Diese Präsentation wurde erfolgreich gemeldet.
Die SlideShare-Präsentation wird heruntergeladen. ×

CYBER SECURITY and DATA PRIVACY 2022_How to Build and Implement your Company's Information Security Program

Anzeige
Anzeige
Anzeige
Anzeige
Anzeige
Anzeige
Anzeige
Anzeige
Anzeige
Anzeige
Anzeige
Anzeige

Hier ansehen

1 von 61 Anzeige

CYBER SECURITY and DATA PRIVACY 2022_How to Build and Implement your Company's Information Security Program

Data is one of your business’s most valuable assets and requires protection like any other asset. How can you protect your data from unauthorized access or inadvertent disclosure?

An information security program is designed to protect the confidentiality, integrity, and availability of your company’s data and information technology assets. Federal, state, or international law may also require your business to have an information security program in place.

This webinar will provide the basics of how to create and implement an information security program, beginning with identifying your incident response team, putting applicable insurance policies into place, and closing any gaps in the security of your data.


Part of the webinar series:
CYBERSECURITY & DATA PRIVACY 2022

See more at https://www.financialpoise.com/webinars/

Data is one of your business’s most valuable assets and requires protection like any other asset. How can you protect your data from unauthorized access or inadvertent disclosure?

An information security program is designed to protect the confidentiality, integrity, and availability of your company’s data and information technology assets. Federal, state, or international law may also require your business to have an information security program in place.

This webinar will provide the basics of how to create and implement an information security program, beginning with identifying your incident response team, putting applicable insurance policies into place, and closing any gaps in the security of your data.


Part of the webinar series:
CYBERSECURITY & DATA PRIVACY 2022

See more at https://www.financialpoise.com/webinars/

Anzeige
Anzeige

Weitere Verwandte Inhalte

Weitere von Financial Poise (20)

Aktuellste (20)

Anzeige

CYBER SECURITY and DATA PRIVACY 2022_How to Build and Implement your Company's Information Security Program

  1. 1. 2 Practical and entertaining education for attorneys, accountants, business owners and executives, and investors.
  2. 2. Disclaimer The material in this webinar is for informational purposes only. It should not be considered legal, financial or other professional advice. You should consult with an attorney or other appropriate professional to determine what may be best for your individual needs. While Financial Poise™ takes reasonable steps to ensure that information it publishes is accurate, Financial Poise™ makes no guaranty in this regard. 3
  3. 3. 4 Thank You To Our Sponsors
  4. 4. Meet the Faculty MODERATOR: Kathryn Nadro - Sugar, Felsenthal, Grais & Helsinger LLP PANELISTS: Jeff Sauntry – Risk Neutral Alison Schaffer - Jump Trading Group Alex Sharpe - Sharpe LLC 5
  5. 5. About This Webinar- How to Build and Implement your Company's Information Security Program Data is one of your business’s most valuable assets and requires protection like any other asset. How can you protect your data from unauthorized access or inadvertent disclosure? An information security program is designed to protect the confidentiality, integrity, and availability of your company’s data and information technology assets. Federal, state, or international law may also require your business to have an information security program in place. This webinar will provide the basics of how to create and implement an information security program, beginning with identifying your incident response team, putting applicable insurance policies into place, and closing any gaps in the security of your data. 6
  6. 6. About This Series Cyber Security & Data Privacy 2022 Cybersecurity and data privacy are critical topics of concern for every business in today’s environment. Data breaches are a threat to every business and can cause both direct losses from business interruption and loss of data to indirect losses from unwanted publicity and damage to your business’s reputation. Compliance with a patchwork of potentially applicable state and federal laws and regulations may cost your business in terms of money and time. This series discusses the various laws and regulations that affect businesses in the United States and in Europe, as well as the best practices to use in creating an information security program and preparing for and responding to data breaches. Each Financial Poise Webinar is delivered in Plain English, understandable to investors, business owners, and executives without much background in these areas, yet is of primary value to attorneys, accountants, and other seasoned professionals. Each episode brings you into engaging, sometimes humorous, conversations designed to entertain as it teaches. Each episode in the series is designed to be viewed independently of the other episodes so that participants will enhance their knowledge of this area whether they attend one, some, or all episodes. 7
  7. 7. Episodes in this Series #1 Introduction to US Privacy and Data Security: Regulations and Requirements Premiere date: 08/03/22 #2: Introduction to EU General Data Protection Regulation: Planning, Implementation, and Compliance Premiere date: 9/07/22 #3: How to Build and Implement your Company's Information Security Program Premiere date: 10/12/22 #4: Data Breach Response: Before and After the Breach Premiere date: 11/09/22 8
  8. 8. Episode #3: How to Build and Implement your Company's Information Security Program 9
  9. 9. Introduction • Information security programs are a documented set of a company or agency’s information security policies, guidelines and procedures • Majority of security programs aim to assess risk, monitor threats, and mitigate cyber security attacks • Implemented in any industry that deals with personally identifiable information or other sensitive information or systems
  10. 10. What is Information Security (INFOSEC)? • The protection of information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide confidentiality, integrity, and availability of information - Intellectual Property (IP) - Confidential, private, and sensitive information, or - information in all forms, both digital and physical • Protection important during storage, processing, transmission
  11. 11. Information Security (INFOSEC) vs. Cybersecurity vs. Information Assurance (IA) • Share the common goals of protecting the confidentiality, integrity, and availability of information • Terms are often used interchangeably but do not have the exact same meaning • All three terms are concerned with the CIA Triad • INFOSEC scope is information in all forms (i.e., digital and paper) • Cybersecurity is information in digital form • IA are the measures that protect and defend information and information systems by ensuring their availability, integrity, authentication - Basically, a term for INFOSEC used in select committees
  12. 12. Motivation to Create an Information Security Program (ISP) • 60% of global revenues are from digital sources • More than 50% of corporate valuations are based on intangible assets • Cyber risk is intrinsic to the modern business world • Cyber risk is now a board conversation • Required by: - regulation - legislation - customers - vendors - suppliers
  13. 13. The Purpose • Different institutions may create ISPs for various reasons, but they generally share few similarities, including - √ Establish a general approach to information security √ Detect and forestall the compromise of information security (i.e. misuse of data, networks, computer systems and applications √ Protect reputation of the company with respect to its ethical and legal obligations √ Recognize the rights of customers o i.e. providing effective mechanism for responding to complaints
  14. 14. The Scope • Generally, ISPs address: √ All data √ Programs √ Systems √ Facilities √ Other tech infrastructure
  15. 15. Information Security Objectives • An organization looking to implement ISP needs to have well-defined objectives • Information security systems are deemed to safeguard 3 main objectives - √ Confidentiality √ Integrity √ Availability
  16. 16. Information Security Programs – Then and Now • Early information security efforts identified confidentiality, integrity, and availability (“CIA Triad”) as primary security factors • The rise of information security programs - √ 1967 - military computers were hacked and CIA Triad found to be inadequate - not much was changed √ 1970s - “phreakers” exploit vulnerabilities in telephone network to make free long- distance calls √ 1980s - First National Bank of Chicago hacked for $70 million √ 1990s & 2000s - computers become targets as more people provide personal information online
  17. 17. The CIA Triad • Confidentiality √ Controlling who gets to access information √ Ensuring only individuals who need access to this information to do their jobs get that access √ Access restricted to only authorized individuals • Integrity √ Ensuring information and programs are changed only in a specified and authorized manner o i.e. information has not been tampered with or deleted by those with unauthorized access
  18. 18. The CIA Triad (cont’d) • Availability √ Ensuring authorized users have continued access to information and resources o Information is readily available to those who need it to successfully conduct an organization’s business
  19. 19. What Information is Protected? • Anything of value or any information required to be protected by law or regulation • Examples: - Intellectual Property (IP) and proprietary information - Operational data (i.e., data which businesses cannot run without) - Required by: - law - regulation - contracts • Types of protected information can include: - private information - personally identifiable information - health information - information protected by GDPR, other data protection laws
  20. 20. Proposed Regulation and Rule Changes • SEC Proposed Rule Changes • Cyber Incidents • Board Composition • Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA), March 2022 • Creates legal protections • Provides guidance to companies that operate in critical infrastructure sectors, including a required reporting of cyber incidents within 72 hours • Requires ransom payments to be reported  Federal data laws that look a lot like a federal privacy law
  21. 21. SEC Proposed Rule In May 2022, SEC proposed amendments to its rules to enhance and standardize disclosures regarding cybersecurity risk management, strategy, governance, and incident reporting by public companies. Proposed amendments in 17 CFR 229, 232, 239, 240 and 249 would require: - Current reporting about material cybersecurity incidents - Periodic reporting to provide updates about previously reported cybersecurity incidents - Periodic reporting about cybersecurity policies and procedures - Reporting about board oversight of cybersecurity risk - Reporting about management’s role and expertise in assessing and managing cybersecurity risk and implementing cybersecurity policies and procedures
  22. 22. Relevant Laws and Other ISP Items • An ISP is likely to include reference to relevant laws √ i.e. HIPAA, GLBA, international data protection laws like the EU General Data Protection Regulation (GDPR) • ISP may also include - √ Virus Protection Procedure √ Intrusion Detection Procedure √ Remote Work Procedure √ Technical Guidelines √ Consequences for Non-compliance √ Disciplinary Actions √ Terminated Employees
  23. 23. Massachusetts Standard: 201 C.M.R. 17 • Standards for the Protection of Personal Information of Residents of the Commonwealth • Implemented in 2010 - the top personal information protection law in the US when enacted • Makes every person or entity that owns personal information of a Massachusetts resident to adopt a written information security program (WISP) designed with appropriate safeguards
  24. 24. Massachusetts Information System Law • In Massachusetts, every information security program must include: √ At least one employee maintaining the information security program; √ Identify foreseeable security risks, both internal and external; √ Employee security policies dealing with access and transportation of personal information outside of the business; √ Disciplinary measures for violations; √ Methods of how to prevent terminated employees from reaching personal information.
  25. 25. Massachusetts Information System Law (cont’d) √ Oversee third-party service providers by taking reasonably steps to adopt and maintain security measures consistent with the entity; √ Restrictions on stored personal information access; √ Regular monitoring to ensure compliance with the implemented information security program and stop unauthorized access; √ Annual review of the security program, or whenever there is a material change in the business practices; and √ Document any incident involving a security breach and actions taken in response to breaches, and any review of business practices to protect personal information, if necessary.
  26. 26. NY Department of Financial Services Cybersecurity Regulation, 23 NYCRR Part 500 • Requires that all financial service companies maintain an ISP √ Any company regulated by the Department of Financial Services √ Exceptions - o Organization with fewer than 10 employees, less than $5 million in gross annual revenue for three years, or less than $10 million in year-end total assets
  27. 27. NY Department of Financial Services Cybersecurity Regulation • The ISP must address: √ information security; √ data governance and classification; √ asset inventory and device management; √ access controls and identity management; √ business continuity and disaster recovery planning and resources; √ systems operations and availability concerns; √ systems and network security; √ systems and network monitoring;
  28. 28. NY Department of Financial Services Cybersecurity Regulation (cont’d) • The ISP must address: √ systems and application development and quality assurance; √ physical security and environmental controls; √ customer data privacy; √ vendor and Third Party Service Provider management; √ risk assessment; and √ incident response.
  29. 29. NY Stop Hacks and Improve Electronic Data Act (“SHIELD Act”) • Expands NY breach notification law and imposes data security program requirements on businesses that possess the private information of New York State residents - Applies regardless of whether the businesses have any physical presence in New York State • Program requirements include administrative, technical, and physical safeguards for detecting and responding to intrusions and maintaining security of information • Businesses subject to and in compliance with Gramm-Leach-Bliley, HIPAA, or the NY Dept. of Financial Services Cybersecurity Requirements are exempted from this requirement under the SHIELD Act
  30. 30. NY Stop Hacks and Improve Electronic Data Act (“SHIELD Act”) (cont’d) • Limited reprieve for “small businesses” with fewer than fifty employees, less than $3 million in gross revenues in the last three fiscal years, or less than $5 million in year-end total assets • Expands the definition of “private information” subject to NY data breach notification law • NY Attorney General can pursue civil penalties, but there is no private right of action
  31. 31. California Consumer Privacy Act • Effective January 1, 2020 (amendment called the California Privacy Rights Act effective January 1, 2023) • CCPA/CPRA mandated companies do the following: √ Inform consumers about the categories of personal information collected and the purposes for which the information is being used; √ Respond to verifiable consumer requests to access certain information; √ Allow customers to opt-out of the sale of their personal information; and √ Enable consumers (subject to carve outs) to request that businesses delete their personal information • CPRA will require annual cybersecurity audits for certain companies processing personal information that might present a “significant risk” to consumer privacy and security
  32. 32. California Consumer Privacy Act (cont’d) • Applies to business if they are businesses that collect and control California residents’ personal information, do business in California, and satisfy one of the following: √ Have annual gross revenues in excess of $25 million, or √ Receive or disclose the personal information of 50,000 or more California residents, households, or devices on an annual basis (increased to 100,000 as of January 1, 2023), or √ Derive 50 percent or more of their annual revenues from selling California residents’ personal information.
  33. 33. CCPA Private Right of Action • Limited private right of action for consumers whose information is exposed in a data breach if the business failed to take reasonable and appropriate security measures • Consumers may receive statutory damages of between $100 and $750 per consumer per incident or actual damages, whichever is greater • California Privacy Protection Agency enforces the CCPA/CPRA and may also issue fines of up to $7,500 per violation
  34. 34. Key Elements of an Effective Information Security Program (ISP) • Purpose • Scope • Information security objectives √ CIA Triad • Authority and access control policy • Classification of data • Data support and operations • Security awareness sessions • Responsibilities and duties of personnel • Relevant laws
  35. 35. Domains A domain is a distinct set or group of security practices (controls) which have similar attributes to each other. Source: Sharpe Consulting LLC
  36. 36. Integration into Existing Governance, Risk, and Compliance (GRC) Principles First Line of Defense - technical and operational controls - largely the responsibility of IT - IT audit is Line of Defense 1.5 Second Line of Defense - Risk Management, Compliance, Finance, etc. - Training, awareness, and incident response - Policies and risk appetite Third Line of Defense - Internal audit Fourth Line of Defense - External audit (assurance to the Board) Source: Sharpe42 LLC STRONG The Purse Strings Ultimate defense is ALWAYS between the keyboard and the back of the chair
  37. 37. Authority Access & Control Policy • Typically, a security policy has a hierarchical pattern: √ Junior staff usually bound not to share the little amount of information they have unless explicitly authorized √ Senior manager may have enough authority to make a decision on what data can be shared and with whom √ Policies governing senior employees may not be the same policy governing junior employees √ ISP should address every basic position in the organization with specifications that will clarify their authoritative status
  38. 38. Classification of Data • Data can have different value and thus may impose separation and specific handling regimes/procedures for each kind of data • Information classification system is commonly sorted as: √ High risk or highly confidential class √ Confidential class √ Public class
  39. 39. Classification of Data (cont’d) • High risk class - generally data protected by state and/or federal legislation or regulations √ Information covered under HIPAA, FERPA, or other federal regulations √ Financial data √ Payroll √ Personnel (privacy requirements) • Confidential Class √ Data in this class may not be covered by any laws or regulations, but the data owner judges that it should be protected against unauthorized disclosure √ Information protected by NDAs, trade secrets, confidential business information •
  40. 40. Classification of Data (cont’d) • Public Class √ Information freely distributed • Data owners should determine both the data classification and the exact measures a data custodian needs to take to preserve integrity in accordance to that level
  41. 41. Data Support and Operations • The regulation of general system mechanisms responsible for data protection n √ Data backup √ Movement of data
  42. 42. Critical Infrastructure and Physical Security • Presidential Policy Directive 21 (PPD-21) • Originally defined in 1998 (Clinton Administration) under Presidential Decision Directive 63 • In practice the term refers to utilities that affects the population – gas, electric, water, wastewater • Historically outages are from Weather, Physical, Cyber is growing • Greatest concern is IT effect on Operational Technology (OT) like Colonial Pipeline
  43. 43. Critical Infrastructure Sectors Chemical Communications Dams Emergency Services Financial Services Government Facilities Information Technology Transportation • Commercial Facilities • Critical Manufacturing • Defense Industrial Base • Energy • Food and Agricultural • Healthcare and Public Health • Nuclear Reactors, Materials and Waste • Water and Wastewater Systems • Social Media?
  44. 44. Oldsmar (Tampa) Water Treatment • Tampa’s water treatment system was accessed remotely • Increased the amount of lye (aka drain cleaner) • Supervisor saw the concentration being changed on his computer screen and immediately reverted • Other safeguards are in place • What if APT disabled safeguards first? • Kudos to Homeland Security
  45. 45. Cyber Attack on Power Grid • First documented case, 2015 in Ukraine • Still not fully operational two months after the attack • Threat grows with IoT adoption • Big time cyber target Factoid: Russia unleashed more cyber attacks on Ukraine in the first day of the invasion than we typically see from all cyber actors in a year
  46. 46. National Defense Responses “Israel is under constant threat in the cyber dimension, and attacks are sometimes carried out against it. We are able to deal with most of the threats through advanced defense capabilities,” Maj. Gen. Tamir Hayman said at a conference at Tel Aviv University
  47. 47. Security Awareness Employee Training • Security awareness training could help provide employees with information regarding how to collect/use/delete data, maintain data quality, records management, confidentiality, privacy, appropriate utilization of IT systems, correct usage of social networking, etc. • Security awareness training has the highest Return on Investment (ROI) for companies
  48. 48. Responsibilities and Duties of Personnel • Not unusual for institutions to hire an ISP person with the sole responsibility for √ implementation √ education and training √ incident response √ user access reviews √ periodic updates of an ISP
  49. 49. Employee Maintaining the Information Security Program • Employee is the designated officer for handling every aspect of the program. √ A designated security officer is responsible for coordinating and maintaining the security program. • This person should maintain independence by reporting to someone outside of the IT department.
  50. 50. Assessing Risk • What risks could your organization face? √ Examples: loss of data, unauthorized access, data corruption, hack, third-party data sharing, etc. • What would be appropriate, cost-effective management techniques for these risks?
  51. 51. Additional Elements of a Good Information Security Program • Designated security officer (DSO) • Risk Assessment • Policies and Procedures • Organizational security awareness • Regulatory standards compliance • Audit compliance plan
  52. 52. About the Faculty 53
  53. 53. About The Faculty Kathryn Nadro - knadro@sfgh.com Kathryn (“Katie”) Nadro leads Sugar Felsenthal Grais & Helsinger’s Data Security and Privacy practice. Katie advises clients on a diverse array of business matters, including data security and privacy compliance, commercial and business disputes, and employment issues. Katie works with individuals and businesses of all sizes to craft successful resolutions tailored to each individual matter. Katie is a Certified Information Privacy Professional (CIPP/US) and counsels clients on a variety of data security and privacy issues, including breach response, policy drafting, program management, data collection, vendor management, and compliance with ever-changing state, federal, and international privacy law. Katie also has broad litigation experience representing companies and individuals in contract, non-compete, discrimination, harassment, fiduciary duty, and trade secret litigation in state and federal court. With a background as both in-house and outside counsel, Katie understands that business objectives, time, and resources play an important role in reaching a favorable outcome for each client. 54
  54. 54. About The Faculty Jeff Sauntry - jsauntry@goriskneutral.com Jeff Sauntry is the CEO and Founder of Risk Neutral. Jeff has led professional services and engineering organizations at multiple publicly traded Fortune 500 companies as part of executive leadership teams. His operational and technical experience spans strategy development, technology, enterprise software, risk, compliance, fraud, cyber, and physical security. Jeff is a serial entrepreneur who has founded four private companies in his home state of Florida. Jeff is the CoPresident of the Tampa Bay Chapter of the Professional Directors Association (PDA). Jeff is a National Association of Corporate Directors (NACD) member and is recognized as a Leadership Fellow and Certified Director. He completed the Chief Risk Officer (CRO) program at Carnegie Mellon University to complement his numerous professional, technical, and cybersecurity certifications. Jeff is an AM&AA Certified Merger & Acquisition Advisor and EPI Certified Exit Planning Advisor. His ESG (Environment, Social, Governance) passions focus on preserving the world’s oceans and increasing board of director cognitive diversity. Jeff is a US Coast Guard certified Captain in the US Merchant Marine (Master 50GT) and has 20 years of active participation with PADI (Professional Association of Dive Instructors), where he holds a rating of MSDT (Master Scuba Diver Trainer). He is a licensed Florida unlimited electrical contractor & qualifier (EC13008900) and an active member of the Comm-ISAC (Communications – Information Sharing and Analysis Center). Jeff brings an informed and balanced perspective to private/public critical infrastructure, diversity-equity-inclusion, data privacy, cybersecurity, environmental, and sustainability corporate governance programs. 55
  55. 55. About The Faculty Alison Schaffer - aschaffer@jumptrading.com Alison Schaffer Bloom is Legal and Regulatory Counsel at the Jump Trading Group in Chicago. Alison works extensively in the areas of trading, technology, human resources, venture capital, and data protection and privacy. Specifically, Alison leads data protection and privacy application for all of the Jump Trading Group’s business lines globally. Alison graduated from Northwestern University with Honors in Legal Studies and Communication Studies and a Certificate in Service Learning and attained a Masters in Education while a Teach For America corps member in New York. Alison obtained her Juris Doctor from Chicago-Kent College of Law, where she was an avid member of the Trial Team. She is a member of the International Association of Privacy Professionals and holds the Certified Information Privacy Professional/Europe (CIPP/E), a preeminent certification for advanced concentration in European data protection laws, standards and practices. 56
  56. 56. About The Faculty Alex Sharpe - alex@sharpellc.com Alex Sharpe is a long-time Cybersecurity, Governance, and Digital Transformation expert with real-world operational experience. He has spent much of his career helping corporations and government agencies reap the rewards afforded by advances in technology while mitigating risk. He began his career at the NSA before moving into the Management Consulting ranks building practices at Booz Allen and KPMG. He subsequently co-founded two firms with successful exits, including The Hackett Group. Alex holds degrees in Business from Columbia Business School, Systems Engineering from Johns Hopkins University, and Electrical Engineering from New Jersey Institute of Technology (NJIT). He is a published author, speaker, instructor, and advisor. 57
  57. 57. Questions or Comments? If you have any questions about this webinar that you did not get to ask during the live premiere, or if you are watching this webinar On Demand, please do not hesitate to email us at info@financialpoise.com with any questions or comments you may have. Please include the name of the webinar in your email and we will do our best to provide a timely response. IMPORTANT NOTE: The material in this presentation is for general educational purposes only. It has been prepared primarily for attorneys and accountants for use in the pursuit of their continuing legal education and continuing professional education. 58
  58. 58. 59
  59. 59. About Financial Poise 61 DailyDAC LLC, d/b/a Financial Poise™ provides continuing education to attorneys, accountants, business owners and executives, and investors. It’s websites, webinars, and books provide Plain English, entertaining, explanations about legal, financial, and other subjects of interest to these audiences. Visit us at www.financialpoise.com Our free weekly newsletter, Financial Poise Weekly, updates you on new articles published on our website and Upcoming Webinars you may be interested in. To join our email list, please visit: https://www.financialpoise.com/subscribe/

×