MEJORES PRACTICAS ENCIBERSEGURIDAD

Roberto Hernández Rojas Valderrama, CISA, CISM, CGEIT, CRISC, ITIL Foundation

ISO 27001 LA, PMP, CFSP

Presidente ISACA Capítulo Ciudad de México

OBJETIVO

Revisar el contenido de algunas guías de

la ISACA que pueden apoyar a las

organizaciones en la mejora de la

ciberseguridad

Nota: Se presenta la documentación en inglés, puesto que los

documentos actualmente no tienen traducción al español

AGENDA

• ISACA - Principios de Privacidad y

administración del programa

• NIST Marco de Trabajo para mejorar la

ciberseguridad en Infraestructura Crítica

• Ciberseguridad y COBIT 5

ISACA - Principios de Privacidad y administracióndel programa

DIFERENCIA ENTRE PRIVACIDAD Y SEGURIDAD

Fuente: ISACA Privacy Principles and Program Management Guide

7 CATEGORÍAS DE PRIVACIDAD

Fuente: ISACA Privacy Principles and Program Management Guide

7 CATEGORÍAS DE PRIVACIDAD

Fuente: ISACA Privacy Principles and Program Management Guide

RIESGOS ASOCIADOS

• Social media

• Evolving cloud and container computing services

• Mobile applications (apps)

• Big data analytics

• Internet of Things (IoT)

• Bring your own device practices (BYOD)

• Tracking/surveillance technologies

Fuente: ISACA Privacy Principles and Program Management Guide

14 PRINCIPIOS DE PRIVACIDAD DE ISACA

Principle 1: Choice and consent

Principle 2: Legitimate purpose specification and use limitation

Principle 3: Personal information and sensitive information life cycle

Principle 4: Accuracy and quality

Principle 5: Openness, transparency and notice

Principle 6: Individual participation

Principle 7: Accountability

Principle 8: Security safeguards

Principle 9: Monitoring, measuring and reporting

Principle 10: Preventing harm

Principle 11: Third party/vendor management

Principle 12: Breach management

Principle 13: Security and privacy by design

Principle 14: Free flow of information and legitimate restriction

Fuente: ISACA Privacy Principles and Program Management Guide

NIST Marco de Trabajo para

mejorar la ciberseguridad en

Infraestructura Crítica

INFRAESTRUCTURA CRÍTICA

Critical infrastructure is defined in the Executive Order as

“systems and assets, whether physical or virtual, so vital to the

United States that the incapacity or destruction of such systems

and assets would have a debilitating impact on security, national

economic security, national public health or safety, or any

combination of those matters.”

Due to the increasing pressures from external and internal

threats, organizations responsible for critical infrastructure need

to have a consistent and iterative approach to identifying,

assessing, and managing cybersecurity risk. This approach is

necessary regardless of an organization’s size, threat exposure,

or cybersecurity sophistication today

Fuente: NIST Framework for Improving Critical Infrastructure Cybersecurity

MARCO DE TRABAJO

• The Framework Core is a set of cybersecurity activities, desired outcomes,

and applicable references that are common across critical infrastructure

sectors

Fuente: NIST Framework for Improving Critical Infrastructure Cybersecurity

MARCO DE TRABAJO

The Framework Core

Fuente: NIST Framework for Improving Critical Infrastructure Cybersecurity

MARCO DE TRABAJO

The Framework

Core

Fuente: NIST Framework for Improving Critical Infrastructure Cybersecurity

MARCO DE TRABAJO

• Framework Implementation Tiers (“Tiers”) provide context on how an

organization views cybersecurity risk and the processes in place to manage

that risk. Tiers describe the degree to which an organization’s cybersecurity

risk management practices exhibit the characteristics defined in the

Framework

Tier 1: Partial

Tier 2: Risk Informed

Tier 3: Repeatable

Tier 4: Adaptive

• Risk Management Process

• Integrated Risk Management Program

• External Participation

• Cyber Supply Chain Risk Management

Fuente: NIST Framework for Improving Critical Infrastructure Cybersecurity

MARCO DE TRABAJO

• A Framework Profile (“Profile”) represents the outcomes based on business

needs that an organization has selected from the Framework Categories and

Subcategories. The Profile can be characterized as the alignment of

standards, guidelines, and practices to the Framework Core in a particular

implementation scenario. Profiles can be used to identify opportunities for

improving cybersecurity posture by comparing a “Current” Profile (the “as is”

state) with a “Target” Profile (the “to be” state).

Fuente: NIST Framework for Improving Critical Infrastructure Cybersecurity

IMPLANTACIÓN DEL MARCO DE TRABAJO

Fuente: NIST Framework for Improving Critical Infrastructure Cybersecurity

IMPLANTACIÓN DEL MARCO DE TRABAJO

Step 1: Prioritize and Scope. The organization identifies its business/mission objectives and high-level

organizational priorities. With this information, the organization makes strategic decisions regarding

cybersecurity implementations and determines the scope of systems and assets that support the selected

business line or process.

Step 2: Orient. Once the scope of the cybersecurity program has been determined for the business line or

process, the organization identifies related systems and assets, regulatory requirements, and overall risk

approach. The organization then consults sources to identify threats and vulnerabilities applicable to

those systems and assets. identifies threats to, and vulnerabilities of, those systems and assets.

Step 3: Create a Current Profile. The organization develops a Current Profile by indicating which

Category and Subcategory outcomes from the Framework Core are currently being achieved.

Step 4: Conduct a Risk Assessment. The organization analyzes the operational environment in order to

discern the likelihood of a cybersecurity event and the impact that the event could have on the

organization. It is important that organizations identify emerging risks and use cyber threat information

from internal and external sources to gain a better understanding of the likelihood and impact of

cybersecurity events.

Fuente: NIST Framework for Improving Critical Infrastructure Cybersecurity

IMPLANTACIÓN DEL MARCO DE TRABAJO

Step 5: Create a Target Profile. The organization creates a Target Profile that focuses on the assessment

of the Framework Categories and Subcategories describing the organization’s desired cybersecurity

outcomes.

Step 6: Determine, Analyze, and Prioritize Gaps. The organization compares the Current Profile and

the Target Profile to determine gaps. Next, it creates a prioritized action plan to address those gaps that

draws upon mission drivers, a cost/benefit analysis, and understanding of risk to achieve the outcomes in

the Target Profile - drawing upon mission drivers, a cost/benefit analysis, and risk understanding - to

achieve the outcomes in the Target Profile. The organization then determines resources necessary to

address the gaps.

Step 7: Implement Action Plan. The organization determines which actions to take in regards to the

gaps, if any, identified in the previous step. It then monitors its current cybersecurity practices against the

Target Profile. For further guidance, the Framework identifies example Informative References regarding

the Categories and Subcategories, but organizations should determine which standards, guidelines, and

practices, including those that are sector specific, work best for their needs.

Fuente: NIST Framework for Improving Critical Infrastructure Cybersecurity

CIBERSEGURIDAD Y COBIT 5

COBIT 5

Information security deals

with information, regardless

of its format. It includes:

• Paper documents

• Digital and intellectual

property

• Verbal or visual

communications

Cybersecurity is concerned

with protecting digital

assets. Includes:

• Networks

• Hardware

• Software

• Information that is

processed, stored or

transported by

internetworked IS

CIBERSEGURIDAD VS. SEGURIDAD DE LA INFORMACIÓN

SEVERIDADES DE LOS ATAQUES

Fuente: Transforming Cybersecurity: Using COBIT 5

RIESGOS ORGANIZACIONALES

Fuente: Transforming Cybersecurity: Using COBIT 5

RIESGOS SOCIALES

Fuente: Transforming Cybersecurity: Using COBIT 5

RIESGOS TÉCNICOS

Fuente: Transforming Cybersecurity: Using COBIT 5

DETALLE DE COBIT 5 Y CIBERSEGURIDAD

Fuente: Transforming Cybersecurity: Using COBIT 5

AGENTES DE AMENAZAS

FUENTE: ENISA Threat Landscape 2013

ATRIBUTOS DE UN CIBERATAQUE

Attack Vector

Payload Exploit VulnerabilityTarget (Asset)

COBIT 5 CONJUNTO DE POLITICAS DE SEGURIDAD DE LA INFORMACIÓN

Information Security

Business Continuity/ Disaster Recovery

Asset Management

Rules of Behavior

Acquisition/ Development/ Maintenance

Vendor Management

Communications and Operations

Compliance

Risk Management

Fuente: Transforming Cybersecurity: Using COBIT 5

ASEGURAMIENTO DE LA CIBERSEGURIDAD

Fuente: Transforming Cybersecurity: Using COBIT 5

PASOS DE INVESTIGACIÓN

8 PRINCIPIOS PARA TRANSFORMAR LA CIBERSEGURIDAD

Principle 1. Know the potential impact of cybercrime and

cyberwarfare.

Principle 2. Understand end users, their cultural values and their

behavior patterns.

Principle 3. Clearly state the business case for cybersecurity, and

the risk appetite of the enterprise.

Principle 4. Establish cybersecurity governance.

Principle 5. Manage cybersecurity using principles and enablers.

Principle 6. Know the cybersecurity assurance universe and

objectives.

Principle 7. Provide reasonable assurance over cybersecurity.

Principle 8. Establish and evolve systemic cybersecurity.

Fuente: Transforming Cybersecurity: Using COBIT 5