Lumension LCRM - DSS @Vilnius 2010
0 likes267 views
This document discusses challenges organizations face in managing compliance with various information security regulations. It proposes a standardized compliance and control framework called the Unified Compliance Framework (UCF) that would assess technical and procedural controls, integrate with security tools, automate compliance workflows, and provide consolidated compliance reporting. This would help organizations improve visibility into their risk posture, prioritize remediation efforts, and manage compliance over time more efficiently.
![Standardized Compliance & Control Framework [UCF]](https://image.slidesharecdn.com/6149771/85/Lumension-LCRM-DSS-Vilnius-2010-12-320.jpg)
Lumension LCRM - DSS @Vilnius 2010
- 1. From Data Theft to … Compliance & Risk Management! PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
- 2. … Agenda 2 PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
- 3. …Agenda 3 PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
- 4. …just a simple pricelist ? 4 PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
- 5. …active measures against card fraud 5 PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
- 6. PCI DSS, PA DSS, 27001, CoBiT, NERC, Basel II, SOX, ... … … …
- 7. Mounting External Compliance Regulations 3 out 4 organizations must comply with two or PII Security Standards more regulations and corresponding audits. Sarbanes-Oxley, Section 404 43% of organizations comply with 3 or more PCI Data Security PCI Data Security Standards (DSS) Standards (DSS) regulations. Basel II Basel II SB1386 SB1386 SB1386 (CA Privacy Act) (CA Privacy Act) (CA Privacy Act) USA Patriot Act USA Patriot Act USA Patriot Act USA Patriot Act Gramm Leach Gramm Leach Gramm Leach Gramm Leach Gramm Leach Bliley (GLBA) Bliley (GLBA) Bliley (GLBA) Bliley (GLBA) Bliley (GLBA) 21CFR11 21CFR11 21CFR11 21CFR11 21CFR11 21CFR11 HIPAA HIPAA HIPAA HIPAA HIPAA HIPAA HIPAA EU Directive EU Directive EU Directive EU Directive EU Directive EU Directive EU Directive EU Directive *The Struggle to Manage Security Compliance for Multiple Regulations”..SecurityCompliance.com Time 7 PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
- 8. Today Organizations Spend 30-50% More On Compliance Than They Should Our IT Networks Were Never Designed With Compliance In Mind
- 9. Compliance & IT Risk Management Challenges ry ulato f Reg La ck o wledge Kno HIPAA Excel SOX Database Business Security Processes Policy PCI Manual IT Surveys Resources Password Length Special Characters Non Standardized Processes Functional Silos Disparate Data Collection 9 PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
- 10. Challenges in Compliance and Risk Management Business Interests Auditor Stakeholders
- 11. Data Collection
- 12. Standardized Compliance & Control Framework [UCF]
- 13. Assess Technical Controls: Automatically assess technical controls through integration to Lumension and 3rd party tools Procedural & Physical Controls: Utilize automated workflow based surveys 13 PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
- 14. Standardized & IT Risk Mgmt. Framework Regulation Authority Documents GLBA PCI FISMA HIPAA NHS NERC SOX ISO/IEC… Business Interests Corporate Policies Business Processes Revenue Streams Trade Secrets IT Assets Profile Risk Attributes Open to the Internet Contains Credit Card Information Contains Customer Data Applicable Controls Pass/Fail Regulation Assessment Password Length Data Encryption Power Save Corp-Policy ISO 27001 PCI NERC 100% 65% 65% 30%
- 15. Automation of Assessment Data Consolidated Assessment Data supports a holistic view of compliance and IT risk posture Technical Controls Procedural & Physical Controls Automated Connectors Automated Assessment Workflow Lumension Lumension 3rd Party Patch, Scan & Application & Web-Based Auditor / Analyst Products Surveys Attestation Configuration Device Control 15 PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
- 16. Connector … 16 PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
- 17. Connector … 17 PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
- 18. Connector … 18 PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
- 19. Connector … 19 PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
- 20. Remediate Remediate: Prioritize remediation efforts based on impact to overall organizational IT risk & compliance posture 20 PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
- 21. Manage Manage: Create operational and strategic visibility across compliance, IT risk postures 21 PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
- 22. Identify…and it starts again
- 23. Adaptation
- 24. Lumension Risk Manager - summary Give you better visibility into your compliance and risk posture. Help you save time & money in your security management process. 24 PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
- 25. Global Headquarters 15880 N. Greenway-Hayden Loop Suite 100 Scottsdale, AZ 85260 1.888.725.7828 info@lumension.com thomas.wendrich@lumension.com www.lumension.com/itgrc-software