Security Frameworks

Security Frameworks In this video, I'll go over some regulations, laws, and standards that impact an organization's security posture. I'll show you a few security frameworks and how they work with local, state, and international regulations. GDPR In May of 2018, the European Union instituted a far-reaching regulation that covered personal data protection. The General Data Protection Regulation, or GDPR, changed the way in which EU companies handled personal data. This regulation brought concepts like the right to be forgotten and the ability for individuals to demand accountability from companies for their personally identifiable information, or PII. This meant transparency in terms of how their PII is used and who the company can sell it to. The regulation was broad and applied to any companies doing business in the EU and any companies that had the personal data of an EU citizen. GDPR also required companies to update their privacy policies as well as their cookieuse policies. These terms had to be written in layman's terms for the user's benefit. No more legalese. It also required these policies to be easy to find. That's why you see pop-up windows about cookies and privacy when you go to many websites. Implementing the necessary changes cost many millions of dollars and non-compliance carries steep monetary penalties. National and State Laws GDPR was not the first law regarding privacy and network security. Countries like Russia, Japan, and Australia also have data privacy laws. In June of 2020, California implemented the California Consumer Privacy Act. Much like GDPR, the CCPA requires greater transparency from companies about any Californian's data. This trend of privacy laws is gathering momentum, and there are dozens of states working on their own versions. Let's not forget about HIPAA in the U.S. HIPAA has been around since 1996, with additions in 2013. This law covers protected health information, or PHI. Credit Card Industry Data-Security Standard PCI DSS is the standard that major credit card issuers require vendors to comply with if they accept credit cards. Unlike laws and regulations, PCI is a contractual obligation imposed by the credit card company. This obligation contains 12 major requirements that deal with network design and security policy implementation regarding data access. CIS The Center for Internet Security, or CIS, is a non-profit that offers free security tools to the business community. They offer benchmarks, threat-update controls, and hardened images. Benchmarks provide configuration guidelines to keep your network safe. CIS has benchmarks for operating systems, mobile devices, desktop software, network appliances, and even cloud providers. There are hundreds of benchmarks to choose from. Membership is free and so are the downloadable benchmarks. NIST The National Institute of Standards and Technology, or NIST, is one of the largest security frameworks with extensive publications on the topic of security. NIST's publications are used by the federal government and all its departments, including the Department of Defense. NIST's cybersecurity frameworks are the gold standard in our business, and they have numerous targeted frameworks within the cybersecurity realm. NIST has frameworks for cybersecurity, risk management, and privacy. Each of these areas fall under the security vertical and are critical to a solid cyber defense and contingency plan. The NIST security framework families are used to evaluate the security posture of government agencies as well as government vendors. Many private companies also use NIST as their standard for vendors since the standard is so robust. Whether a company needs guidance in security controls, compliance, cloud security, cryptography, access controls, or a myriad of other security-related topics, NIST has a publication for it. NIST 800-53 Rev. 5, for example, is the security and privacy controls standard for information systems and organizations. There are hundreds more. ISO The International Organization for Standardization, or ISO, is a worldwide organization that's currently the standardization body in 164 different countries. ISO 27001 is the publication that covers implementing and improving a security management system as well as an assessment guideline. Publication 27002 lays out guidelines for selecting and implementing security controls. NIST 31000 covers risk management as it pertains to business continuity, safety, environmental results, and professional reputation. ISO 27701 covers establishing, implementing, and improving a Privacy Information Management system. This is geared towards companies that need to comply with privacy laws and regulations. SSAE SOC Type II/III The System and Organization Controls, or SOC, is made up of controls. It has 3 types of reports that help a third party determine how a company is adhering to systems and controls through an audit. The types of SOC reports we discuss are Type II and Type III. SOC Type II reports focus on predetermined controls that are audited and a detailed report that attests to the audited company's compliance. Type II is a non-financial report about controls as they relate to processing, integrity, security, availability, confidentiality, and network privacy. Type III is a non-detailed report that attests to the company's compliance. This type of report is used for marketing and letting future partners know that the company has met compliance standards. Cloud Security Alliance The CSA is a relatively new, 10-year-old security framework. CSA stands for Cloud Security Alliace. With the exponential growth of cloud computing, the need for a cloud security framework was crucial. Along with best practices in cloud security, CSA also introduced the first cloud-centric individual certification. CSA works because it aggregates the best security practices from all business and educational verticals. This ensures that a company meets their individual framework needs with relevant and upto-date information. Cloud Control Matrix Within CSA, there's something called a cloud control matrix. This matrix is a guide to assist prospective cloud users in evaluating a cloud provider's security risk. This matrix also helps cloud providers integrate fundamental security principles into their services. It works with frameworks like NIST, ISO 27001, and ISO 27002.