Date post: | 05-Dec-2014 |
Category: |
Documents |
Upload: | bill-lisse |
View: | 619 times |
Download: | 1 times |
What you don’t know about IT Controls can cripple your business
“Yep, son, we have met the enemy and he is us.”
- Pogo, 1971
Presented by:
Bill Lisse, CISSP, GIAC PCI, GIAC HIPAA, SSCA, Security+ SME
IT Audit Manager
“Only 1 of 10 firms are
leveraging Information
Technology (IT)
compliance (Controls)…
that could help mitigate
financial risk from lost or
stolen data.”
Source: ITpolicycompliance.com. IT Policy Compliance Group. “Why
Compliance Pays: Reputations and Revenues at Risk,” July 2007
Leading OrganizationsLeading Organizations1 of 10 are well-positioned
Normative OrganizationNormative Organization 7 out of 10 could substantially reduce financial risk
Lagging OrganizationsLagging Organizations2 out of 10 have the most to gain
Why should business Why should business leaders care?leaders care?
Leaders versus LaggardsLeaders have the fewest business disruptions – only two or fewer disruptions annuallyLaggards experience 17 disruptions or more per year
Leaders have 2 or fewer data losses or thefts per year Laggards have 22 or more data losses per year
Financial Risks
- An 8 percent decline in market value of
stock for publicly traded firms –
some never recover
- An 8 percent loss of customers
- A temporary decline in revenue of 8 percent
- Additional costs for litigation, notification,
settlements, cleanup, restoration, and
improvements averaging $100 per lost
customer record !
Source: Oxford Executive Research Briefing, Impact of Catastrophes on Shareholder Value
Average Cost $1,662,720
This does not include potential civil litigation is class action lawsuits.
Prevent or Limit Losses
• Limit exposure (proactive versus reactive)
Due diligence – “reasonable assurance” Cannot rely on laws to protect or limit liability
o Sophisticated hackers may be beyond the reach of the law
Prevent or Limit Losses
• In 2004, the Department of Justice estimated 3% of all U.S. households experienced some form of identity theft – the number is accelerating
3.6 Million People Average $1,290.00 per household Conservative annualized loss estimate was
$6.4 Billion Occurs every 79 seconds in America!
Protecting your hard earned reputation “Avoid the wrong type of branding"
• Your corporate reputation is at stake – backlash can be severe
• Making headlines TJMaxx Choicepoint
• Once you make the list, you are here forever.... http://www.sec.gov/litigation http://www.ftc.gov/os/caselist/index.shtm http://www.privacyrights.org/
Protecting your hard earned reputation “Avoid the wrong type of branding"
The Evolving Landscape
• Fair Access to Credit Transactions Act (FACTA) - June 1, 2005 Any employer whose action or inaction
results in the loss of employee information can be fined by federal and state government, and sued in civil court
• Additional fines may apply for non-compliance with contracts and regulations or statutes
• Compliance Regulations
Gramm-Leach-Bliley Act
Critical Infrastructure Protection
Payment Card Industry Digital Security Standard
International Standards Organization 27001/27002
The Evolving Landscape
• Compliance Regulations
Sarbanes-Oxley Act (§404)
Health Insurance Portability and Accountability Act (HIPAA)
Automated Teller Machine ANSI X.9
AICPA Statement on Auditing Standards
What’s next…
The Evolving Landscape
Threats are Asymmetric
• Internal Threats are accidental and intentional. Insiders are responsible for…
32% of electronic crimes1 A CFO embezzled $96,000 by fixing an electronic
payment system to pay his monthly credit card bill
70% of identify theft2
A Fidelity database administrator stole and sold bank and credit card data for 8.5 million customers
1 Software Engineering Institute Computer Emergency Response Team and U.S. Secret Service Study http://www.cert.org/insider_threat/
2 FDIC and Michigan State Study http://www.fdic.gov/consumers/consumer/idtheftstudysupp/toc.html
Threats are Asymmetric
• Natural disasters - Katrina, etc...• External threats are becoming more
sophisticated Multi-echelon and multi-vector Specialization
o Bot hearderso Phisherso Carderso Spammers
Harvesting data is good business…if you’re a criminal
The Black Market… $980-$4,900 - Trojan program to steal online
account information $490 - Credit card number with PIN $78-$294 - Billing data, including account number,
address, Social Security number, home address, and birth date
$147 - Driver's license $147 - Birth certificate $98 - Social Security card $6-$24 - Credit card number with security code
and expiration date $6 - PayPal account logon and password
Source: Trend Micro “How Does The Hacker Economy Work?”
Common Myths
• End-Point Security is effective
• Hackers are pizza-faced 13 year old script-kiddies
• Hackers can’t get from my web site to our internal network
Common Myths
• Morale will be hurt if I make control changes – employees will think we don’t trust them
• Outsourcing will transfer my risk
• IT controls will impede business efficiency
1. No or few policies and procedures
2. Reliance on manual detective controls
3. Reliance on end-point security (firewalls)
4. No Data Classification - Trusted Insiders
5. No separation of duties
6. Enforce password rules (strong passwords)
7. No periodic review of user accesses
8. Not Monitoring threats (phishing and social
engineering)
9. Insufficient wireless network protection
10. Insufficient System Auditing
Top 10 Gaps
Prescription (Best practices)
1. Implement
appropriate co
ntrol
objectives and
IT
controls
2. Consolidate
control object
ives
3. Monitor,
measure, and r
eport
controls again
st
objectives on
a
regular schedu
le
Conclusion• It seems that companies aren’t learning
anything from the front-page mistakes of competitors- We are our own worst enemy
• IT control is not just about compliance, it is a useful tool for ensuring the efficient use of organizational resources to meet business objectives and to prevent fraud
• Like any resource, IT requires a clear
linkage between business needs and requirements
Bill Lisse, IT Audit Manager Phone: (937) 853-1490Email: [email protected]