Compliance Security - Cyber Security Summit...Cyber Security Summit | October 23-25, 2017 |...

25
Compliance ≠ Security (But, we’re getting closer) Rich Banta, Co-Owner & CISO, Lifeline Data Centers, LLC

Transcript of Compliance Security - Cyber Security Summit...Cyber Security Summit | October 23-25, 2017 |...

Page 1: Compliance Security - Cyber Security Summit...Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org Compliance ≠ Security NIST 800-53 R4 Control

Compliance ≠ Security

(But, we’re getting closer) Rich Banta, Co-Owner & CISO, Lifeline Data Centers, LLC

Page 2: Compliance Security - Cyber Security Summit...Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org Compliance ≠ Security NIST 800-53 R4 Control

Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org

Page 3: Compliance Security - Cyber Security Summit...Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org Compliance ≠ Security NIST 800-53 R4 Control

Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org

•  FedRAMP-Ready •  HITRUST CSF

Certified •  PCI DSS AoC/RoC •  SOC2 •  IRS-1075

Page 4: Compliance Security - Cyber Security Summit...Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org Compliance ≠ Security NIST 800-53 R4 Control

Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org

Rich Banta •  CISSP•  CCSP•  CISA•  CRISC•  CFCP•  CDCDP•  CTIA•  CTDC

Page 5: Compliance Security - Cyber Security Summit...Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org Compliance ≠ Security NIST 800-53 R4 Control

Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org

Compliance ≠ Security WhydoesCompliance≠Security?

Page 6: Compliance Security - Cyber Security Summit...Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org Compliance ≠ Security NIST 800-53 R4 Control

Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org

Compliance ≠ Security WhydoesCompliance≠Security?•  ComplianceisChecklist-Based

Page 7: Compliance Security - Cyber Security Summit...Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org Compliance ≠ Security NIST 800-53 R4 Control

Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org

Compliance ≠ Security WhydoesCompliance≠Security?•  ComplianceisChecklist-Based•  CompliancedependsonAudits

Page 8: Compliance Security - Cyber Security Summit...Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org Compliance ≠ Security NIST 800-53 R4 Control

Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org

Compliance ≠ Security WhydoesCompliance≠Security?•  ComplianceisChecklist-Based•  CompliancedependsonAudits•  AuditsassessapointinAme

Page 9: Compliance Security - Cyber Security Summit...Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org Compliance ≠ Security NIST 800-53 R4 Control

Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org

Compliance ≠ Security Whateffortsarebeingmadetoaddressthepoint-in-Ameshortcoming?

Page 10: Compliance Security - Cyber Security Summit...Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org Compliance ≠ Security NIST 800-53 R4 Control

Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org

Compliance ≠ Security Whateffortsarebeingmadetoaddressthepoint-in-Ameshortcoming?•  CMP:ConAnuousMonitoringProgram

Page 11: Compliance Security - Cyber Security Summit...Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org Compliance ≠ Security NIST 800-53 R4 Control

Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org

Compliance ≠ Security CMP:FedRAMP’sapproachtoConAnuousMonitoring

Page 12: Compliance Security - Cyber Security Summit...Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org Compliance ≠ Security NIST 800-53 R4 Control

Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org

Compliance ≠ Security TheFedRAMPModerateBaselinecontains326controls*.*AndanaddiAonal~70controlenhancements

Page 13: Compliance Security - Cyber Security Summit...Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org Compliance ≠ Security NIST 800-53 R4 Control

Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org

Compliance ≠ Security TheFedRAMPCMPcallsforconAnuousongoingmonitoringandreporAngon58ofthe326controls.

Page 14: Compliance Security - Cyber Security Summit...Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org Compliance ≠ Security NIST 800-53 R4 Control

Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org

Compliance ≠ Security NIST800-53R4ControlRA-5:•  VulnerabilityScanning

Page 15: Compliance Security - Cyber Security Summit...Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org Compliance ≠ Security NIST 800-53 R4 Control

Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org

Compliance ≠ Security NIST800-53R4ControlRA-5:•  VulnerabilityScanning– RA-5a:OS/infrastructure/webapplicaAon/databasescans– ScanresultsmustbesubmiYedinFedRAMP-specificdashboardformat

Page 16: Compliance Security - Cyber Security Summit...Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org Compliance ≠ Security NIST 800-53 R4 Control

Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org

Compliance ≠ Security NIST800-53R4ControlRA-5:•  VulnerabilityScanning– RA-5d:ProvidearAfactstoISSOshowinghigh-riskvulnerabiliAeshavebeenmiAgatedin30daysandmoderaterisk-vulnerabiliAeswithin90days

– POA&M

Page 17: Compliance Security - Cyber Security Summit...Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org Compliance ≠ Security NIST 800-53 R4 Control

Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org

Compliance ≠ Security NIST800-53R4ControlCM-7(1)a:•  LeastFuncAonality–  IdenAfyandeliminateunnecessaryfuncAons,ports,protocols,and/orservices

–  PPSM(Ports,Protocols,andServicesManagement)

Page 18: Compliance Security - Cyber Security Summit...Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org Compliance ≠ Security NIST 800-53 R4 Control

Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org

Compliance ≠ Security NIST800-53R4ControlCM-8(3)a:•  InformaAonSystemComponentInventory–  AutomateddetecAonofnewassets–  ReportssubmiYedmonthly–  Vulnerabilityscanmust=Inventoryscan=PPSM=NAC,etc.

Page 19: Compliance Security - Cyber Security Summit...Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org Compliance ≠ Security NIST 800-53 R4 Control

Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org

Compliance ≠ Security Lifelinehasnointernalwirelessnetworks.

(ThisincludestheDMZ)

Page 20: Compliance Security - Cyber Security Summit...Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org Compliance ≠ Security NIST 800-53 R4 Control

Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org

Compliance ≠ Security ThisprecludeshavinganIoT,orInternetofThings

Page 21: Compliance Security - Cyber Security Summit...Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org Compliance ≠ Security NIST 800-53 R4 Control

Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org

Compliance ≠ Security ThisprecludeshavinganIoT,orInternetofThingsIdiocy

Page 22: Compliance Security - Cyber Security Summit...Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org Compliance ≠ Security NIST 800-53 R4 Control

Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org

Compliance ≠ Security ThisprecludeshavinganIoT,orInternetofThings

Page 23: Compliance Security - Cyber Security Summit...Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org Compliance ≠ Security NIST 800-53 R4 Control

Compliance ≠ Security

(But, we’re getting closer)

Page 24: Compliance Security - Cyber Security Summit...Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org Compliance ≠ Security NIST 800-53 R4 Control

Questions? Comments? Rich Banta, Co-Owner & CISO, Lifeline Data Centers, LLC

Page 25: Compliance Security - Cyber Security Summit...Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org Compliance ≠ Security NIST 800-53 R4 Control

Thank you for your time and interest! Rich Banta, Co-Owner & CISO, Lifeline Data Centers, LLC


CYBER SECURITY: CCSS CLOSE CYBER SECURITY SUPPORT › dtic › tr › fulltext › u2 › a588004.pdf · 2013-12-12 · 1 CYBER SECURITY: CCSS – CLOSE CYBER SECURITY SUPPORT An

CYBER SECURITY: CCSS CLOSE CYBER SECURITY SUPPORT › dtic › tr › fulltext › u2 › a588004.pdf · 2013-12-12 · 1 CYBER SECURITY: CCSS – CLOSE CYBER SECURITY SUPPORT An

Securing Critical Infrastructure ... - Cyber Security Summit€¦ · Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org © 2017 Regents of the

Securing Critical Infrastructure ... - Cyber Security Summit€¦ · Cyber Security Summit | October 23-25, 2017 | Minneapolis, MN | cybersecuritysummit.org © 2017 Regents of the

BSc (Hons) Cyber Security BSc (Hons) Cyber Security (with ...

BSc (Hons) Cyber Security BSc (Hons) Cyber Security (with ...

National Cyber Security Division - Joint Cyber Security Services Pilot (JCSP)

National Cyber Security Division - Joint Cyber Security Services Pilot (JCSP)

Cyber Security Seminar Cyber Security fingerprints Security Seminar Cyber Security fingerprints Per Larsen, ... Antivirus Solutions ... Account Management Computer Policies Microsoft

Cyber Security Seminar Cyber Security fingerprints Security Seminar Cyber Security fingerprints Per Larsen, ... Antivirus Solutions ... Account Management Computer Policies Microsoft

Cyber Security Architecture Methodology for the Electric ... · part of a cyber security strategy. Another component of the cyber security strategy is a cyber security architecture.

Cyber Security Architecture Methodology for the Electric ... · part of a cyber security strategy. Another component of the cyber security strategy is a cyber security architecture.

Cyber Security Technologist Level 4 Apprenticeship€¦ · Cyber Security Technologists This course supports cyber security technologists who apply an understanding of cyber threats,

Cyber Security Technologist Level 4 Apprenticeship€¦ · Cyber Security Technologists This course supports cyber security technologists who apply an understanding of cyber threats,

CYBER SECURITY DIVISION - dhs.gov · CYBER SECURITY DIVISION: SECURING YOUR CYBER FUTURE • • • CYBER SECURITY DIVISION OVERVIEW The nation’s economic strength and security

CYBER SECURITY DIVISION - dhs.gov · CYBER SECURITY DIVISION: SECURING YOUR CYBER FUTURE • • • CYBER SECURITY DIVISION OVERVIEW The nation’s economic strength and security

Introduction to Cyber Security by Cyber Security Infotech(CSI)

Introduction to Cyber Security by Cyber Security Infotech(CSI)

2020 - cybersecuritysummit.org€¦ · Endpoint Security Director, Threat & Vulnerability Mgmt Faculty Global IT Internal Audit Leader Global Product Security Officer Incident Responder

2020 - cybersecuritysummit.org€¦ · Endpoint Security Director, Threat & Vulnerability Mgmt Faculty Global IT Internal Audit Leader Global Product Security Officer Incident Responder

CYBER SECURITY - newriver.edu · CYBER SECURITY CYBER SECURITY CERTIFICATE OF APPLICED SCIENCE (CAS) [PROGRAM HOURS: 30] Prepare to work in an entry-level cyber security job. Explore

CYBER SECURITY - newriver.edu · CYBER SECURITY CYBER SECURITY CERTIFICATE OF APPLICED SCIENCE (CAS) [PROGRAM HOURS: 30] Prepare to work in an entry-level cyber security job. Explore

Cyber Security - Joshua McCloud - Cisco Cyber Security Solutions Architect

Cyber Security - Joshua McCloud - Cisco Cyber Security Solutions Architect

Cyber Security The Cyber Security · Cyber Security Breaches Survey 2020: Statistical Release Summary The extent of cyber security threats has not diminished. In fact, this survey,

Cyber Security The Cyber Security · Cyber Security Breaches Survey 2020: Statistical Release Summary The extent of cyber security threats has not diminished. In fact, this survey,

Improving Cyber-Security Improving Cyber-Security through ...

Improving Cyber-Security Improving Cyber-Security through ...

DHS National Cyber Security Division Cyber Security Procurem

DHS National Cyber Security Division Cyber Security Procurem

National Cyber Security Alliance National Cyber Security Awareness … · 2020-02-13 · National Cyber Security Alliance National Cyber Security Awareness Month 2017 Results Summary

National Cyber Security Alliance National Cyber Security Awareness … · 2020-02-13 · National Cyber Security Alliance National Cyber Security Awareness Month 2017 Results Summary

Cyber Security Research Impacts · 2 | The Australian Centre for Cyber Security Beyond Academia: Cyber Security Research Impacts 3 ACCS INCUBATOR The Australian Centre for Cyber Security

Cyber Security Research Impacts · 2 | The Australian Centre for Cyber Security Beyond Academia: Cyber Security Research Impacts 3 ACCS INCUBATOR The Australian Centre for Cyber Security

Cyber Security The Cyber Security - GOV.UK

Cyber Security The Cyber Security - GOV.UK

Clarity on Cyber Security - assets.kpmg€¦ · Partner, Cyber Security Matthias Bossardt Gerben Schreurs Partner, Cyber Security Gerben Schreurs Media reports on cyber incidents

Clarity on Cyber Security - assets.kpmg€¦ · Partner, Cyber Security Matthias Bossardt Gerben Schreurs Partner, Cyber Security Gerben Schreurs Media reports on cyber incidents

Cyber security & Importance of Cyber Security

Cyber security & Importance of Cyber Security