Developing Cybersecurity Programs and Policies, 3rd Edition Omar Santos Solution Manual

Type:

Solution Manual

Resource:

Developing Cybersecurity Programs and Policies

Edition:

3rd Edition

Author(s):

Omar Santos

Instructor’s Guide to Accompany DEVELOPING CYBERSECURITY PROGRAMS AND POLICIES CHAPTER 1 UNDERSTANDING CYBERSECURITY POLICY AND GOVERNANCE

CHAPTER OBJECTIVES When students have finished reading this chapter, they will be able to: •

Describe the significance of cybersecurity policies

•

Evaluate the role policy plays in corporate culture and civil society

•

Articulate the objective of cybersecurity-related policies

•

Identity the different characteristics of successful cybersecurity policies

•

Define the life cycle of a cybersecurity policy

CHAPTER OVERVIEW This chapter is a high-level introduction to policy in all aspects of life. Students should receive a basic understanding of the nature of policy, identify the characteristics of a successful policy, and understand the phases of the policy lifecycle from development to review. This material will be critical in later chapters.

CHAPTER OUTLINE I.

Information Security vs. Cybersecurity Policies

II.

Looking at Policy Through the Ages

III.

•

Policy in Ancient Times

•

The U.S. Constitution as a Policy Revolution

•

Policy Today

Cybersecurity Policy •

What Are Assets?

•

Successful Policy Characteristics 1

IV.

V.

•

What Is the Role of Government?

•

Additional Federal Banking Regulations

•

Government Cybersecurity Regulations in Other Countries

•

The Challenges of Global Policies

Cybersecurity Policy Life Cycle •

Policy Development

•

Policy Publication

•

Policy Adoption

•

Policy Review

Summary

TEACHING NOTES AND TIPS PER TOPIC 1. Information Security vs. Cybersecurity Policies Teaching Tip: These terms are often confused and misunderstood. Make sure students can differentiate between the two terms.

2. Looking at Policy Through the Ages Teaching Note: Topics include: • • •

Policy in Ancient Times The U.S. Constitution as a Policy Revolution Policy Today

Teaching Tips Emphasize to students that the need for guidance, direction, and roles have existed throughout mankind. Lead a discussion on examples in religion, government, and private industry.

3. Cybersecurity Policy Teaching Note: Topics include: • • • • • •

What Are Assets?

Successful Policy Characteristics What Is the Role of Government?

Additional Federal Banking Regulations Government Cybersecurity Regulations in Other Countries The Challenges of Global Policies

Teaching Tip: Emphasize that the key to writing policies lies in knowing what is protected and where it exists. Information security policy should secure information in three distinct states: stored, processed, and transmitted. Information in these states resides in information technology systems, on paper, and in human brains.

Teaching Tip In class, have students discuss what should be in a policy for a veterinarian’s office.

Point out to students that class suggestions and comments center around what information needs to be protected (for example, account balances, credit card numbers, customer list, and appointment schedules) and where the information resides.

2

Teaching Tip: Without policies, it would be almost impossible to organize any group for any reason and for any length of time. Government policy can, in turn, require businesses to create their own policy to achieve and sustain compliance.

Teaching Tip: The function of well-written information security policies is to protect the organization, its employees, its customers, and its vendors and partners from harm resulting from intentional or accidental damage, misuse, or disclosure of information.

Teaching Tip: A successful policy should be supported by management, applicable to the organization, should make sense to the people it applies to, can be successfully implemented, can be changed when needed, can be enforced when needed, and includes all relevant parties.

Teaching Tip: Identify and discuss the six characteristics (Endorsed, Relevant, Realistic, Attainable, Adaptable, Enforceable, Inclusive) of a successful cybersecurity policy. Ask for real-world examples of a cybersecurity policy that failed, and which of these characteristics were lacking?

Teaching Tip: Government intervention is required to protect its critical infrastructures and citizens.

Examples of government information security-related legislation are the Gramm-Leach-Bliley Act (GLBA) and the Health Insurance Portability and Accountability Act (HIPAA). States also play an important role is passing legislation when comprehensive national standards do not exist. The California Security Breach Information Act and the Massachusetts Standards for the Protection of Personal Information are two such examples.

4. Information Security Policy Life Cycle Teaching Note: Topics include: • • • •

Policy Development Policy Publication Policy Adoption Policy Review

Teaching Tip: Regardless of the type of policy, its success depends on how the organization approaches the process of development, publishing, adopting, and reviewing the policy.

Teaching Tip: There are six main tasks involved in policy development: planning, researching, writing, vetting, approving, and authorizing.

Teaching Tip: To implement a successful policy publication procedure, policies need to be communicated and made available to all parties they apply to. The company should provide training to reinforce the policies. Creating a culture of compliance can ensure all parties understand the importance of the policy and actively support it.

Teaching Tip: In a successful policy adoption plan, the policy is implemented, monitored, and enforced.

Teaching Tip: Successful policy review procedures ensure that policies are reviewed annually, and outdated policies are updated or retired.

3

ACTIVITIES FOR CLASS I.

Discussion Questions A. Discussion Question 1 In addition to the Bible and the U.S. Constitution, identify another written policy that had (or still has) a profound effect on societies across the globe, including our own.

Answer: Students’ answers will vary. An acceptable policy should have been created out of a perceived need to guide human behavior in foreseeable circumstances, and even to guide human behavior when circumstances could not be or were not foreseen.

B. Discussion Question 2 How do policies communicate corporate culture?

Answer: Corporate culture can be defined as the shared attitudes, values, goals, and practices that characterize a company or corporation. These attitudes, values, goals, and practices are communicated to all the organization’s employees, vendors, partners, and customers with policies that support organizational goals and provide expectations to help sustain consistency in the organization’s services and products.

II.

Web Projects A. Web Project 1 Visit the Department of Health & Human Services http://www.hhs.gov/ocr/hipaa/) to find out generally what the HIPAA Privacy Rule requires the average provider or health plan to do.

Notes: This project can help students explore an important government policy.

B. Web Project 2 Go to http://www.hpl.hp.com/news/2006/jan-mar/fake.html, and read the article. Based on this information, suggest a policy to deter the proliferation of counterfeit drugs. Who would create this policy? Who would be affected by it?

Notes: This project can further students’ understanding of government policy as a response to complex issues. Students’ answers will vary.

C. Web Project 3 Read about information security threats at http://searchsecurity.techtarget.com/topics/0,295493,sid14_tax299811,00.html. Which threats are the most critical? Which threats are the hardest to protect against?

Notes: This project provides more in-depth research into information security threats. Students’ answers should include their reasons for considering a threat more critical or hard to protect against.

4

WEB RESOURCES •

http://www.247.prenhall.com/ Pearson product support

•

http://searchsecurity.techtarget.com/bestWebLinks/0,289521,sid14_tax281891,00.html basics: Valuable resource links for those just entering the world of security

•

http://www.cert.org/ The CERT Coordination Center (CERT-CC)

•

http://www.us-cert.gov/ The United States Computer Emergency Readiness Team (US-CERT)

5

Security

Instructor’s Guide to Accompany DEVELOPING CYBERSECURITY PROGRAMS AND POLICIES CHAPTER 2 CYBERSECURITY POLICY ORGANIZATION, FORMAT, AND STYLES

CHAPTER OBJECTIVES When students have finished reading this chapter, they will be able to: •

Explain the differences between a policy, a standard, a procedure, a guideline, and a plan

•

Know how to use “plain language when creating and updating your cybersecurity policy”

•

Identify the different policy elements

•

Include the proper information in each element of a policy

CHAPTER OVERVIEW This chapter provides a detailed explanation of each of the recommended policy elements of an information security policy; though you should find these same elements in any policy document used for any purpose. The chapter explores how these elements fit together and how they depend on and support each other.

CHAPTER OUTLINE I.

II.

Policy Hierarchy •

Standards

•

Baselines

•

Guidelines

•

Procedures

•

Plans and Programs

Writing Style and Techniques •

Using Plain Language

•

The Plain Language Movement 1

• III.

IV.

Plain Language Techniques for Policy Writing

Policy Format •

Understanding Your Audience

•

Policy Format Types

•

Policy Components

Summary

TEACHING NOTES AND TIPS PER TOPIC 1.

Policy Hierarchy Teaching Note: Topics include: • • • • •

Standards Baselines Guidelines Procedures Plans and Programs

Teaching Tip: Explain to students that because standards, baselines, guidelines, and procedures change far more often than policies, these should be separated from the policy document.

Teaching Tip: Standards dictate specific minimum requirements in a policy.

Teaching Tip: Baselines are an aggregate of implementation standards and security controls for a specific category or grouping. For example, a baseline can be created for all users using smartphones or all users connecting to the network through a VPN. Teaching Tip: Guidelines are best thought of as suggestions for the best way to help people conform to the standards. Guidelines are likely to change more often than any other element in this family of documents.

Teaching Tip: Procedures are the instructions necessary to carry out a policy statement. They focus on actions or steps, and there is usually a starting point and an ending point to that action. Four commonly used types are simple step, hierarchical, graphic, and flowchart.

2.

Writing Style and Technique Teaching Note: Topics include: • • •

Using Plain Language The Plain Language Movement Plain Language Techniques for Policy Writing

Teaching Tip: Follow the plain language techniques when writing policy documents.

2

Teaching Tip: Discuss the FYI: Plain Language Results on page 46 of the textbook. Have students explore the source: https://plainlanguage.gov/examples/before-and-after/. Do they find any examples particularly interesting? Have they recently received a document or email that was difficult to understand?

Teaching Tip: Bring in a verbose, real-world document you have received. Ask students to re-write the document using plain language writing techniques. Alternatively, ask students to bring in a document or piece of mail they have received that does not follow the Plain Language Movement. Discuss some of the documents as a group.

3.

Policy Format Teaching Note: Topics include: • • •

Understanding Your Audience Policy Format Types Policy Components

Teaching Tip: You need to know your intended audience and write in a way that is relevant and understandable for that audience.

Teaching Tip: Policy format varies. Each policy can be written as a discrete document, called a singular policy, or one large policy document with multiple sections, called a consolidated policy. Discrete documents offer the advantages of being short, clean, and crisp, and well targeted to the intended audience.

Teaching Tip: The key to successful policy writing is to understand the goal of each section and to be consistent in how you write.

Teaching Tip: Version control is used to keep track of any changes to the policy, including who authorized and made the changes and what is the effective date.

Teaching Tip: A policy heading contains all the technical details relevant to a policy, such as version number, identity of the author(s), date of creation, and more.

Teaching Tip: The policy objective states what (not the why or how) we are trying to achieve by implementing the policy. One policy can feature multiple objectives.

Teaching Tip: The policy statement focuses on the specifics of how the policy will be implemented, in other words, the rules. The policy will also reference the standards, procedures, and guidelines (all separate documents) that have been created to support all the rules that make up the policy.

Teaching Tip: Keep the number of policy exceptions low. Language used when creating an exception must be clear, concise, and indicate a process by which exceptions may be granted. The criteria or conditions for exceptions should not be detailed in the policy, only the method or process for requesting an exception.

Teaching Tip: Include a policy enforcement clause in the policy document. The only way to enforce the policy rules is to include the penalty for ignoring the rules in the same document. Do not list every possible punishment for every possible violation. Simply indicate a disciplinary process and list the most severe punishment, which usually includes dismissal or criminal prosecution.

Teaching Tip: Administrative notations are used to provide a reference to an internal resource or to an external policy or regulation.

3

Teaching Tip: Include policy definitions for any instance of nonstandard language. When choosing which words will be defined, do not look only at those that could clearly be unknown by the target audience, but also include those that should be defined to remove all ambiguity.

ACTIVITIES FOR CLASS I.

Discussion Questions A. Discussion Question 1 What is the difference between a policy objective and a policy purpose?

Answer: Students’ answers will vary. Essentially, the policy objective is to achieve a broad goal to more efficiently protect the company. The policy purpose explains how the company will protect itself from specific threats using the actual rules of the policy.

B. Discussion Question 2 Why are policy definitions an important part of any policy?

Answer: Student answers should focus on the use of definitions to enhance understanding of the policy and the need to define a target audience. Another important reason for definitions is to remove all ambiguity from the policy. A security policy should be viewed as a legal document and crafted carefully.

II.

Web Projects A. Web Project 1 Read about the national strategy to secure cyberspace at: https://www.dhs.gov/sites/default/files/publications/DHS-Cybersecurity-Strategy_1.pdf. Is this a policy?

Who is the target audience? Can you find all the policy elements?

Notes: Student answers will vary. The primary target audience is citizens of the United States. Student answers will vary on finding the policy elements. Not all elements may be included.

B. Web Project 2 Choose a university or corporation and locate its Data Management, Use, and Protection policy. Develop a brief report on how it compares to the policy elements discussed in this chapter? What criticisms do you have of this policy? What has been done well? Include links to the source document.

Notes: Student answers will vary. The successful student will compare to the policy elements covered in the chapter. Criticisms and/or positive reviews should be included.

WEB RESOURCES •

http://www.247.prenhall.com/ Pearson product support 4

•

http://www.sans.org/resources/policies/ The SANS Institute provides sample policies and templates in many areas of information security along with other relevant information

•

https://www.infosecurity-magazine.com Information Security magazine is the enterprise security and risk managers' leading source of critical, objective information on strategic and practical security issues

•

https://www.dhs.gov/publication/dhs-cybersecurity-strategy Homeland Security Cybersecurity Strategy Fact Sheet and cybersecurity strategy

5

Instructor’s Guide to Accompany DEVELOPING CYBERSECURITY PROGRAMS AND POLICIES CHAPTER 3 CYBERSECURITY FRAMEWORK

CHAPTER OBJECTIVES When students have finished reading this chapter, they will be able to: •

Understand confidentiality, integrity, and availability (the CIA security model)

•

Describe the security objectives of confidentiality, integrity, and availability

•

Discuss why organizations choose to adopt a security framework

•

Understand the intent of the National Institute of Standards and Technology (NIST) Cybersecurity Framework

•

Understand the intent of the ISO/IEC 27000-series of information security standards

•

Outline the domains of an information security program

CHAPTER OVERVIEW This chapter focuses on the information security framework, which includes standards, information classification, and identification of information owners. A good information security framework will answer the following questions.

• • •

What are we trying to achieve in pursuit of cybersecurity?

What is the goal of the policy?

What tangible benefit will come to customers, employees, partners, and the organizations?

CHAPTER OUTLINE I.

Confidentiality, Integrity, and Availability •

What Is Confidentiality?

•

What Is Integrity?

•

What Is Availability?

1

• II.

Who Is Responsible for CIA?

Information Security Framework •

What Is NIST’s Function?

•

So, What About ISO?

•

NIST cybersecurity Framework

III.

ISO Standards

IV.

Summary

TEACHING NOTES AND TIPS PER TOPIC 1. Confidentiality, Integrity, and Availability Teaching Note: Topics include: • • • •

What Is Confidentiality?

What Is Integrity?

What Is Availability?

Who Is Responsible for CIA?

Teaching Tip: Help students realize that information security is not a “point-in-time” measurement but rather an ongoing process requiring vigilance and sustained effort. Then, they will understand why it is important to write policies that facilitate consistency and sustainability.

Teaching Tip: Lead a discussion about confidentiality. Using Figure 3-2, have students explain and site examples of each of the three general concepts of Confidentiality.

Teaching Tip: Lead a discussion about integrity. Ask students to explain the difference between Data Integrity and System Integrity, and site examples of each.

Teaching Tip: Lead a discussion about availability. Using figure 3-3, have students review types availability threats. Ask students to brainstorm about ways each of the listed threats could be prevented or controlled.

Teaching Tip: Compare and contrast threats to availability, confidentiality, and integrity. Which type of threat is most likely to occur? (Availability – hardware will fail.)

Teaching Tip: Ensure that students understand what Denial of Service (DoS) attack means, and can identify the three general categories of DoS: direct DDoS, reflected, and amplification DDoS attacks.

Teaching Tip: Ensure students can identify the “Five As” of Information Security, and what they stand for.

They can be found on page 81.

Teaching Tip: Have students discuss the difference between information owner and information custodian.

Ask students to provide an example of each.

2. Information Security Framework 2

Teaching Note: Topics include: • • • •

What Is NIST’s Function?

So, What About ISO? NIST Cybersecurity Framework ISO Standards

Teaching Tip: Explain the functions of NIST and ISO, and ask students to locate one document published from each of these organizations that deals with information security.

Teaching Tip: The term “domain” may be confusing to students who think of a network domain or a web domain. Clearly define “domain” in this context (an ISO domain) as simply a category. Have students identify the ISO domains and the purpose of each domain.

ACTIVITIES FOR CLASS I.

Discussion Questions A. Discussion Question 1 How does the ISO 27002:2013 standard relate to an organization’s information security policy?

Answer: Student answers will vary. The standard is a comprehensive set of information security recommendations comprising best practices in information security. As such, it provides a framework to help organizations of any size develop appropriate controls to maintain the confidentiality, integrity, and availability of information.

B. Discussion Question 2 Describe an effective policy.

Answer: Student answers will vary. For policies to be effective, they must be meaningful and relevant as well as appropriate to the size and complexity of the organization. The key is to understand what policy and control may be needed in any given environment and then develop, adopt, and implement the controls and policies that make sense for the organization.

II.

Web Projects A. Web Project 1 Visit the ISO website (http://www.iso.org) to find out how ISO standards are developed. Write a brief summary of what you learn.

Notes: http://www.iso.org/iso/home/standards_development.htm B. Web Project 2 Review the Table of Equivalent Classification Markings in Various Countries at Wikipedia. Discuss the difference between classifications used in Chile and the People’s Republic of China. Compare both to those used in the United States and to Switzerland. What conclusions can you draw?

3

Notes: Student answers will vary. Chile has only two levels of classification, whereas the People’s Republic of China ostensibly has three, but they are poorly defined. There is no formal system of classification in the People’s Republic of China, nor are there legal requirements limiting what can be declared secret or even prevent information previously released from retroactively being declared state secrets. The result of this makes it possible for the government to use this law to jail journalists who the government considers to be a danger to the ruling governing system. The United States has only three levels of classification, and Switzerland has no level equivalent to “top secret.”

WEB RESOURCES •

http://www.247.prenhall.com/ Pearson product support

•

http://www.iso.org/ More information about the ISO

•

http://www.nist.gov/ More about NIST

•

https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator A Common Vulnerability Scoring system (CVSS) Calculator

•

https://www.first.org/cvss/v2/guide A complete guide to the CVSS scoring system

4

Instructor’s Guide to Accompany DEVELOPING CYBERSECURITY PROGRAMS AND POLICIES CHAPTER 4 GOVERNANCE AND RISK MANAGEMENT

CHAPTER OBJECTIVES When students have finished reading this chapter, they will be able to: •

Define governance.

•

Explain cybersecurity governance and NIST’s Cybersecurity Framework.

•

Explain the importance of strategic alignment

•

Know how to manage cybersecurity policies

•

Describe cybersecurity-related roles and responsibilities

•

Identify the components of risk management

•

Create polices related to cybersecurity, governance, and risk management

CHAPTER OVERVIEW This chapter focuses on cybersecurity policy requirements and the governance structure necessary to implement and manage cybersecurity policies. The chapter also discusses risk management.

CHAPTER OUTLINE I.

Understanding Cybersecurity Policies •

What is Governance?

•

What Is Meant by Strategic Alignment?

•

Regulatory Requirements

•

User-Level Cybersecurity Policies

•

Vendor Cybersecurity Policies

•

Cybersecurity Vulnerability Disclosure Policies 1

•

Client Synopsis of Cybersecurity Policies

•

Who Authorizes Cybersecurity Policy?

•

What Is a Distributed Governance Model?

•

Evaluating Cybersecurity Policies

•

Revising Cybersecurity Policies: Change Drivers

•

NIST Cybersecurity Framework Governance Subcategories and Informative References

• II.

III.

Regulatory Requirements

Cybersecurity Risk •

Is Risk Bad?

•

Understanding Risk Management

•

Risk Appetite and Tolerance

•

What Is a Risk Assessment?

•

Risk Assessments Methodologies

Summary

TEACHING NOTES AND TIPS PER TOPIC 1. Understanding Cybersecurity Policies Teaching Tip: Ensure students understand that cybersecurity policies are critical to any organization because their goal is protecting the organization from harm.

Teaching Tip: Influencing and defining culture is the role of leadership, so the signer should be seen as both a leader and a decision maker. The signer should also be seen as in touch with day-to-day operations, yet have enough authority to enforce the policy. Change drivers should trigger risk and vulnerability assessments and ultimately a review of policies.

Teaching Tip: The Cybersecurity Document policy should reference the federal (and state) regulations the organization is subject to. Each individual policy should have a cross reference notation to the specific regulatory section.

Teaching Tip: The policy owner is not the final authority. Ownership translates into developing, maintaining, and reviewing the policies and companion documents.

Teaching Tip: When discussing Governance, mention that the Board of Directors is usually responsible for overseeing the policy development. Effective security requires a distributed governance model with the active involvement of stakeholders, decision makers, and users.

Teaching Tip: Ask students to identify the roles of the Chief Information Security Officer (CISO).

2

2. Cybersecurity Risk Teaching Tip: Ensure students understand that risk management is the process of determining the acceptable level of risk. Risk management involves calculating the current risk level and deciding whether to accept the risk or take steps to reduce it.

Teaching Tip: Companies use risk assessment to calculate the level of risk. Explain that the company can decide to either accept the risk or mitigate the risk. To mitigate the risk, the company can take one of the following four actions: risk reduction, risk sharing, risk transference, risk avoidance, or a combination of these actions. Ask students to explain each of these actions and discuss when to use each action. Ask students to identify the risks of using third parties.

ACTIVITIES FOR CLASS I.

Discussion Questions A. Discussion Question 1 Why should a statement of authority reflect the organization’s culture?

Answer: Students’ answers will vary. The SOA should be thought of as a teaching tool sprinkled with a motivational “pep talk,” so the most effective communication will take into account the audience’s background, education, experience, age, and even native language. Corporate culture can be defined as the shared attitudes, values, goals, and practices that characterize a company or corporation.

B. Discussion Question 2 Ideally, who is involved in designing and maintaining a secure organizational environment?

Answer: Students’ answers will vary. This is a huge undertaking that requires input from professionals throughout an organization, including members of management, developers, network engineers and administrators, Human Resources, and legal and financial communities. Following the rules is possible only if the infrastructure is designed in such a way that following the rules is easy and doesn’t hinder performance or productivity, which requires input from all levels of the organization.

II.

Web Projects A. Web Project 1 Visit the home page for the Family Educational Rights and Privacy Act (FERPA) (http://www.ed.gov/offices/OII/fpco/ferpa/) to review some of the federal regulations your school is subject to. Discuss how your school complies with two of the regulations.

Notes: This project will help students explore the content of a major piece of federal legislation and how their school complies.

3

WEB RESOURCES •

http://www.247.prenhall.com/ Pearson product support

•

http://www.rmmagazine.com/ The Risk Management Magazine

•

http://www.isaca.org/Knowledge-Center/Risk-IT-IT-Risk-Management/Pages/Risk-IT1.aspx Risk IT Framework for managing IT-related business risks

4

Instructor’s Guide to Accompany DEVELOPING CYBERSECURITY PROGRAMS AND POLICIES CHAPTER 5 ASSET MANAGEMENT AND DATA LOSS PREVENTION

CHAPTER OBJECTIVES When students have finished reading this chapter, they will be able to: •

Assign information ownership responsibilities

•

Develop and use information classification guidelines

•

Understand information handling and labeling procedures

•

Identify and inventory information systems

•

Create and implement asset classification policies

•

Understand data loss prevention technologies.

CHAPTER OVERVIEW This chapter looks at the various methods and rating systems that organizations use to define, inventory, and classify their information and information systems. Such a classification system must communicate value and handling instructions to employees and vendors.

CHAPTER OUTLINE I.

Information Assets and Systems

II.

• Who Is Responsible for Information Assets?

Information Classification

III.

• How Does the Federal Government Classify Data?

• Why Is National Security Information Classified Differently?

• Who Decides How National Security Data Is Classified?

• How Does the Private Sector Classify Data?

• Can Information Be Reclassified or Even Declassified?

Labeling and Handling Standards 1

IV.

• Why Label?

• Why Handling Standards?

Information Systems Inventory

V.

• Why an Inventory is Necessary and What Should Be Inventoried Understanding Data Loss Prevention Technologies

VI.

Summary

TEACHING NOTES AND TIPS PER TOPIC 1. Information Assets and Systems Teaching Tip: Emphasize that information assets are information used by a company (regardless of size) to fulfill its mission or goal. Many information assets are used to support internal operations, such as payroll.

Teaching Tip: Remind students that the information asset owner is liable and responsible for protecting the information and the business results derived from using that information (as opposed to merely updating the information). Every information asset needs an owner, but it is not always apparent or obvious who should be or is willing to assume the responsibility of ownership.

Teaching Tip: Responsibility for information security is often delegated to information custodians, whereas the information security officer ensures that appropriate controls are applied consistently throughout the organization.

2. Information Classification Teaching Tip: Mention that the objective of an information classification system is to differentiate data types. Classification systems are used in government, military, and private sector, and all these systems differ. Ask students to identify how information is classified by federal agencies, by military, and by private organizations.

Teaching Tip: Information may also need to be protected due to its intelligence value to others. Note to students that hacking begins with the process of gathering clues from information that is readily available.

Teaching Tip: Identify a web source for students to read the Freedom of Information Act. Lead a discussion into the merits of this act. Are there any drawbacks?

Teaching Tip: Discuss the following section of the textbook: FYI: What is NPPI and Why Protect It (pages 154 – 155). Ask students if they have been asked to provide NPPI information to a company or organization.

When is it necessary to provide a SSN, and when can you decline? Provide scenarios to students and ask if they are required to provide their SSN. Use this document for further discussion and historical information about social security numbers: https://www.ssa.gov/policy/docs/ssb/v69n2/v69n2p55.html.

3. Labeling and Handling Standards Teaching Tip: Information is classified for the sole purpose of identifying the level of protection necessary and communicating that information. The level of protection extends to the key areas of access, modification, duplication, transport, storage, records management, and disposal.

2

Teaching Tip: Discuss that labels are used to identify the data classification. Explain that labels can be in many different forms, such as, electronic, print, audio, and visual. Ask students to find an example of each type of label and share it with the class. Have students develop a data handling standards matrix for a college. Student can use the sample matrix on page 157, Table 5.1, as a guide.

4. Information Systems Inventory Teaching Tip: Many organizations don’t have an up-to-date inventory of their assets. Creating and maintaining comprehensive inventory is a major but important task that all companies should undertake.

Why do students think this is an area that is lacking in many companies?

Teaching Tip: The critical decision is choosing what attributes and characteristics of the information asset you want to record. Remember that over time your inventory may have multiple purposes.

Teaching Tip: Remind students that when asset names are detailed enough to be good identifiers, they are also important pieces of information to protect.

5. Understanding Data Loss Prevention Technologies Teaching Tip: Lead a discussion about data loss prevention (DLP). Have students identify the three basic types of data a DLP plan should target (PII, IP, NPI). Give examples of each.

Teaching Tip: Explore and discuss current, popular DLP software tools with students. Here are some resources: https://www.cisco.com/c/en/us/products/security/email-security-appliance/data-loss-prevention-dlp.html https://www.techradar.com/news/top-5-best-data-loss-prevention-services

ACTIVITIES FOR CLASS I.

Discussion Questions A. Discussion Question 1 Many organizations do not have an up-to-date inventory of information systems. What are the benefits of having such an inventory?

Answer: Students’ answers will vary. Identified benefits of an information systems inventory may include consolidation and/or merger of redundant systems (or information); improved business impact and disaster recovery planning; insurance coverage; business valuation; and enhanced criticality and risk analysis.

B. Discussion Question 2 What sorts of routine, seemingly unimportant information would help you learn about or break into another company’s network?

Answer: Student answers will vary. Possible answers include policy and procedure manuals, telephone and email lists, corporate web pages, network maps or other information (for example, server names), and discarded paperwork.

II.

Web Projects 3

A. Web Project 1 Review the information classification example from SANS Institute http://www.sans.org/readingroom/whitepapers/auditing/information-classification-who-846 ). Compare the recommendations with those given in this text. Summarize what you learn in a brief report.

Notes: Student answers will vary.

B. Web Project 2 Research the guidelines for data classification for a university of your choice. Compare and contrast your findings with the information presented in the textbook. Does it address information ownership and clearly define information classifications? Site examples to support your conclusions. Present your findings to the class.

Notes: Student answers will vary. Here is the link to one example of a university’s data classification policy provided by Carnegie Mellon: https://www.cmu.edu/iso/governance/index.html.

WEB RESOURCES •

http://www.247.prenhall.com/ Pearson product support

•

http://searchsecurity.techtarget.com/tip/1,289483,sid14_gci995767,00.html information classification

•

http://www.molemag.net/index.htm ISO 27001 and 27002 newsletters provide guidance on various practical issues, plus commentary on recent information security incidents.

•

https://en.wikipedia.org/wiki/Bell%E2%80%93LaPadula_model Wikipedia page for the Bell-LaPadula classification model

•

https://en.wikipedia.org/wiki/Biba_Model Wikipedia page for the Bibi classification model

•

https://www.ssa.gov/policy/docs/ssb/v69n2/v69n2p55.html U.S. Social Security Administration: The Story of the Social Security Number

•

https://www.cisco.com/c/en/us/products/security/email-security-appliance/data-loss-prevention-dlp.html Cisco: What is Data Loss Prevention (DLP)?

•

http://www.sans.org/reading-room/whitepapers/auditing/information-classification-who-846 SANS Institute whitepaper on information classification

4

Security tips on standardizing

Instructor’s Guide to Accompany DEVELOPING CYBERSECURITY PROGRAMS AND POLICIES CHAPTER 6 HUMAN RESOURCES SECURITY

CHAPTER OBJECTIVES When students have finished reading this chapter, they will be able to: •

Define the relationship between cybersecurity and personnel practices

•

Recognize the stages of the employee life cycle

•

Describe the purpose of confidentiality and acceptable use agreements

•

Understand appropriate security education, training, and awareness programs

•

Create personnel-related security policies and procedures

CHAPTER OVERVIEW This chapter is mapped to the ISO 27002:2013 Section 7 and addresses personnel issues as they relate to information systems security. Employees are simultaneously an organization’s most valuable asset and their most dangerous risk. The chapter ends with a discussion of the importance of security education and training and an overview of the Security, Education, Training, and Awareness (SETA) model.

CHAPTER OUTLINE I.

The Employee Life Cycle

•

What Does Recruitment Have to Do with Security?

•

What Happens in the Onboarding Phase?

•

What Is User Provisioning?

•

What Should an Employee Learn During Orientation?

•

Why Is Termination Considered the Most Dangerous Phase?

II.

The Importance of Employee Agreements •

What Are Confidentiality or Nondisclosure Agreements?

1

• III.

IV.

What Is an Acceptable Use Agreement?

The Importance of Security Education and Training

•

Influencing Behavior with Security Awareness

•

Teaching a Skill with Security Training

•

Security Education Is Knowledge Driven Summary

TEACHING NOTES AND TIPS PER TOPIC 1.

The Employee Life Cycle Teaching Tip: The employee life cycle represents the stages in the employee’s career. Security needs should be considered in each of the stages of these processes to protect both company information and potential employees’ nonpublic personal information.

Teaching Tip: An organization needs to proactively protect itself by conducting background checks on potential employees and directors. To access classified information, the government requires not only a level of security clearance at least equal to the classification of the information but also an appropriate “need to know” the information.

Teaching Tip: Common stages of the employee lifecycle include: recruitment, onboarding, user provisioning, orientation, career development, termination, and off-boarding. Have students identify the various processes occurring in each step.

Teaching Tip: Job postings are one of the sources that intruders often look to use for information that can be used in social engineering attacks and provide a path to more in-depth knowledge. Ask students how information regarding specific systems, software, security features, or access controls in a job description can be misused.

Teaching Tip: Interviewers often reveal much more than they should to early-stage job candidates. Ask if any students have experienced this during an interview; or share a personal experience.

2.

The Importance of Employee Agreements Teaching Tip: Employees, contractors, and outsourcers are commonly required to sign two basic agreements: a confidentiality agreement and an acceptable use agreement.

Teaching Tip: Ask students what should be included in an acceptable use agreement. Have students discuss the expectation of privacy at the workplace. Ask students to share their opinion on whether employers should monitor employees’ Facebook and other social networking profiles.

3.

The Importance of Security Education and Training Teaching Tip: According to the National Institute of Standards and Technology (NIST), “the ‘people factor’—not technology—is key to providing an adequate and appropriate level of security.”

2

Teaching Tip: Have students discuss why security education and training is important. Have students identify the type of training that should be included in a security education program and how often these programs should be conducted. Ask students to identify current awareness programs and program goals.

ACTIVITIES FOR CLASS I.

Discussion Questions A. Discussion Question 1 Why does the U.S. government require both a level of security clearance (at least equal to the classification of the information) and an appropriate “need to know” before information is released to an individual?

Answer: Student answers will vary. Merely having a certain level of security clearance does not authorize an individual to access all information so classified. Information must be closely held to be protected, so requiring both an equivalent security clearance and an authorized “need to know” restricts access appropriately. Background checks are more stringent for higher security clearance levels.

B. Discussion Question 2 What should be included in an acceptable use agreement?

Answer: Student answers will vary, but at a minimum the following components should be included in an acceptable use agreement: introduction, data classifications, applicable policy statement, handling standards, contacts, violations section, and acknowledgment.

II.

Web Projects A. Web Project 1 Go to the website for your local newspaper and select three job ads. For each ad, list the organizational information that is given in the ad. Which ad gives the most important information?

Notes: Student answers will vary. This project can help students understand the types of information that can inadvertently be given in a job ad. (Local job ads often reveal more information than those specifically developed for posting to online services.)

B. Web Project 2 Go to the website for your local newspaper and find a job description attached to an ad. Edit the job description to create one version for the ad posting and another version for final candidates who have passed the initial interviews.

Notes: Student answers will vary. This project can help students understand the types of information that can inadvertently be given in a job description.

3

WEB RESOURCES •

http://www.247.prenhall.com/ Pearson product support

•

https://www.glassdoor.com/, http://www.monster.com, http://www.careerbuilder.com, and http://www.indeed.com/ Popular Internet-based job hunting sites

•

http://csrc.nist.gov Computer Security Response Center, a comprehensive portal to information security resources

•

http://www.sans.org/security-resources/policies/Acceptable_Use_Policy.pdf Sample acceptable use policy

4

Instructor’s Guide to Accompany DEVELOPING CYBERSECURITY PROGRAMS AND POLICIES CHAPTER 7 PHYSICAL AND ENVIRONMENTAL SECURITY

CHAPTER OBJECTIVES When students have finished reading this chapter, they will be able to: •

Define the concept of physical security and how it relates to information security

•

Evaluate the security requirements of facilities, offices, and equipment

•

Understand the environmental risks posed to physical structures, areas within those structures, and equipment

•

Enumerate the vulnerabilities related to reusing and disposing of equipment

•

Recognize the risks posed by the loss or theft of mobile devices and media

•

Develop policies designed to ensure the physical and environmental security of information, information systems, and information-processing and storage facilities

CHAPTER OVERVIEW Section 11 of the ISO 27002:2013 is dedicated to physical and environmental security with the objective of maintaining a secure physical environment. This chapter discusses the importance of physical and environmental security and related policies and procedures.

CHAPTER OUTLINE I.

Understanding the Secure Facility Layered Defense Model

•

How Do We Secure the Site?

•

How Is Physical Access Controlled?

II.

Protecting Equipment •

No Power, No Processing 1

•

How Dangerous Is Fire?

•

What About Disposal?

•

Stop, Thief!

III.

Summary

TEACHING NOTES AND TIPS PER TOPIC 1.

Understanding the Secure Facility Layered Defense Model Teaching Tip: Physical security is one of the most important domains of a comprehensive information security program. In a secure area, the assets are protected from both man-made and natural harm. A layered defense model ensures that if an intruder bypasses one level of access controls, there are additional layers that can stop and prevent the attack.

Teaching Tip: The policy should also define the work environment in secure areas: how will people be allowed access, how will they be supervised and monitored, and what will be done to secure these areas when there are no personnel present? Have students brainstorm and develop a layered defense model for a campus location.

2.

Protecting Equipment Teaching Tip: The protection of company and employee-owned equipment involves defining how equipment should be used, sited, maintained, and even disposed of. Unattended equipment and paper records, and even the position of computer monitors, enable information theft.

Teaching Tip: Remind students that protection of equipment from power outages and power spikes, as well as protection of cabling, must be considered.

Teaching Tip: Data can be recovered even from reformatted drives, so sanitizing or destroying the information resident on old computers and other devices is an important part of information security.

Teaching Tip: Everyone thinks about protecting property from theft, yet many people ignore the possibility of information theft and take few, if any, precautions. Have students list valuable information that may be stolen from them or from a business they have worked for. Ask students what precautions they take (or the business requires) to prevent information theft.

ACTIVITIES FOR CLASS I.

Discussion Questions A. Discussion Question 1 Why would a business want critical information processing facilities to be inconspicuous? Third-party data centers are not inconspicuous, so how do businesses protect critical assets located in these places?

2

Answer: Students’ answers will vary. Basically, critical information processing facilities should be inconspicuous so that attention is not drawn to them. To steal information, you first have to find it. Thirdparty data centers are also relatively inconspicuous. The data center is often located away from the sales offices. Within the data center, extraordinary physical and environmental security policies and procedures should be in place because each client’s property needs to be isolated and protected from that of other clients as well.

B. Discussion Question 2 Who poses a threat to a business’s physical and environmental security?

Answer: Student answers will vary. The key here is that students realize that employees are as much of a threat as persons outside the organization, and the threat comes from intentional as well as accidental harm (for example, spilling a drink on a keyboard).

II.

Web Projects A. Web Project 1 Review the National Institute of Standards and Technology National Institute of Standards and Technology Generally Accepted Principles and Practices for Securing Information Technology Systems: http://csrc.nist.gov/publications/nistpubs/800-14/800-14.pdf. Thinking of a business where you have worked, assess the business’s compliance with these guidelines. What areas are under- or unprotected?

What are the dangers?

Notes: Student answers will vary. This project can help heighten student awareness of physical and environmental security issues.

B. Web Project 2 Compare and contrast Chapter 15, Physical and Environmental Security, of NIST’s Special Publication 800-12 (https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-12.pdf) with Chapter 7 of your textbook. What new topics are covered? Where do these resources disagree?

Notes: Student answers will vary. This project can help students understand the variety of issues affecting physical and environmental security.

C. Web Project 3 Have students access the Amazon Web Services whitepaper discussed in the “FYI: How Can you Ensure Physical Security of Assets When your Data and Applications are in the Cloud?” textbook section on page 210. Alternatively, locate another cloud service company’s policy. Write a brief paper identifying policy on: fire detection, data center power system requirements and design, climate and temperature control standards, management and monitoring of systems and equipment’s, and storage device decommissioning requirements.

Notes: Student answers will vary depending upon the company policy researched.

3

WEB RESOURCES •

http://www.247.prenhall.com/ Pearson product support

•

http://it.emory.edu/security/standards/physical_environmental_security.html environmental security guidelines for Emory University

•

https://csrc.nist.gov/publications/white-paper NIST Computer Security Resource Center’s list of publications

•

https://d1.awsstatic.com/whitepapers/Security/AWS_Security_Whitepaper.pdf Overview of Security Processes

•

https://www.microsoft.com/en-us/cybersecurity/default.aspx Home page for Microsoft’s Cybersecurity policy

4

Comprehensive physical and

Amazon

Web

Services:

Instructor’s Guide to Accompany DEVELOPING CYBERSECURITY PROGRAMS AND POLICIES CHAPTER 8 COMMUNICATIONS AND OPERATIONS SECURITY

CHAPTER OBJECTIVES When students have finished reading this chapter, they will be able to: •

Create useful and appropriate standard operating procedures

•

Implement change control processes

•

Understand the importance of patch management

•

Protect information systems against malware

•

Consider data backup and replication strategies

•

Recognize the security requirements of email and email systems

•

Appreciate the value of log data and analysis

•

Evaluate service provider relationships

•

Understand the importance of threat intelligence and information sharing

•

Write policies and procedures to support operational and communications security

CHAPTER OVERVIEW This chapter focuses on daily use and protection of information assets and information systems, as detailed in section 12 of the ISO 27002:2013 standard, Operations Security and Section 13 Communications Security. Security functions such as: standard operating procedures (SOPs), change management, malware protection, data replication, securing messaging, and activity monitoring are discussed in this chapter.

CHAPTER OUTLINE I.

Standard Operating Procedures 1

II.

III.

IV.

•

Why Document SOPs?

•

Developing SOPs

Operational Change Control •

Why Manage Change?

•

Why Is Patching Handled Differently?

Malware Protection •

Are There Different Types of Malware?

•

How Is Malware Controlled?

•

What Is Antivirus Software?

Data Replication •

V.

VI.

Secure Messaging •

What Makes Email a Security Risk?

•

Are Email Servers at Risk?

•

Other Collaboration and Communication Tools

Activity Monitoring and Log Analysis •

VII.

VIII.

What Is Log Management?

Service provider Oversight •

What Is Due Diligence?

•

What Should Be Included in Service Provider Contracts?

Threat Intelligence and Information Sharing •

IX.

Is There Recommended Backup or Replication Strategy?

How Good Is Cyber Threat Intelligence if It Cannot Be Shared?

Summary

TEACHING NOTES AND TIPS PER TOPIC 1.

Standard Operating Procedures Teaching Tip: Well written standard operating procedures (SOPs) should provide directions, improve communication, reduce training time, and improve work consistency.

Teaching Tip: Students should understand the importance of documenting SOPs. Open discussion by using an analogy: What would happen if a new professor were there at the next class? Students should discover through discussion that the syllabus is an SOP of sorts for the class.

Teaching Tip: Distinguish between repetitive steps and decision points by asking students how the procedures for a fire drill should be documented (probably a simple step format). Next ask students how the procedures for class registration should be documented. (Students will suggest hierarchical, but help 2

them see that the various decisions to be made—for example, what to do if a course is closed—are best handled in the flowchart format).

2.

Operational Change Control Teaching Tip: Operational Change Control is an internal procedure by which only authorized changes are made to software, hardware, network access privileges, or business processes. All changes should be documented.

Teaching Tip: Have students consider a scenario in which the change goes wrong (for example, applying a routine email patch downs the email server). They should relate with anecdotes from their personal or work experiences. No matter how routine or trivial a change appears, there is the possibility of failure.

Assessment includes consideration of risks and a tested and approved recovery plan if the unexpected happens.

3.

Malware Protection Teaching Tip: Malware encompasses a range of programs and code including viruses, worms, spyware, Trojan horses, key loggers, and logic bombs, among others.

Teaching Tip: Ask students to identify the different types of malware available, and discuss ways to protect against malware. Have students research and discuss recent types of ransomware. Discuss common misperceptions of antivirus software with students: To be effective, it must be continually and routinely updated (automatic updates are best) and it protects best against only one type of malware.

Teaching Tip: Discuss the example of a call to 911 as an incident reporting procedure. Help students see that these calls are self-selected emergencies, but that 911 operators follow incident response procedures to classify the call’s severity and handle the incident.

4.

Data Replication Teaching Tip: Backing up data protects data availability and data integrity for both organizations and individuals. Backup and restore solutions must be periodically tested to be sure they function as planned.

Teaching Tip: Lead students into a discussion of the advantages and disadvantages of cloud storage and backup.

5.

Secure Messaging Teaching Tip: Although email has become the most widely used application in the world, basic email is often an insecure way to communicate. The NIST publication 800-177, Trustworthy Email, recommends practices for improving email security.

Teaching Tip: Ask students about security weaknesses in email systems. Discuss how a “weakness” is recognized by users. What is a “weakness”?

Teaching Tip: Ask students to identify other messaging and communication tools used by companies, in addition to email. Lead a discussion about the risks imposed by other types of collaboration tools.

6.

Activity Monitoring and Log Analysis

3

Teaching Tip: Routine logging and log analysis is beneficial for identifying security incidents, policy violations, fraudulent activity, and operational problems.

Teaching Tip: Mention that monitoring is not only important to identify incidents and policy violation, but it might also be required to comply with various laws and regulations. Ask students to research what regulations require companies to perform due diligence and monitor user activities.

7.

Service Provider Oversight Teaching Tip: Operational security extends to service providers. Service providers’ controls should meet or exceed those of the contracting organization.

Teaching Tip: Stress to students that even if the company outsources the work, it is still legally responsible for the confidentiality, integrity, and availability of data.

Teaching Tip: Lead a discussion on topics that should be covered in a service provider contract.

8.

Threat Intelligence and Information Sharing Teaching Tip: Companies and organizations may use threat intelligence to understand how “the enemy” may be most likely to compromise security.

Teaching Tip: Have students identify various sources for gathering threat intelligence data. Some examples are outlined in the FYI: Open Source Intelligence (OSINT) section of the textbook (page 279). Additionally, The Information Sharing and Analysis Centers (ISAC) provides shared information on threats.

ACTIVITIES FOR CLASS I.

Discussion Questions A. Discussion Question 1 How can companies ensure emails are secure?

Answer: Student answers will vary.

B. Discussion Question 2 Why is change logging so important?

Answer: Student answers will vary. No company wants to be in a situation in which it is uncertain what was done. Most problem solving depends upon knowing what has been done previously and in what order. When in doubt, it should be as simple as looking up a log and finding the date, time, and identity of the employee/contractor who handled the task.

II.

Web Projects A. Web Project 1 4

Use the Internet to find and research three firms that specialize in media and data destruction. What differences do you notice between the firms? Present your findings to the class.

Notes: Student answers will vary.

B. Web Project 2 Do research online and then present your view on whether employers can monitor employees’ actions? Discuss what employers can legally monitor and what expectation of privacy employees have if they are bringing their own devices to work.

Answer: Student answers will vary.

WEB RESOURCES •

http://www.247.prenhall.com/ Pearson product support

•

http://en.wikipedia.org/wiki/Malware#Academic_Research_on_Malware:_A_Brief_Overview entry on malware

•

http://www.csoonline.com/ Online resource for security executives

•

http://www.scmagazine.com/us/ Website of SC media, a cybersecurity source

•

https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-177.pdf NIST’s whitepaper on Trustworthy Email

•

https://www.fedramp.gov Federal Risk and Authorization Management Program’s (FedRAMP) information on a standardized approach to security assessment and monitoring for cloud services

•

https://www.nationalisacs.org/member-isacs National Council of ISACs

5

Wikipedia’s

Instructor’s Guide to Accompany DEVELOPING CYBERSECURITY PROGRAMS AND POLICIES CHAPTER 9 ACCESS CONTROL MANAGEMENT

CHAPTER OBJECTIVES When students have finished reading this chapter, they will be able to: •

Explain access control fundamentals

•

Apply the concepts of default deny, need-to-know, and least privilege

•

Understand secure authentication

•

Protect systems from risks associated with Internet connectivity, remote access, and telework environments

•

Manage and monitor user and administrator access

•

Develop policies to support access control management

CHAPTER OVERVIEW Organizations have the dual task of providing multiple methods of secure access while simultaneously denying access to unauthorized users. Organizations must also audit and monitor access to information assets and information systems to be alerted to potential security violations.

CHAPTER OUTLINE I.

II.

Access Control Fundamentals •

What Is a Security Posture?

•

How Is Identity Verified?

•

What Is Authorization?

•

Accounting

Infrastructure Access Controls •

Why Segment a Network?

1

III.

IV.

•

What Is Layered Border Security?

•

Remote Access Security

User Access Controls •

Why Manage User Access?

•

What Types of Access Should Be Monitored?

Summary

TEACHING NOTES AND TIPS PER TOPIC 1.

Access Control Fundamentals Teaching Tip: The two fundamental postures are open (default allow) and secure (default deny). The default organizational attitude toward security is reflected in its security posture.

Teaching Tip: It is important to show students that there is a balance to be achieved. Security cannot be so restrictive as to stop the wheels of business from turning. But organizations need to realize that security plays a major role in accomplishing the mission of the organization, even though it is not the mission itself.

A good example is a bank teller who has access to only one cash drawer, not the other tellers’ drawers and not the safe or safe deposit boxes, and so on. Emphasize to students that although not always convenient for individual employees, balance between security needs and the business need for productivity is often found with least privilege.

Teaching Tip: Emphasize to students that because hackers target user accounts when access has been gained to an organization’s network, this function should be one of the more strictly controlled functions of user management.

Teaching Tip: Remind students that special privilege accounts should be used only when the activity being performed requires the special privilege. Every person with a special privilege account should also have a basic user account with which to perform duties that do not require escalated privileges (for example, checking email). Although inconvenient, it keeps special accounts secure because malicious code will run in the security context of the logged-in user.

Teaching Tip: It cannot be emphasized enough that passwords should be secure (strong) and unique. (The same password is not used for multiple websites or applications by the same user.) No one should know a user’s password. They can too easily be misused by unauthorized people to gain access to information resources.

Teaching Tip: Have students discuss the differences between single-factor authentication, multifactor authentication, and multilayer authentication and provide examples of each type.

2.

Infrastructure Access Controls Teaching Tip: Remote access into internal networks often circumvents the perimeter protections and requires an additional analysis of risks that must be addressed with additional controls specific to remote access. Controls should be chosen based on the need for protection of each system to which remote access will be allowed.

2

Teaching Tip: Make sure students understand the goal of network segmentation and layered security. Ask students to decide how a campus network should be segmented and list the devices that can be used to implement layered security. Remind students that as much as possible, use of organizational information should be secured through the use of VPN and other remote access technologies so that no data is actually stored on a laptop (or other portable device). If the device is compromised, only generic data will be resident. If connectivity is not possible, then data stored on any portable device must be encrypted using only company-approved methods.

Teaching Tip: Distinguish telecommuting policy from mobile computing for students: Telecommuting policy addresses the means of communication and the infrastructure concerns associated with networks that are not under organizational controls.

3.

User Access Controls Teaching Tip: A policy must define what will be monitored as well as who will review all the logs generated, how often they will review them, and how long the logs will be retained in case they need to be referred to again.

Teaching Tip: Help students understand that the key here is in the regular and periodic review and auditing of all the information generated by all the systems on any given network. Gathering the information is easy; continually reviewing and assessing it is where the difficulty lies.

ACTIVITIES FOR CLASS I.

Discussion Questions A. Discussion Question 1 What makes a password secure?

Answer: Student answers will vary. Strong passwords are at least eight characters in length and contain mixed case letters, as well as numbers and symbols. Visit these sources for examples of strong password generators: https://passwordsgenerator.net/, https://my.norton.com/extspa/idsafe?path=pwdgen, http://www.goodpassword.com/.

B. Discussion Question 2 As the system administrator for a medium-sized company, how would you convince users that letting the computer operating system or browser application remember their passwords is against good security practices?

Answer: Student answers will vary. A system administrator might begin by reiterating the need for tight security (and the benefits to the organization of good security). A (management-approved) demonstration of how easily such a computer can be compromised, and the potentially devastating consequences would go a long way in convincing many users, especially if they understand that their identity will appear in the logs.

II.

Web Projects A. Web Project 1 3

On any Windows computer, explore the user access control settings from the control panel. Use this link for more information on the User Account Control works https://docs.microsoft.com/enus/windows/security/identity-protection/user-account-control/how-user-account-control-works. Present your findings to the class.

Notes: Student answers will vary.

B. Web Project 2 Make an argument for either single-factor or multiple-factor authentication in the workplace. Visit http://www.cnet.com/news/two-factor-authentication-what-you-need-to-know-faq/ and http://en.wikipedia.org/wiki/Strong_authentication for additional information to help you make your arguments. Consider cost, efficiency, and user compliance.

Notes: Student answers will vary. This project helps students explore an important access control issue and the associated trade-offs and benefits of each type of authentication.

WEB RESOURCES •

http://www.247.prenhall.com/ Pearson product support

•

https://csrc.nist.gov/publications/ NIST Computer Security Resource Center

•

https://csrc.nist.gov/News/2012/NIST-Interagency-Report-(IR)-7874 NIST Guidelines for Access Control System

•

https://www.securitysolutionsmedia.com/ Security Solutions Media home page

•

http://www.comptechdoc.org/independent/security/policies/remote-access-policy.html Sample remote access policy (other sample security policies including a mobile computer policy are available in the left navigation on the web page) from The Computer Technology Documentation Project, http://www.comptechdoc.org/.

•

http://www.nsa.gov/ia/ National Security Agency (NSA) division of Information Assurance

4

Instructor’s Guide to Accompany DEVELOPING CYBERSECURITY PROGRAMS AND POLICIES CHAPTER 10 INFROMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE

CHAPTER OBJECTIVES When students have finished reading this chapter, they will be able to: •

Understand the rationale for the systems development life cycle (SDLC)

•

Recognize the stages of software releases

•

Appreciate the importance of developing secure code

•

Be aware of the most common application development security faults

•

Explain cryptographic components

•

Develop policies related to systems acquisition, development, and maintenance

CHAPTER OVERVIEW This chapter focuses on different yet complementary aspects of security as it pertains to application development: building application systems, updating them, and securing the data that they provide.

CHAPTER OUTLINE I.

Systems Security Requirements

• • •

What Is SDLC? What About Commercially Available or Open Source Software?

The Testing Environment

• II. •

III.

Protecting Test Data Secure Code The Open Web Application Security Project (OWASP)

Cryptography • • •

Why Encrypt?

Regulatory Requirements What Is a “Key”?

1

• • •

IV.

What Is PKI? Why Protect Cryptographic Keys?

Digital Certificate Compromise

Summary

TEACHING NOTES AND TIPS PER TOPIC 1.

Systems Security Requirements of Systems Teaching Tip: Security should be one of the high-priority items during the design phase of any new application.

Teaching Tip: Discuss the Systems development lifecycle (SDLC). Have students identify each phase of the SDLC and explain what processes are occurring at each step.

2.

Secure Code Teaching Tip: Aspects of programming that distinguish secure and sloppy code are discussed in this section. The importance of input and output validation is also discussed.

Teaching Tip: Make it clear to students that secure code is always the result of careful planning that considers security as an element of the coding process from the beginning of the design phase through completion of the application. Sloppy code is everything else.

Teaching Tip: Help students understand that the generic idea behind input validation is to look at the characteristics of the expected data, and then make sure that the actual data entered matches these characteristics before allowing it to be transmitted to the back-end database.

Teaching Tip: Students do not always realize that even an application’s error messages can give valuable clues to hackers.

3.

Cryptography Teaching Tip: The art and science of writing secret information is called cryptography and has been around throughout history. Ensure that students can identify the three goals of cryptography: confidentiality, integrity, and authenticity /nonrepudiation.

Teaching Tip: Students often assume that cryptography is secure against most attacks. Emphasize that the two weaknesses of cryptography are keys that are not secured properly and keys that are so weak that they can be broken easily.

Teaching Tip: Digital signatures prove that the data integrity of an email message is intact and that the person shown in the email as the sender actually sent the email. However, it is important for students to understand that although digital signatures prove authenticity, they do not provide confidentiality.

2

ACTIVITIES FOR CLASS I.

Discussion Questions A. Discussion Question 1 Evaluate the following statement: To increase security, all data should be encrypted before transport.

Answer: Student answers will vary. Encrypted information takes longer to be transmitted and processed by all the computers involved in the transaction. The data needs to be encrypted prior to the transaction, and again decrypted by the target computer before it can be displayed or stored. Only data that is classified as sensitive should be transferred in encrypted format.

B. Discussion Question 2 Is it safe to install a minor software patch that is primarily a bug fix?

Answer: Student answers will vary. New and improved code releases, even bug fixes, should not be installed on production servers without testing. All software updates or upgrades MUST be tested in an environment similar to that in which the new code will be deployed to be sure that all other installed software continues to work as expected.

II.

Web Projects A. Web Project 1 Read the article “How to Write Insecure Code” at the Open Web Application Security Project (http://www.owasp.org/index.php/How_to_write_insecure_code). Which “recommendations” in this article create the greatest vulnerabilities in the resulting code? What overall programmer attitude results in the worst code? Based on this article, write a serious article that summarizes best practices for writing secure code.

Notes: This project leads students to explore the process of securing code through a nontechnical, tonguein-cheek article. Students should realize that all the vulnerabilities cited in the article are critical; any of them could result in serious security holes and risks. Programmers are exhorted to ignore standards, make code as complex as possible, and not document it.

B. Web Project 2 Conduct online research on the differences between public and private key encryption. Write a summary of the differences, advantages, and disadvantages of each.

Notes: Student answers will vary.

C. Web Project 3 Data encryption has been used throughout history. Research and site a historical example of encryption, and explain how it was used.

3

Notes: Student answers will vary. Some historical examples include Ancient Egypt’s use of hieroglyphics, Caesar’s cipher, and the Zimmerman telegram.

WEB RESOURCES •

http://www.247.prenhall.com/ Pearson product support

•

http://www.owasp.org/ The Open Web Application Security Project (OWASP), dedicated to finding and fighting the causes of insecure software

•

http://searchappsecurity.techtarget.com/ SearchAppSecurity.com is the online community for developers, architects, and executives interested in building secure enterprise applications

•

http://en.wikipedia.org/wiki/Cryptography Wikipedia article on cryptography

•

https://www.sans.org/critical-security-controls/http://www.sans.org/top20/ Network, Security) Institute: CIS Critical Security Controls

•

https://cwe.mitre.org/data/ Common Weakness Enumeration (CWE) home page; A community-driven list of common security weaknesses in software and hardware

4

The SANS (SysAdmin, Audit,

Instructor’s Guide to Accompany DEVELOPING CYBERSECURITY PROGRAMS AND POLICIES CHAPTER 11 CYBERSECURITY INCIDENT RESPONSE

CHAPTER OBJECTIVES When students have finished reading this chapter, they will be able to: •

Prepare for a cybersecurity incident

•

Identify a cybersecurity incident

•

Understand the incident response plan

•

Understand the incident response process

•

Understand information sharing and coordination

•

Identify incident response team structure

•

Understand federal and state data breach notification requirements

•

Consider an incident from the perspective of the victim

•

Create policies related to security incident management

CHAPTER OVERVIEW Security-related incidents are becoming more and more common. A single incident can prove catastrophic to a company beyond the point of recovery. Incident preparedness includes having policies, strategies, plan, and procedures.

CHAPTER OUTLINE I.

Incident Response • What Is an Incident?

• How Are Incidents Reported?

• What Is an Incident Response Program?

• The Incident Response Process 1

• • • • •

II.

III. IV.

Tabletop Exercises and Playbooks Information Sharing and Coordination Computer Security Incident Response Teams Product Security Incident Response Teams (PSIRTs) Incident Response Training and Exercises

What Happened? Investigation and Evidence Handling • • •

Documenting Incidents Working with Law Enforcement Understanding Forensic Analysis

Data Breach Notification Requirements

• Is There a Federal Breach Notification Law? • Does Notification Work?

Summary

TEACHING NOTES AND TIPS PER TOPIC 1. Incident Response Teaching Tip: Incident can be costly to companies. Every organization should have an incident response plan in place and should train employees to report all suspected incidents. Have students research the 10 most common incidents and discuss their findings.

Teaching Tip: Have students locate and evaluate NIST publications: SP 800-61 (latest revision) – Computer Security Incident Handling Guide SP 800-83 (latest revision) – Guide to Malware Incident Prevention and Handling SP 800-86 (latest revision) - Guide to Integrating Forensic Techniques into Incident Response These documents can be found at https://csrc.nist.gov/publications/.

2. What Happened? Investigation and Evidence Handling Teaching Tip: Every incident response plan should involve gathering evidence to determine the cause of the incident. Ensure that students understand why this is important. Include in the discussion that potential lawsuit or regulatory actions may occur.

3. Data Breach Notification Requirements Teaching Tip: Explain that most states have some form of data breach notification laws. Ask students to select one of the states, research its breach notification laws, and present their findings to the rest of the class.

ACTIVITIES FOR CLASS I.

Discussion Questions A.

Discussion Question 1 2

What should be included in an incident response plan?

Answer: Student answers will vary.

B.

Discussion Question 2 What is chain of custody and what is its role in a forensic investigation?

Answer: Chain of custody is used to prove that evidence has not been altered from the time it was collected through production in court.

II.

Web Projects A.

Web Project 1 Visit the following two sites that have examples of incident response plans at https://cdt.ca.gov/serp/?q=incident%20response%20plan http://www.mckinsey.com/insights/business_technology/how_good_is_your_cyberincident_respo nse_plan Develop an incident response plan based on the examples.

Notes: Student answers will vary.

B.

Web Project 2 Visit the following site to learn more about ransomware: http://blog.malwarebytes.org/intelligence/2013/10/cryptolocker-ransomware-what-you-need-toknow/.

How does this particular type of ransomware work? What can be done to protect against this malware? What can be done after the system has been infected?

Notes: This project can help students explore a new type of ransomware that encrypts information.

Student answers will vary.

WEB RESOURCES •

http://www.247.prenhall.com/ Pearson product support

•

http://www.forensicfocus.com/ Forensic Focus—computer forensics and data recovery news and discussion

•

https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf Incident Handling Guide

•

http://www.sans.org/reading-room/whitepapers/incident/computer-incident-response-team-641 Institute Computer Incidence Response Team guidelines

3

NIST

Computer

Security

SANS

•

https://digital-forensics.sans.org/blog/2018/01/08/meltdown-and-spectre-enterprise-action-plan SANS Digital Forensics and Incident Response Blog

•

https://www.youtube.com/watch?v=du6g__lgS3Q A Cybersecurity Simulation video via The Economist.

4

Instructor’s Guide to Accompany DEVELOPING CYBERSECURITY PROGRAMS AND POLICIES CHAPTER 12 BUSINESS CONTINUITY MANAGEMENT

CHAPTER OBJECTIVES When students have finished reading this chapter, they will be able to: •

Define a disaster

•

Appreciate the importance of emergency preparedness

•

Analyze threats, risks, and business impact assessments

•

Explain the components of a business continuity plan and program

•

Develop policies related to business continuity management

CHAPTER OVERVIEW Emergencies, disruptions, disasters, accidents, and injuries can occur any time. The primary objective of disaster response, recovery, and business continuity policies, plans, and procedures is to ensure continued operations by providing for the safety of employees and customers, protecting the organization’s assets, and restoring operating services after a business interruption.

CHAPTER OUTLINE I. II.

III.

Emergency Preparedness • What Is a Resilient Organization?

• Regulatory Requirements Business Continuity Risk Management • What Is Business Continuity Threat Assessment?

• What Is Business Continuity Risk Assessment?

• What Is Business Impact Assessment?

The Business Continuity Plan • Roles and Responsibilities • Disaster Response Plans • Operational Contingency Plans • The Disaster Recovery Phase 1

IV.

V.

• The Resumption Phase Plan Testing and Maintenance • Why Is Testing Important?

• Plan Maintenance Summary

TEACHING NOTES AND TIPS PER TOPIC 1. Emergency Preparedness Teaching Tip: The concept of disaster is defined and discussed, along with the need for an organization to assess potential disasters. Remind students that emergency preparedness is a civic duty and regulatory requirement. Without good risk assessment, organizations cannot plan effective responses.

2. Business Continuity Risk Management Teaching Tip: Instructions should be written as simply as possible, using short, direct sentences so that the reader can quickly understand and, if necessary, memorize the steps in the procedure. This documentation follows the same form as standard operating procedures (SOPs).

Teaching Tip: Explain that continuity planning involves ensuring the company can continue to perform essential business functions. Have students discuss the difference between business continuity threat assessment and business continuity risk assessment. Discuss the steps in performing a business impact analysis.

3. The Business Continuity Plan Teaching Tip: There are a myriad of roles and responsibilities in designing, approving, implementing, managing, and maintaining a business continuity plan. The goal of contingency plans is to continue to provide services to customers, comply with regulatory requirements, and continue internal operations during a period when information systems and/or a normal operating environment is not available.

Teaching Tip: Remind students that all roles should be predefined and documented. All participants should understand their roles and receive training (ahead of time!) where appropriate.

Teaching Tip: Emphasize to students that the business continuity team is a team of people, not a single individual, representing a cross-section of the organization and with a designated leader. A second-incommand person should be trained to assume the leader position because this team will operate in unpredictable situations.

Teaching Tip: Describe a call tree to students. Discuss alternative methods of notification. (For example, how do students learn about a school closing?) Ask students what must be done in advance to use either notification method.

Teaching Tip: Remind students that a disaster response can be orderly instead of chaotic when there are established procedures and responsibilities. Use a recent natural disaster that has occurred. Was there a continuity plan and was it successful? Compare it to other historical examples where planning and implementation failed (example: Hurricane Maria). Have students think through what would happen to a business (for example, a chain of pet food stores) that had not prepared. What have we learned from past natural disasters? Why is preparation important?

2

Teaching Tip: Discuss with students that plan activation also opens the door for a host of nonoperational business concerns, like public safety, employee relations, media relations, customer relations, and crime.

The business continuity plan needs to specify how these will be addressed and who is responsible.

Teaching Tip: Emphasize to students that it is not realistic to assume that all services and operations can continue after every disaster. Critical services and operations should have been identified during the risk assessment process before preparing the BCP. 4. Plan Testing and Maintenance Teaching Tip: The objective of a testing program is to ensure that plans and procedures are accurate, relevant, and operable under adverse conditions.

Teaching Tip: Strongly emphasize to students that proactive testing approaches are essential, as important as demonstrating success is uncovering inadequacies. The worst time to find out that your plans were incomplete, outdated, or just plain wrong is in the midst of a disaster. Remind students that the more essential the function, the more rigorous the testing program should be.

Teaching Tip: Help students understand that because business environments are dynamic, the BCP as well as the risk assessment and business impact analysis need to be reviewed on a scheduled basis to ensure that their components accurately reflect the needs of the organization.

Teaching Tip: A common mistake is to assume that the IT department is responsible for BCP. However, planning for business continuity is a wide-ranging, functional plan of action, not just a list of procedures for recovering information systems.

ACTIVITIES FOR CLASS I.

Discussion Questions A. Discussion Question 1 Why should the IT department not be solely responsible for business continuity?

Answer: Student answers will vary. Planning for business continuity is a wide-ranging, functional plan of action that needs to involve a cross-section of the organization in planning and execution, not just a list of procedures for recovering information systems.

B. Discussion Question 2 Why does plan activation open the door to a host of nonoperational business concerns?

Answer: Student answers will vary. For any organization, recovering from a disaster involves more than just restoring service to customers and continuing internal operations. The organization must communicate effectively with the media, as well as customers and employees. Public safety concerns must be addressed. Enhanced protection measures may be needed for personnel and property during recovery.

II.

Web Projects A. Web Project 1 3

Read more about American business attitudes toward public warning and business continuity, archived at the Partnership for Public Warning ( http://www.bridgemultimedia.com/eas/ppw.php).

Read the recommendations for emergency preparedness. Let’s say the CEO at your company believes that BCPs are not essential. He thinks that all that preparation is a waste of time, money and effort that is better directed toward current organizational challenges. How would you respond?

Notes: This project can help students explore the arguments for and against BCPs, while familiarizing themselves with relatively recent business practices (as expressed in the survey).

B. Web Project 2 Visit the Redmond, Washington website to learn about the different types of disasters it cataloged (http://www.redmond.gov/PublicSafety/DisasterPreparedness) and possible local impacts of these disasters. Which disasters are particularly critical for a business in Redmond, WA? Notes: This project can help students methodically explore various types of disasters. They should conclude that although some disasters are less likely to occur, all these disasters can be critical for a business.

WEB RESOURCES •

https://support.pearson.com/getsupport/s/ Pearson product support

•

http://www.continuitycentral.com/ Continuity Central provides a constantly updated one-stop resource of business continuity news, jobs, and information

•

http://en.wikipedia.org/wiki/Business_Continuity_Planning Planning

•

https://csrc.nist.gov/publications/detail/sp/800-34/rev-1/final NIST site to download Contingency Planning Guide for Federal Information Systems

4

The Wikipedia entry for Business Continuity

Instructor’s Guide to Accompany DEVELOPING CYBERSECURITY PROGRAMS AND POLICIES CHAPTER 13 REGULATORY COMPLIANCE FOR FINANCIAL INSTITUTIONS

CHAPTER OBJECTIVES When students have finished reading this chapter, they will be able to: •

Understand different financial institution cybersecurity regulatory compliance requirements

•

Understand the components of a GLBA-compliant information security program

•

Examine other financial services regulations, such as the New York Department of Financial Services (DFS) Cybersecurity Regulation

•

Prepare for a regulatory examination

•

Understand data privacy and new trends in international regulatory compliance

CHAPTER OVERVIEW This chapter examines, from a policy perspective, the regulations applicable to the financial sector. It focuses on Title 5 Section 501(b) of the Gramm-Leach-Bliley Act (GLBA) and discusses how federal examiners assess compliance with the various regulations. New York’s Department of Financial Services cybersecurity regulations are examined. The chapter concludes with a look at identity theft.

CHAPTER OUTLINE I.

II. III.

IV.

The Gramm-Leach-Bliley Act (GLBA) • What Is a Financial Institution?

• Regulatory Oversight • What Are Interagency Guidelines?

New York’s Department of Financial Services Cybersecurity Regulation What Is a Regulatory Examination • Examination Process • Examination Ratings Personal and Corporate Identity Theft • What Is Required by the Interagency Guidelines Supplement A? 1

• V.

What Is Required by the Supplement to the Authentication in an Internet Banking Environment Guidance?

Summary

TEACHING NOTES AND TIPS PER TOPIC 1. The Gramm-Leach-Bliley Act Teaching Tip: This important act’s history and impact are discussed as well as the Financial Privacy Rule.

Interagency Guidelines require that the Board of Directors or an appropriate committee of the Board approve a financial institution’s written information security program.

Teaching Tip: In “modernizing” financial services by ending regulations that prevented the merger of banks, stock brokerage companies, and insurance companies, the GLBA carries a high risk for misuse of information. However, Title 5 and Section 501(b) of GLBA as well as the Financial Privacy Rule specifically address protecting both the privacy and security of financial information.

Teaching Tip: Most important for students to realize is that the Safeguards Act is not as comprehensive as the Interagency Guidelines. In addition, organizations subject to the act are not audited for compliance unless a complaint is filed.

2. New York’s Department of Financial Services Cybersecurity Regulation (23 NYCRR Part 500) Teaching Tip: The Cybersecurity Requirements for Financial Service Companies document can be found at https://www.dfs.ny.gov/legal/regulations/adoptions/dfsrf500txt.pdf.

Teaching Tip: Ensure that students know there are overlapping regulation between this regulation and regulations covered under the GLBA. Which should be followed? What are the differences and similarities. Have students locate articles that discuss the difference and similarities. (Example: https://corpgov.law.harvard.edu/2017/03/25/new-york-cybersecurity-regulations-for-financialinstitutions-enter-into-effect/) 3. What Is a Regulatory Examination Teaching Tip: Students should understand the steps of a regulatory examination process.

Teaching Tip: Lead a discussion on the Uniform Rating System for Information Technology (URSIT).

Discuss and differentiate between the ratings of 1 -5.

4. Personal and Corporate Identity Theft Teaching Tip: Mention that identity theft is one of the fastest growing crimes worldwide. The regulatory agencies responsible for the U.S. banking sector have issued a supplement that describes response programs, including customer notification procedures, that a financial institution should develop and implement to address unauthorized access to or use of customer information that could result in substantial harm or inconvenience to a customer.

ACTIVITIES FOR CLASS I.

Discussion Questions 2

A. Discussion Question 1 Because privacy protections are already an inherent part of the GLBA, why is the Interagency Guidelines needed as a response to identity theft?

Answer: Student answers will vary. The Guidelines describes response programs, including timely customer notification procedures. The NPI data continues to be protected, but now customers as well as regulatory and law enforcement agencies are notified of attempts to access customer information systems.

B. Discussion Question 2 Ask students if they have personally been a victim of identity theft. Ask students to research recent cases of identity theft and identify the process victims of identity theft can follow to get their identity back.

Answer: Student answers will vary.

II.

Web Projects A. Web Project 1 Visit the Electronic Privacy Information Center (EPIC) (http://www.epic.org/privacy/glba/victoriassecret.html) to learn how a Victoria's Secret catalog was one of the key reasons that Congress included privacy protections for financial information when passing the Gramm-Leach-Bliley Act (GLBA). Are additional privacy protections necessary today? What technology advances are creating new sources of NPI or allowing other companies to access NPI? Write a letter to your senator describing your concerns.

Answer: This project leads students to explore privacy issues in more detail.

B. Web Project 2 Research the GLBA and summarize your findings. Include highlights of the important data protection requirements outlined in the regulation, and site resources.

Answer: Student answers will vary. Here is one valuable resource on How to Comply with the GLBA: https://www.ftc.gov/tips-advice/business-center/guidance/how-comply-privacyconsumer-financial-information-rule-gramm.

WEB RESOURCES •

https://support.pearson.com/getsupport/s/ Pearson product support.

•

http://www.ftc.gov/privacy/privacyinitiatives/glbact.html The FTC site for privacy initiatives covers the FTC’s Safeguards Rule and the Financial Privacy Rule

•

http://en.wikipedia.org/wiki/Gramm-Leach-Bliley_Act The Wikipedia article on the Gramm-Leach-Bliley Act (GLBA) 3

•

http://www.consumer.gov/idtheft/ The FTC’s identify theft website

4

Instructor’s Guide to Accompany DEVELOPING CYBERSECURITY PROGRAMS AND POLICIES CHAPTER 14 REGULATORY COMPLIANCE FOR THE HEALTH-CARE SECTOR

CHAPTER OBJECTIVES When students have finished reading this chapter, they will be able to: •

Explain health-care-related information cybersecurity regulatory compliance requirements

•

Understand the components of a HIPAA/HITECH-compliant information security program

•

Prepare for a regulatory audit

•

Know how to respond to an ePHI security incident

•

Write HIPAA-related policies and procedures

•

Understand the HIPAA compliance enforcement process

CHAPTER OVERVIEW This chapter examines the components of the HIPAA Security Rule and discusses the policies, procedures, and practices that health care entities need to implement to be considered compliant with HIPAA regulations. The chapter also discusses the changes to the HIPAA Security Rule and the HITECH Act and the Omnibus Rule.

CHAPTER OUTLINE I.

II.

The HIPAA Security Rule • What Is the Objective of the HIPAA Security Rule?

• How Is the HIPAA Security Rule Organized?

• What Are the Physical Safeguards?

• What Are the Technical Safeguards?

• What Are the Organizational Requirements?

• What Are the Policies and Procedures Standards?

• The HIPAA Security Rule Mapping to NIST Cybersecurity Framework The HITECH Act and the Omnibus Rule • What Changed for Business Associates?

• What Are the Breach Notification Requirements?

1

III. IV.

Understanding the HIPAA Compliance Enforcement Process Summary

TEACHING NOTES AND TIPS PER TOPIC 1.

The HIPAA Security Rule Teaching Tip: The HIPAA Security Rule focuses specifically on safeguarding electronic protected health information (ePHI) in both public and private sector entities that process, store, or transmit ePHI. Teaching Tip: The main goal of the HIPAA Security Rule is to protect the confidentiality, integrity, and availability of all electronic protected health information that a covered entity creates, receives, maintains, or transmits. The bottom line is that if covered entities subscribe to security best practices and principles, they will easily achieve compliance.

Teaching Tip: Point out to students that noncompliance with the HIPAA Security Rule can be used in liability cases. The penalties for noncompliance were significantly increased by the Omnibus Rule of up to $1,500,000 per violation per year.

Teaching Tip: Use figure 14-3 on page 506 to discuss how HIPAA rules are organized.

Teaching Tip: The Security Management Process §164.308(a)(1): The requirement is that covered entities have a formal security management process in place to address a full range of security issues.

Teaching Tip: Assigned Security Responsibility §164.308(a)(2): The requirement is to appoint a security official who is responsible for the development and implementation of the policies and procedures required for the entity.

Teaching Tip: Workforce Security §164.308(a)(3): The purpose of this standard is to ensure that there are appropriate policies, procedures, and safeguards in place regarding access to ePHI by the entire workforce.

Teaching Tip: Information Access Management §164.308(a)(4): The goal is to require that covered entities have formal policies and procedures for granting access to ePHI. Teaching Tip: Security Awareness and Training §164.308(a)(5) This regulation requires that the organization implements a security awareness and training program on specific topics.

Teaching Tip: Security Incident Procedures §164.308(a)(6): This regulation addresses both reporting of and responding to security incidents.

Teaching Tip: Contingency Plans §164.308(a)(7): The objective of this regulation is to establish (and implement as needed) policies and procedures for responding to an emergency or other occurrence that damages systems that contain ePHI. Teaching Tip: Evaluation §164.308(a)(8): This standard focuses on developing criteria and metrics for reviewing all standards and implementation specifications for compliance.

2

Teaching Tip: Business Associate Contracts and Other Arrangements §164.308(b)(1): Covered entities must obtain satisfactory assurances that business associates appropriately safeguard shared ePHI. Teaching Tip: HIPAA physical safeguard objective is to protect ePHI from unauthorized physical access.

Teaching Tip: HIPAA technical safeguard objective is to use technical controls to protect ePHI from unauthorized access.

Teaching Tip: HIPPA organizational requirement objective is to require contracts between covered entities and their business associates to meet the specific requirements to ensure the confidentiality, integrity, and availability of ePHI. Teaching Tip: The HIPAA Policies and Procedures Standards requires covered entities to implement reasonable and appropriate policies pursuant to the Security Rule. All policies, procedures, actions, activities, and assessments related to the Security Rule must be maintained in written or electronic form.

2.

The HITECH Act and the Omnibus Rule Teaching Tip: The HITECH Act was introduced in 2009 and the Omnibus Act in 2013.

Teaching Tip: Mention that the HITECH Act widened the scope of privacy and security protections available under HIPAA. Mention that the final rule amended the description of business associates and considerably increased the fines for violations. Ask students to research resent HIPAA violations and to discuss the fines and criminal charges that have been applied.

3.

Understanding the HIPAA Compliance Enforcement Process Teaching Tip: The DHHS Office of Civil Rights (OCR) Authority is responsible for investigating violations and enforcing HIPAA. If there is a criminal penalty involved, the Department of Justice has authority to bring criminal action against violators.

Teaching Tip: A source for How OCR enforces HIPAA: https://www.hhs.gov/hipaa/forprofessionals/compliance-enforcement/examples/how-ocr-enforces-the-hipaa-privacy-and-securityrules/index.html.

ACTIVITIES FOR CLASS I.

Discussion Questions A. Discussion Question 1 Why are covered entities required to obtain satisfactory assurances that business associates are appropriately safeguarding ePHI? Answer: Student answers will vary. Because business associates may not be covered entities under HIPAA (and therefore not subject to the Security Rule), a covered entity must require assurance that ePHI handled by business associates is protected.

B. Discussion Question 2 What is required for addressable implementation specifications under the HIPAA Security Rule?

3

Answer: Student answers will vary. For addressable specifications, covered entities must perform an assessment to determine whether the implementation specification is a reasonable and appropriate safeguard for implementation in the covered entity’s environment.

II.

Web Projects A. Web Project 1 Read about the issue of medical privacy versus health care quality: http://www.eurekalert.org/pub_releases/2005-05/uomh-mpv052305.php. How can these unintended limitations of HIPAA be overcome or mitigated?

Notes: This project can help students explore this significant regulation from another angle.

B. Web Project 2 HHS.gov provides case examples organized by entities of the HIPPA (https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/examples/byentity/index.html?language=en#2healthplanhmos). Choose a case example and write a brief outline documenting your findings.

Notes: Student answers will vary.

WEB RESOURCES •

https://support.pearson.com/getsupport/s/ Pearson product support

•

http://www.hhs.gov/ocr/privacy/hipaa/administrative/omnibus/ Description of the Omnibus Rule

•

http://en.wikipedia.org/wiki/Health_Insurance_Portability_and_Accountability_Act Health Insurance Portability and Accountability Act (HIPAA)

•

https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html Privacy Rule

•

http://www.hipaacomply.com/ The definitive source for up-to-date information regarding HIPAA security and privacy compliance

•

https://www.hhs.gov/hipaa/index.html Health Information Privacy site

Wikipedia article on

Summary of the HIPAA

https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/examples/how-ocr-enforces-the-hipaaprivacy-and-security-rules/index.html HHS site: How OCR Enforces the HIPAA Privacy & Security Rules

4

Instructor’s Guide to Accompany DEVELOPING CYBERSECURITY PROGRAMS AND POLICIES CHAPTER 15 PCI COMPLIANCE FOR MERCHANTS CHAPTER OBJECTIVES When students have finished reading this chapter, they will be able to: •

Understand the Payment Card Industry Data Security Standard (PCI DSS)

•

Recognize merchant responsibilities

•

Explain the 12 top-level requirements

•

Understand the PCI DSS validation process

•

Implement practices related to PCI compliance

CHAPTER OVERVIEW This chapter focuses on the requirements for protecting cardholder data. The Payment Card Industry Data Security Standard was released by the Payment Card Industry Security Standards Council in December 2004. The latest release at the time of this writing is version 3.2 published in April 2016.

CHAPTER OUTLINE I.

II.

III.

Protecting Cardholder Data • What is the PAN? • The Luhn Algorithm • What Is the PCI DSS Framework?

• Business-as-Usual Approach • Where Are the PCI Requirements?

PCI Compliance • Who Is Required to Comply with PCI DSS? • What Is a Data Security Compliance Assessment?

• What Is the PCI DSS Self-Assessment Questionnaire (SAQ)?

• Are There Penalties for Noncompliance?

Summary

1

TEACHING NOTES AND TIPS PER TOPIC 1.

Protecting Cardholder Data Teaching Tip: To counter the potential for staggering losses, the payment card brands—Visa, MasterCard, Discover, JCB International, and American Express— contractually require all organizations that store, process, or transmit cardholder data and/or sensitive authentication data comply with the PCI DSS. Teaching Tip: Ask students to identify what is considered account data. Ask students to discuss how account data should be protected.

Teaching Tip: Discuss the 12 top-level requirements and how they fit in the six core principles of the PCI DSS framework. Use figures 15-3 and 15-4 to discuss the core principles and requirements.

Teaching Tip: Ensure that students understand how to perform modulo-10 mathematics, and how this relates to the Luhn algorithm. Work through some examples to determine if a card number is a potentially valid number by applying the Luhn algorithm. Here are two resources that provide examples: https://www.geeksforgeeks.org/luhn-algorithm/ and https://en.wikipedia.org/wiki/Luhn_algorithm.

Teaching Tip: Ensure that students understand that the Luhn algorithm is designed to reduce accidental errors, not malicious attacks.

2.

PCI Compliance Teaching Tip: Stress that PCI compliance is not a government regulation or law but a contractual obligation that applies to entities involved in the payment card channel. Ask students to conduct an Internet research and compose a PCI compliance checklist that could be used by an online retailer. Ask students to compose a list for an offline merchant. Have students compare both checklists and discuss any differences.

ACTIVITIES FOR CLASS I.

Discussion Questions A. Discussion Question 1 How can companies protect cardholder data?

Answer: Student answers will vary.

B. Discussion Question 2 What are some malware that could be used to steal credit card information?

Answer: Student answers will vary.

II.

Web Projects A. Web Project 1

2

Read about the Target credit card breach that occurred in November 2013 at http://krebsonsecurity.com/2014/05/the-target-breach-by-the-numbers/ and http://www.nbcnews.com/business/consumer/millions-target-customers-credit-debit-cardaccounts-may-be-hit-f2D11775203. What could have Target done differently to avoid the data breach?

Notes: Student answers will vary.

B. Web Project 2 Examine the PCI compliance checklist at http://www.1stoppciscan.com/pci-compliance-checklist/.

Are there any additional items that should be included to the list?

Answer: Student answers will vary.

C. Web Project 3 Research online for examples of how skimmers work, and ways to detect them. Outline your findings in a brief report, and site your sources.

Notes: Student answers will vary. Two resources are: https://www.pcmag.com/article2/0,2817,2469560,00.asp and https://krebsonsecurity.com/allabout-skimmers/.

WEB RESOURCES •

https://support.pearson.com/getsupport/s/ Pearson product support.

•

https://www.pcisecuritystandards.org/ Description of the PCI Standard

•

https://www.pcisecuritystandards.org/merchants/ Information on how to ensure a business is PCI-compliant

•

https://www.pcicomplianceguide.org/ A guide on PCI compliance

•

https://en.wikipedia.org/wiki/Luhn_algorithm Wiki article on the Luhn algorithm

•

https://www.creditcards.com/credit-card-news/assets/Luhn.pdf A pdf to calculate the Luhn formula

3

Instructor’s Guide to Accompany DEVELOPING CYBERSECURITY PROGRAMS AND POLICIES CHAPTER 16 NIST CYBERSECURITY FRAMEWORKS CHAPTER OBJECTIVES When students have finished reading this chapter, they will be able to: •

Understand the overall goal of the NIST Cybersecurity Framework

•

Identify the Framework’s Core, Profile, and Implementation Tiers

•

Explain how the NIST Cybersecurity Framework can be used by any organization as a reference to develop a cybersecurity program

CHAPTER OVERVIEW This chapter examines the NIST Cybersecurity Framework and how it can serve as a security blueprint for any organization attempting to create a security program and analyze its cybersecurity risk.

CHAPTER OUTLINE I. II.

III. IV. V. VI. VII.

Introducing the NIS Cybersecurity Framework Components The Framework Core • Identify • Protect • Detect • Respond • Recover Framework Information Tiers • Who Should Coordinate the Framework Implementation?

NIST’s Recommended Steps to Establish or Improve a Cybersecurity Program • Communication with Stakeholders and Supply Chain Relationships NIST’s Cybersecurity Framework Reference Tool Adopting the NIST Cybersecurity Framework in Real Life Summary

1

TEACHING NOTES AND TIPS PER TOPIC 1.

Introducing the NIST Cybersecurity Framework Components Teaching Note: This section provides an overview of NIST’s Cybersecurity Framework, which consists of three parts: Framework Core, Framework Profiles, and Framework Tiers. Each of these is covered in more detail later in the chapter.

Teaching Tip: Use Figure 16-1 to review the three parts of the framework and the topics beneath each major part.

Teaching Tip: Stress that the framework is meant to complement existing risk management processes and cybersecurity programs. It does not replace other processes or programs. If an organization does not yet have any processes or programs, the framework can be used as an outline reference for developing them.

2.

The Framework Core Teaching Note: This section covers the functions defined in the NIST Cybersecurity Framework Core: Identify, Protect, Detect, Respond, and Recover.

Teaching Tip: Use Figure 16-3 to explain that each of the five functions has categories, subcategories, and informative references. The bulleted list at the bottom of page 586 explains what each of those consists of.

Teaching Tip: The diagrams in Figures 16-4 through 16-9 provide the categories for each function, and the categories are further described in the function sections on pages 587 through 591. NIST also has a spreadsheet students can download at https://www.nist.gov/cyberframework that provides the categories, subcategories, and informative references in full.

3.

Framework Implementation Tiers Teaching Note: This section covers the framework tiers defined in the NIST Cybersecurity Framework Tiers section: Partial, Risk-Informed, Repeatable, and Adaptive.

Teaching Tip: Point out that in the Core section, each function had different categories, but in the Tiers section, each tier has the same set of categories: • • • •

Risk Management Process Integrated Risk Management Program External Participation Cyber Supply Chain Risk Management

The definitions on pages 592-594 explain this in detail and can be used as a study guide for understanding the tiers and their categories.

Teaching Tip: Refer to Figure 16-11 to discuss the feedback loop between the organizational levels. The Business/Process level serves as a conduit between the Executive and the Implementation/Operations levels.

4.

NIST’s Recommended Steps to Establish or Improve a Cybersecurity Program Teaching Note: This section provides a seven-step process that NIST recommends to establish or improve a cybersecurity program. The seven steps are: Prioritize and scope; Orient, Create a current profile; Conduct 2

a risk assessment; Create a target profile; Determine, analyze, and prioritize any gaps; and Implement the action plan.

Teaching Tip: The steps in the process presented here can provide an effective action plan for a company that does not currently have a cybersecurity program in place. Ask students to estimate how long it might take a company starting from scratch to implement all seven steps in this process.

Teaching Tip: Ask students to think about how customer relationships and buying decisions can be affected by a company’s cybersecurity framework.

5.

NIST’s Cybersecurity Framework Reference Tool Teaching Note: This section describes NIST’s Cybersecurity Framework (CSF) Reference Tool, which allows users to navigate through the framework components and references. It is available from https://www.nist.gov/cyberframework/csf-reference-tool.

Teaching Tip: If possible, show a live version of the tool on a classroom PC. If not, refer to Figures 16-13 through 16-16 when discussing its features.

6.

Adopting the NIST Cybersecurity Framework in Real Life Teaching Note: This section discusses some practical concerns and considerations for implementing framework guidelines and dealing with overlapping and conflicting requirements.

Teaching Tip: Use Figure 16-17 to discuss the process of operationalizing cybersecurity activities based on the NIST framework.

Teaching Tip: Ask students to consider this scenario: Suppose your company needed to comply with all HIPAA cybersecurity guidelines. How would those guidelines fit within the NIST Cybersecurity framework? In which functions and categories would you place them?

ACTIVITIES FOR CLASS I.

Discussion Questions A. Discussion Question 1: What are some ways that the NIST Framework can be used to aid in communication with stakeholders and supply chain partners?

Answer: Student answers will vary. The bulleted list at the top of page 596 may be helpful in providing a few examples.

B. Discussion Question 2 When a company is looking for potential vendors/suppliers for a project, what would be the impact if the company asked vendors submitting proposals to provide information about their cybersecurity framework profile? How would that affect the supplier-customer relationship?

3

Answer: Student answers will vary. Some students may bring up that you would get fewer vendor applicants because of the additional requirement, but that the vendors who do comply may present a lower risk of security problems during the B2B relationship.

II.

Web Projects A. Web Project 1 What other tools are available for building and analyzing a company’s cybersecurity program besides the NIST Cybersecurity Framework you learned about in this chapter? Find at least one other tool, and write a paragraph about it.

Notes: Student answers will vary.

B. Web Project 2 At the beginning of this chapter, Executive Order 13636 is referenced. What executive orders are currently in effect in the United States that affect cybersecurity?

Notes: Student answers will vary depending on the current administration and their executive orders.

President Trump signed a cybersecurity executive order on May 11, 2017, which has three key priorities: to protect federal networks, to update antiquated and outdated systems, and to direct all department and agency heads to work together to view the federal IT as one enterprise network.

C. Web Project 3 There are many online articles providing advice in implementing the NIST Cybersecurity Framework in real-life businesses. Locate at least 5 articles and provide a one-paragraph description and review of each one.

Notes: Student answers will vary.

WEB RESOURCES •

https://support.pearson.com/getsupport/s/ Pearson product support

•

https://obamawhitehouse.archives.gov/the-press-office/2013/02/12/executive-order-improvingcritical-infrastructurecybersecurity Executive Order—“Improving Critical Infrastructure Cybersecurity”

•

https://www.congress.gov/bill/113th-congress/senate-bill/1353/text Cybersecurity Enhancement Act of 2014

•

https://www.nist.gov/cyberframework NIST Cybersecurity Framework

•

https://www.nist.gov/cyberframework/framework-resources-0 NIST Cybersecurity Framework Interactive Framework Resources

•

https://www.nist.gov/cyberframework/related-efforts-roadmap NIST Cybersecurity Framework Roadmap

4

•

https://securingtomorrow.mcafee.com/executive-perspectives/tried-nist-framework-works-2 Framework and It Works,” McAfee

•

https://www.nist.gov/sites/default/files/documents/cyberframework/cybersecurityframework_6thworkshop_intel_corp.pd f “Cybersecurity Framework: Intel’s Implementation Tools and Approach”

•

https://www.eac.gov/file.aspx?&A=Us%2BFqgpgVZw6CIHjBnD2tHKX0PKbwfShtOKsIx2kbEE%3D NIST Cybersecurity Framework to Elections

5

“We

Tried

the

NIST

Applying the