preventative control has the highest weight) Type of control Preventative Corrective Other entity Auditing Security and Business Continuance 22
- 23. Example of Risk and Control Risk: Electricity failure Controls: Uninteruptable power supply (UPS) Generators Preventive maintenance reports Auditing Security and Business Continuance 23
- 24. Fail a Security Audit Already -- it's Good for You Network World Failing an audit sounds like the last thing any company wants to happen. But that's because audits are seen by many as the goal of a security program. In reality, audits are only the means of testing whether enforcement of security matches the policies. In the broader context, though, an audit is a means to avoid a breach by learning the lesson in a "friendly" exercise rather than in the real world. If the audit is a stress-test of your environment that helps you find the weaknesses before a real attack, you should be failing audit every now and then. After all, if you're not failing any audits there are two possible explanations: 1) You have perfect security. 2) You're not trying hard enough. Auditing Security and Business Continuance 24
- 25. Your turn Questions ??? Rob Kloots CISA CISM CRISC, Owner, TrustingtheCloud E rob.kloots@trustingthecloud.eu M +32.499-374713 Auditing Security and Business Continuance 25
- 26. ISO27001 14. BCM Auditing Security and Business Continuance 26
- 27. ISO27001 11. AC Auditing Security and Business Continuance 27
- 28. ISO27001 11. ework Auditing Security and Business Continuance 28
- 29. ISO27001 6. EP Auditing Security and Business Continuance 29
- 30. ISO27001 8. HR Auditing Security and Business Continuance 30
- 31. ISO27001 8. HR Auditing Security and Business Continuance 31
- 32. ISO27001 9. PhySec Auditing Security and Business Continuance 32
- 33. ISO27001 10. 3rd pty Auditing Security and Business Continuance 33
- 34. ISO27001 10. Mon Auditing Security and Business Continuance 34
- 35. ISO27001 13. IncMgt Auditing Security and Business Continuance 35