WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:0 00:15.440 --> 00:16.880 All 00:30.960 --> 00:34.600 right, let's take a look at Module 5, which deals with network security 00:34.630 --> 00:38.440 controls, specifically administrative controls. 00:38.560 --> 00:46.020 One of our first considerations is how to comply with industry standard regulations. 00:46.050 --> 00:49.240 Regulatory frameworks compliance is 00:49.270 --> 00:55.180 required for organizations to comply with some type of imposed security regulation, 00:55.210 --> 01:01.900 be that a government regulation or be in an industry standard like PCI DSS. 01:01.930 --> 01:03.560 Compliance with frameworks is a 01:03.590 --> 01:06.820 collaborative effort between governments and private bodies 01:06.850 --> 01:11.340 to encourage voluntary or mandatory improvements to cybersecurity. 01:11.370 --> 01:13.900 So the whole idea with mandatory or 01:13.930 --> 01:18.080 standards is that they maintain consistency, that they're required. 01:18.110 --> 01:21.700 We're going to see that term pop up in our security policy discussion. 01:21.730 --> 01:25.380 And if everybody is following the prescribed mandates and standards, 01:25.410 --> 01:30.240 everybody's at the same level and we have a standard baseline of security. 01:30.270 --> 01:32.720 It security regulatory frameworks contain 01:32.750 --> 01:37.080 guidelines and best practices, standards, and we're going to lay out that 01:37.110 --> 01:40.920 whole policy hierarchy here in just a second. 01:41.400 --> 01:44.290 Regulatory frameworks compliance. 01:44.320 --> 01:46.340 First and foremost, 01:46.370 --> 01:49.980 you have the frameworks that dictate what you need to comply with. 01:50.010 --> 01:53.570 So one example would be PCI DSS. 01:53.600 --> 01:57.700 One of its requirements is to encrypt cardholder data. 01:57.730 --> 02:02.740 You would then draft a policy that would address these requirements. 02:02.770 --> 02:06.620 The policy example in this case would be encryption policy. 02:06.650 --> 02:11.960 So we'll talk about more types of policies later in the module, but we would write a 02:11.990 --> 02:15.960 policy that dictates the requirements, the purpose, the scope, etc. 02:15.990 --> 02:21.860 Within that policy will be recommendations or references to prescribed standards. 02:21.890 --> 02:24.730 The standards are mandatory activities. 02:24.760 --> 02:27.020 Now, the example they give you here 02:27.050 --> 02:31.440 is we do have standards like data encryption standard, advanced 02:31.470 --> 02:33.730 encryption standard, R vish Shemir Adelman. 02:33.760 --> 02:36.120 Those are well known industry standard 02:36.150 --> 02:39.890 types of protocols and encryption algorithms. 02:39.920 --> 02:43.980 The standard also refers to a mandatory or 02:44.010 --> 02:47.120 compulsory activity, which means you have to do it. 02:47.120 --> 02:48.920 The policy would say something along the 02:48.950 --> 02:54.240 lines of, The standard is that this data is encrypted using a standard like data 02:54.270 --> 02:58.980 encryption standard, advanced encryption standard, or R vish Shemir Adelman. 02:59.010 --> 03:03.520 Procedures practice to and guidelines are specifics. 03:03.550 --> 03:09.560 Operating procedures lay out step by step exactly how you accomplish a stated task. 03:09.590 --> 03:13.500 So the standard would be something along the lines of, we require encryption. 03:13.530 --> 03:16.160 The practice or the procedure would lay 03:16.190 --> 03:20.760 out the specifics of how encryption keys are stored, preserved, what types of 03:20.790 --> 03:23.700 software you're using to apply the algorithms, etc. 03:23.730 --> 03:28.700 Guidelines are generally more flexible and the rules of thumb. 03:28.730 --> 03:34.440 So rules of thumb give you some wiggle room, if you will, for the absence of a 03:34.470 --> 03:37.900 standard and recommendations to follow as best practices. 03:37.930 --> 03:41.340 So we have the policy brief, high level overview document. 03:41.370 --> 03:44.000 The policy lays out the specific 03:44.030 --> 03:47.520 requirements, the standards, mandatory compulsory activities. 03:47.550 --> 03:51.060 You've got to actually adhere to these standards. 03:51.090 --> 03:53.720 The uniform application of standards gives 03:53.750 --> 03:58.440 you a security baseline, which we hear baseline often used in the same discussion 03:58.470 --> 04:02.920 as policies and standards. And then the procedures, the specific step by step how 04:02.950 --> 04:07.820 tos and practices, and then guidelines, flexible or rules of thought. 04:07.850 --> 04:12.840 They're all interrelated and they're all part of the same hierarchy. 04:13.320 --> 04:15.610 Why organizations need compliance? 04:15.640 --> 04:18.980 A, to stay in business, to be allowed to continue to operate, 04:19.010 --> 04:23.920 and they improve security, minimize loss, and maintain trust. 04:23.950 --> 04:26.400 Improving security, there's hopefully a 04:26.420 --> 04:28.900 reason for the requirements in the standard. 04:28.920 --> 04:32.540 And the ultimate reason is to ensure or improve security. 04:32.570 --> 04:34.860 The standards are developed over time. 04:34.890 --> 04:38.100 They allow best practices, reasonable requirements. 04:38.130 --> 04:41.780 So by applying the standard in compliance, 04:41.800 --> 04:46.620 you should automatically get the benefit of improving security. 04:46.650 --> 04:50.620 Help to minimize losses, pretty self explanatory, and maintain trust. 04:50.650 --> 04:55.040 Customers will have a higher degree of confidence doing business with an 04:55.070 --> 05:01.340 organization that adheres to best practices, industry standards, etc. 05:01.360 --> 05:05.180 Identifying which regulatory framework to comply with. 05:05.210 --> 05:07.300 Start with the industry. 05:07.330 --> 05:12.320 I talk an awful lot about different regulations and different standards 05:12.340 --> 05:14.540 throughout all the security courses I teach. 05:14.570 --> 05:17.380 The first thing I recommend is don't dive 05:17.410 --> 05:20.980 too terribly deep into the details initially. 05:21.010 --> 05:24.640 So get an idea of the basics of the 05:24.660 --> 05:27.500 regulation and the industry that it applies to. 05:27.530 --> 05:29.920 Now you can dive into the various titles 05:29.950 --> 05:34.300 of HIPAA, for example, but that might be way too much detail, way too fast. 05:34.330 --> 05:36.840 So start off with, Hey, HIPAA deals with 05:36.860 --> 05:40.360 anybody that maintains health care information, period. 05:40.390 --> 05:42.680 And then worry about the details as they 05:42.710 --> 05:45.420 come up in additional discussions or as a review. 05:45.450 --> 05:49.420 So if I maintain health care information, 05:49.440 --> 05:52.940 I am subject to HIPAA compliance, and that is not just a doctor's office. 05:52.970 --> 05:54.960 That's insurance companies, business 05:54.980 --> 06:04.060 associates, employers, intermediaries, patient data processors, etc. 06:04.090 --> 06:05.780 Starbrain's Oxley. 06:05.800 --> 06:12.580 Any publicly traded company is required to comply with Starbrain's Oxley. 06:12.600 --> 06:17.120 This primarily deals with accuracy of accounting practices. 06:17.150 --> 06:19.500 Organizations within scope, 06:19.530 --> 06:24.380 US public company boards, management, public accounting firms. 06:24.410 --> 06:31.720 The whole reason we have Starbased and Xoxley is for the For the Enron scandal. 06:31.750 --> 06:34.600 If you remember that way back years ago, a 06:34.630 --> 06:40.380 lot of misreporting in Enron's accounting practices, and that led to one of the big 06:40.410 --> 06:43.700 five accounting firms going away at that point. 06:43.730 --> 06:46.400 Federal Information Security Management 06:46.420 --> 06:51.380 Act of 2002 or FISMA, deals with federal agencies. 06:51.410 --> 06:54.620 They must develop a method of protecting information systems. 06:54.650 --> 06:58.640 I always got FISMA confused with FRPA 06:58.670 --> 07:02.140 because they both started with F and ended with A. 07:02.170 --> 07:06.400 Something about the human brain is you book end the two letters at the beginning 07:06.420 --> 07:09.200 of a word and your brain fills in the middle. 07:09.230 --> 07:13.380 So for whatever reason, I used to get those two completely confused. 07:13.410 --> 07:19.420 Fisma is Federal Systems, FRPA is educational systems. 07:19.440 --> 07:21.860 And we'll mention that at some point during the course. 07:21.890 --> 07:24.360 But FRPA is any information held by an 07:24.390 --> 07:28.260 educational institution you have a right to actually review. 07:28.290 --> 07:31.260 Gramm leach Blyley deals with finance. 07:31.290 --> 07:35.740 Companies that offer financial products or services to individuals such as loans, 07:35.770 --> 07:38.900 financial or investment advice, or insurance. 07:38.920 --> 07:45.800 So that is protecting customer data for banking and mortgage lenders, etc. 07:45.830 --> 07:51.300 So if you work in the banking and finance industry, Gramm leach Blyley. 07:51.330 --> 07:53.840 Payment card industry data security 07:53.860 --> 07:58.260 standard, PCI DSS is actually not a regulatory law. 07:58.290 --> 08:02.140 It's a standard imposed by Mastercard and Visa. 08:02.170 --> 08:06.760 Anybody that participates in merchant transaction processing, which means any 08:06.790 --> 08:11.500 company handling credit card information, is subject to PCI compliance. 08:11.530 --> 08:16.860 Pci is a big driver for security testing and security assessments. 08:16.890 --> 08:20.820 Are deciding on how to comply to a regulatory framework. 08:20.850 --> 08:26.480 Now, you should generally have a team put together for regulatory compliance since 08:26.510 --> 08:30.340 it can be definitely a full time job and then some. 08:30.360 --> 08:32.400 When organization falls within the scope 08:32.430 --> 08:36.860 of certain regulatory framework, it needs to first off correctly interpret 08:36.880 --> 08:39.620 regulatory requirements and the framework to be complied with. 08:39.650 --> 08:45.040 When you read the standards and the regulation, it's not always really clear 08:45.060 --> 08:48.940 on exactly how you would protect cardholder data. 08:48.960 --> 08:52.580 So based on the requirements, you need to establish policies, procedures, and 08:52.610 --> 08:55.000 security controls to actually make it happen. 08:55.000 --> 08:56.740 They manage and maintain compliance. 08:56.770 --> 09:00.880 Now, they do give a couple of examples of PCI DSS, and I'm not going to get into a 09:00.910 --> 09:06.140 lot of the detail of the different specific criteria in PCI DSS. 09:06.170 --> 09:11.240 It does lay out things like approving and testing network, restricting 09:11.270 --> 09:14.740 and bound outbound traffic, and all of that requires a solution. 09:14.770 --> 09:19.320 Your policy would map the solution to the prescribed standard, and that's where you 09:19.350 --> 09:26.340 can benefit from the experience of an auditor or other architect or designer. 09:26.370 --> 09:29.280 A lot of times the compliance is 09:29.310 --> 09:32.860 outsourced to some an expert or consultant. 09:32.880 --> 09:34.640 All right, based on those regulatory 09:34.670 --> 09:39.060 requirements, establish your policies, procedures, and security controls. 09:39.080 --> 09:44.320 All right, a little bit on regulatory frameworks, laws, and acts. 09:44.350 --> 09:50.400 Pci, DSS, again, is imposed by Mastercard and Visa. 09:50.400 --> 09:52.440 Proprietary information security standard 09:52.470 --> 09:56.680 for organizations handling cardholder information for major debit credit, 09:56.700 --> 10:01.100 prepaid, ePers, ATM, point of sale cards, etc. 10:01.130 --> 10:04.340 All entities involved in payment card processing. 10:04.370 --> 10:07.620 Here are some of the specifics of PCI. 10:07.640 --> 10:09.440 Again, we're not going to dig too terribly 10:09.470 --> 10:13.880 deep into the details, but if you are participating in electronic transaction 10:13.910 --> 10:19.420 processing or your provider is, you're required to comply with PCI. 10:19.440 --> 10:22.860 Health Insurance Portability Accountability Act. 10:22.890 --> 10:25.100 Again, it deals with electronic 10:25.130 --> 10:30.240 transactions and code set standards, privacy rule, security rule, national 10:30.270 --> 10:33.260 identity requirements, and the enforcement rule 10:33.280 --> 10:36.840 requires all health care providers, health plans, and employers have standard 10:36.870 --> 10:40.220 national numbers that identify them to attach standard transactions. 10:40.240 --> 10:43.600 Security rule series of administrative, physical, and technical safeguards, which 10:43.600 --> 10:47.020 we'll be talking about in several examples of those for all covered entities. 10:47.040 --> 10:50.740 Federal protections for personal health information by covered entities, etc. 10:50.770 --> 10:53.440 Again, don't worry too much about picking 10:53.470 --> 10:56.180 up every detail, every nuance in the first pass. 10:56.200 --> 10:57.720 Get a general feel for the industry that 10:57.750 --> 11:01.720 applies to and a general feel for some of the requirements. 11:02.280 --> 11:04.380 Let's start with OXley. 11:04.410 --> 11:06.880 Again, protecting investors in public by 11:06.910 --> 11:10.660 increasing the accuracy and reliability of corporate disclosures. 11:10.690 --> 11:12.920 Comes in three titles, title 1, title 2, 11:12.950 --> 11:17.420 title 3, dealing with public company accounting oversight board, 11:17.450 --> 11:20.700 auditor independence, and corporate responsibility. 11:20.730 --> 11:23.080 And again, that comes in the wake of the 11:23.110 --> 11:31.000 Enron scandal years ago with a huge in accuracy in Enron's accounting practices. 11:31.080 --> 11:35.660 The Gramm Leach Bliley Act, again, is meant for financial institutions. 11:35.690 --> 11:38.720 The objective was to ease the transfer of 11:38.750 --> 11:43.320 financial information between institutions and banks while making the rights of the 11:43.350 --> 11:46.900 individual more specific through security requirements. 11:46.930 --> 11:52.360 Key points, protecting customers or consumers' personal financial inspiration 11:52.390 --> 11:56.860 held by financial institutions and their service providers subject to 11:56.890 --> 12:03.200 a civil penalty of not more than $10,000 for each violation. 12:04.560 --> 12:07.120 The General Data Protection Regulation. 12:07.150 --> 12:08.940 This is one of the more stringent 12:08.970 --> 12:15.140 standards and it deals with organizations doing business in Europe. 12:15.170 --> 12:19.060 One of the most stringent privacy and security laws globally. 12:19.080 --> 12:22.640 Levy's harsh fines against those who violate its privacy and security 12:22.670 --> 12:26.500 standards, penalties reaching tens of millions of euros. 12:26.530 --> 12:32.620 The protection principles are lawfulness, fairness and transparency, 12:32.650 --> 12:38.420 purpose limitation, data minimization, accuracy, storage limitation, 12:38.450 --> 12:41.860 integrity and confidentiality, and then accountability. 12:41.890 --> 12:47.360 Now, prior to this, there are some unknowns, how organizations are collecting 12:47.390 --> 12:51.040 your data, how they're using your data, whether they're discarding it or 12:51.070 --> 12:56.320 destroying it when it's no longer needed, whether that data can be portable, right 12:56.350 --> 12:59.300 to be forgotten, and a bunch of other concerns. 12:59.330 --> 13:03.340 So GDPR went into effect on May 25, 2018, 13:03.370 --> 13:08.160 and is again one of the most stringent standards. 13:08.190 --> 13:12.160 Privile and security law is globally, and we're seeing some other types of 13:12.190 --> 13:17.100 regulations follow suit with the initial implementation of GDPR. 13:17.130 --> 13:24.180 The Data Protection Act of 2018, this is actually another UK or European law. 13:24.200 --> 13:27.400 It's an act to make the provision for the regulation of the processing of 13:27.400 --> 13:30.680 information related to individuals, provision in connection with the 13:30.710 --> 13:34.900 information commissioners functions under specific regulations, and to make 13:34.930 --> 13:39.780 provision for a direct marketing code of practice and connected purposes. 13:39.810 --> 13:41.620 All right, protects individuals 13:41.650 --> 13:45.480 concerning the processing of personal data, requiring data to be processed 13:45.510 --> 13:49.100 lawfully and fairly, conferring the rights on the data subject, 13:49.120 --> 13:52.320 and conferring functions on the Commissioner, giving the holder of that 13:52.350 --> 13:56.640 office responsibility to monitor and enforce their provisions. 13:57.520 --> 13:59.860 Iso standards. 13:59.890 --> 14:02.560 Anytime I see a table like this, the first 14:02.580 --> 14:06.120 thing my brain does is say, Is this testable? 14:06.150 --> 14:08.060 Do I have to memorize this? 14:08.080 --> 14:11.000 The answer to that is in a testing 14:11.030 --> 14:16.260 situation, you will most likely run into ISO standards. 14:16.290 --> 14:21.840 Memorizing the entire list might be a little bit more 14:21.880 --> 14:26.180 initiative or effort than is required at the beginning, but you don't want to be 14:26.210 --> 14:32.320 familiar with things like 27001, 27002, 9660, 13490. 14:32.350 --> 14:37.720 These are all things just off the top of my head that have stuck for specific 14:37.750 --> 14:44.300 standards like CDRs or multi session support or organizational security models. 14:44.330 --> 14:47.180 There's tons of ISO standards out there. 14:47.210 --> 14:53.000 The standards are relating to pretty much anything globally. 14:53.030 --> 14:55.600 It could be information systems, it could 14:55.630 --> 15:01.340 be physical standards for device manufacturing, etc. 15:01.360 --> 15:02.680 Lots of standards out there. 15:02.710 --> 15:06.500 This table looks a little bit overwhelming. 15:06.530 --> 15:09.340 When you're preparing for your exams, just 15:09.360 --> 15:13.220 take note of what you see in your practice test questions and things like that. 15:13.250 --> 15:15.940 That should typically highlight 15:15.970 --> 15:18.780 the standards you're going to need to commit to memory. 15:18.810 --> 15:21.280 But every certification exam, to some 15:21.310 --> 15:25.460 degree, has some memorization involved, no doubt about it. 15:25.490 --> 15:27.740 Now, certain things like port numbers, 15:27.760 --> 15:29.740 that serves you well to have that memorized. 15:29.770 --> 15:32.240 But memorizing all the ISO standards, you 15:32.270 --> 15:37.740 might have bigger fish to fry as far as expanding your mental energy. 15:37.770 --> 15:40.000 The DMCA, Digital Millennium Copyright 15:40.030 --> 15:46.420 Act, is meant to enforce violations of digital copyright law. 15:46.450 --> 15:49.540 When you willfully and purposely defeat 15:49.570 --> 15:53.060 digital copy protection mechanisms, you're in violation of DMCA. 15:53.080 --> 15:57.480 When you share software you haven't paid for or music you haven't paid for or 15:57.510 --> 16:02.300 original works of authorship you haven't paid for, you're in violation of DMCA. 16:02.330 --> 16:06.280 So it defines legal prohibitions against the circumvention of technological 16:06.310 --> 16:12.480 protection measures employed by copyright owners to protect their works. 16:12.480 --> 16:14.880 Fisma, Federal Information Security Management Act. 16:14.910 --> 16:17.000 Now, again, I laid out the basic 16:17.030 --> 16:22.400 definitions of most of these on the lead in slide, but FISMA is a comprehensive 16:22.430 --> 16:26.480 framework, ensuring the effectiveness of information security controls over 16:26.510 --> 16:30.900 information resources that support federal operations and assets. 16:30.930 --> 16:35.360 That's pretty self explanatory, federal systems. 16:36.360 --> 16:40.140 Again, like everything else, it gives us 16:40.170 --> 16:42.620 standards, guidelines, and recommendations. 16:42.640 --> 16:44.680 Standards, remember, are always compulsory. 16:44.710 --> 16:48.380 You have to comply or there's some consequence. 16:48.410 --> 16:53.300 Guidance is often given through guidelines, which is flexibility. 16:53.330 --> 16:57.960 You'll see those standards and guidelines or recommendations come up over and over 16:57.990 --> 17:02.780 in these different discussions on compliance and regulation. 17:02.800 --> 17:04.960 A nd other information, security acts and laws. 17:04.990 --> 17:10.040 Couple of notables, USA Patriot Act of 2001. 17:10.070 --> 17:13.200 Now, this relaxed a lot of the 17:13.230 --> 17:19.200 restrictions on eaves dropping on communications and monitoring in the 17:19.230 --> 17:23.420 interests of national security in the wake of 911. 17:23.450 --> 17:29.620 Typically, when there is a suspension of a right for a temporary period, 17:29.650 --> 17:33.640 almost invariably, that temporary period gets drawn out longer and longer and 17:33.670 --> 17:37.940 longer, and eventually temporary is no longer temporary, it's permanent. 17:37.970 --> 17:42.460 Here in the United States, for example, we have certain rights 17:42.490 --> 17:47.080 that are provided to us through our US Constitution, and infringement on those 17:47.110 --> 17:54.080 rights can actually take place in the form of legal regulation, law, and so forth. 17:54.110 --> 17:57.040 The idea with the Patriot Act was that you 17:57.070 --> 18:00.000 didn't have an expectation of privacy, etc. 18:00.030 --> 18:04.040 Our fourth amendment here in the United States says I have a reasonable 18:04.070 --> 18:06.560 expectation of privacy and my domicile, etc. 18:06.590 --> 18:08.900 I don't know the verbiage directly to 18:08.930 --> 18:14.140 quote, but they just can't listen in for any old reason anytime they please. 18:14.170 --> 18:16.420 In the wake of 911, 18:16.440 --> 18:19.800 we had a lot of relaxing of that requirement for monitoring communications. 18:19.800 --> 18:22.680 I'm getting on a bit of a soapbox here, so I'll step off of it. 18:22.710 --> 18:25.280 But when this temporary legislation goes 18:25.310 --> 18:29.160 into place, it's supposed to have a sunset clause, and here we are. 18:29.190 --> 18:34.320 911 was a little over 20 years ago, and a lot of that stuff is still in force. 18:34.350 --> 18:35.810 Just saying. 18:35.840 --> 18:39.640 The Human Rights Act of 1998, not real notable. 18:39.670 --> 18:42.530 Freedom of Information Act directly 18:42.560 --> 18:47.860 relates to information being available through a written request. 18:47.890 --> 18:52.200 The Electronic Communications Privacy Act, this is pretty important historically. 18:52.230 --> 18:55.000 This equated electronic communications to 18:55.030 --> 18:59.160 the same expectation of privacy that you had with voice communications. 18:59.190 --> 19:04.080 Long story short, when you require a wire tap to listen on a phone call, ECPA 19:04.110 --> 19:09.250 requires a similar court order to listen in on your electronic communications. 19:09.280 --> 19:11.480 Freedom of Information Act, 2000. 19:11.480 --> 19:13.360 Again, we got a couple of variants of that. 19:13.360 --> 19:17.040 The computer fraud and abuse act, that definitely deserves an honorable mention. 19:17.070 --> 19:19.320 That is United States Code Title 18, 19:19.350 --> 19:23.800 Section 1030, which is our primary federal anti hacking statute. 19:23.830 --> 19:26.560 Now that was amended through a couple of 19:26.590 --> 19:31.960 versions to allow for writing malware and systems of infrastructure. 19:31.990 --> 19:35.880 But that was one of our most notable anti hacking statutes.