Compliance-driven Security Requirements Warzaw Oct 2010

Compliance-driven Security Requirements Warzaw 12 Oct 2010 10-10-13 [email_address] Bengt Berg, M.Sc, CISM, CISSP, QSA, ... Head of Compliance Management Services Cybercom Sweden East AB

[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],So... Who’s Talking? 10-10-13 [email_address]

External Compliance Requirements 10-10-13 [email_address] Sarbanes-Oxley Act ISO/EIC 27001:2006 CE certification FDA/Part11 Basel3 Public Sector Procurement Laws ISO 14001 PCI DSS, Payment Card Industry Data Security Standard,

How PCI DSS has Transformed the Payment Security Area 10-10-13 [email_address]

PCI DSS 10-10-13 [email_address] Brands Bank PSP Merchant Solution vendor Service provider PA-QSA PTS PFI QSA ASV

But What are These Requirements? 10-10-13 [email_address] Requirement 1: Install and maintain a firewall configuration to protect cardholder data Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters Requirement 3: Protect stored cardholder data Requirement 4: Encrypt transmission of cardholder data across open, public networks Requirement 5: Use and regularly update anti-virus software Requirement 6: Develop and maintain secure systems and applications Requirement 7: Restrict access to cardholder data by business need-to-know : Requirement 8 Assign a unique ID to each person with computer access Requirement 9: Restrict physical access to cardholder data Requirement 10: Track and monitor all access to network resources and cardholder data Requirement 11: Regularly test security systems and processes Requirement 12: Maintain a policy that addresses information security ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Initial Backlashes 10-10-13 [email_address]

Response From Product Suppliers and Consultancy Companies 10-10-13 [email_address]

[object Object],[object Object],[object Object],[object Object],What Results Have Been Achieved? 10-10-13 [email_address] Investments in IS/IT Security

[object Object],What Results Have Been Achieved? 10-10-13 [email_address]

[object Object],[object Object],What Results Have Been Achieved? 10-10-13 [email_address] Brands Bank PSP Merchant Solution vendor Service provider QSA ASV

Emerging Methods for Managing External Compliance Requirements 10-10-13 [email_address]

[object Object],[object Object],[object Object],[object Object],[object Object],Emerging methods 10-10-13 [email_address]

[object Object],[object Object],Portal Solutions for Compliance Management 10-10-13 [email_address]

Use of Issue Management Systems 10-10-13 [email_address] 27 workflows neccessary to implement ISO 27001 Report Incident Incident response team Webb team Network team H/R Closed Incidents CISO

Use of Issue Management Systems 10-10-13 [email_address]

All Documentation in Wiki format ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],10-10-13 [email_address]

All Documentation in Wiki format 10-10-13 [email_address]

Trend-oriented tests 10-10-13 [email_address]

[object Object],Conclusions 10-10-13 [email_address] New compliance-oriented business models Will always benefit the outsourcing providers The leader gets a competitive advantage Rational methods decrease investment Success depends on the governance framework Nobody wants to be a problem for their customer

Compliance-driven Security Requirements Warzaw Oct 2010

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (20)

Similaire à Compliance-driven Security Requirements Warzaw Oct 2010

Similaire à Compliance-driven Security Requirements Warzaw Oct 2010 (20)

Compliance-driven Security Requirements Warzaw Oct 2010

Notes de l'éditeur