The Governance Council is composed of executives responsible for managing all risks to the organization, with the primary goal of providing oversight for the organization's security function while ensuring that the security function continues to serve the needs of both the organization and its stakeholders. They review ongoing and planned projects, remote metrics, and any other security matters that may concern the entire enterprise.

Every acquisition brings a unique set of circumstances, and security experts from both organizations should come together to evaluate each organization's security controls and figure out how to eliminate redundancies and ensure the system's containment.

Possible risk points:

Countermeasures:

•Identify and classify all assets involved in the divestment; this includes hardware, software and information assets.

•Decouple affected systems from your remaining infrastructure.

•Review all access rights.

• Consult with your legal and compliance teams to ensure you are following all necessary regulatory and compliance requirements surrounding data retention, deletion, etc.

The chief information security officer is the senior executive responsible for the overall management and oversight of the information security program within an organization.

The chief information security officer drives the organization's security strategy and vision and is ultimately responsible for the security of the company's systems and information.

The CSO is a senior executive within an organization and is typically responsible for all physical security and personnel security matters.

Many organizations have merged the responsibilities of the CSO into the role of the CISO

Are technical, operational, or administrative protective measures used by an organization to prevent, detect, reduce, or counter security threats.

Technical controls: System-based protections and countermeasures such as firewalls, I1DS/PS, and data loss prevention (DLP) •

Operational controls: Protective measures and countermeasures performed primarily by humans, such as security guards.

Management controls: include policies, procedures and other countermeasures to control information security risks.

The principle of caution refers to reasonable and prudent behavior to protect information security, including maintaining the confidentiality, integrity and availability of information, and applies to all persons. This principle applies to any person or organization, regardless of their level of expertise in information security.

Due diligence refers to a series of measures taken in information security to ensure that reasonable security measures have been implemented and work effectively. These include developing a formal security framework, developing security policies, standards, baselines, guidelines and procedures, and more. In this regard, it is the responsibility of senior management to ensure that due diligence is carried out.

Passed by the U.S. Congress in 1987, it has been removed and replaced by FISMA.

Federal Information Security Management Act, all U.S. federal government agencies and non-governmental organizations that provide information services to these agencies are required to conduct risk-based security assessments consistent with the NIST Risk Management Framework (RMF)

Regulations related to the finance of listed companies

Payment Card Industry Regulations

Stands for system and organizational control and is an audit framework with three commonly used SOC audit and reporting types, named SOC1, SOC2 and SOC3.

SOC1: Audit related to financial statements

SOC2: Detailed audit and compliance reports, generally not open to the public.

SOC3: A simplified version of SOC2, available to the public.

Privacy requirements refer to protecting the security and confidentiality of personal information during information processing and limiting access to personal information to the authorized use scope of the authorized party. In essence, privacy refers to the protection of personally identifiable information to protect an individual's right to privacy.

1.4.2.1PII

Cybercrime refers to criminal activities directly involving computers or the Internet, which mainly include:

Data breaches are a special type of cybercrime where information is accessed or stolen by cybercriminals without authorization. Organizations affected by a data breach may face reputational damage, identity theft incidents, fines, or loss of intellectual property due to theft. Encryption is a simple way to protect your organization from data breaches.

Computer Fraud and Abuse Act (CFAA): America’s first criminal law targeting cybercrime, making many types of hacking a federal crime. The CFAA amendments were met with resistance.

Electronic Communications Privacy Act (ECPA): Restricts the U.S. government from intercepting communications and storing information, and the government must meet strict requirements to obtain a search warrant for electronic communications.

Identity Theft and Presumption of Deterrence Act: Makes theft of a person’s worth a federal crime.

Software is an important form of intellectual property. Organizations invest significant financial and human resources in developing software and then protecting the software through licensing agreements. There are four common types of license agreements:

A very important responsibility of information security professionals is to protect the intellectual property belonging to their organization from unauthorized use or disclosure.

1.Copyrights

2.Trademarks

3.Patents

4. Trade Secrets

The Traffic in Arms Regulations (TAR) is anything related to defense articles

The Export Administration Regulations (EAR) cover many broad technology categories, including sensitive electronics and computers, lasers, navigation, marine technology, and more.

1. "Privacy Act"

2. Health Insurance Portability and Accountability Act (HIPAA)

3.Children’s Online Privacy Protection Act (COPPA)

4. Financial Services Modernization Act (GLBA)

5. Health Information Technology for Economic and Clinical Health (HITECH) Act

1.《Data Protection Directive (DPD)＞

2. General Data Protection Regulation (GDPR)

3. "Safe Harbor" and "Privacy Shield" are privacy protection agreements between the United States and the European Union, and they have expired.

An investigation within an organization to find the root cause of a problem and resolve it so that the business can resume normal operations.

A security policy is a set of statements that very carefully describes an organization's long-term security expectations and identifies the principles and rules that govern the protection of information systems and data in the organization.

•Compliance with policies is mandatory and policies are usually approved by the highest level of the organization.

Some common security policies: acceptable use policy, access control policy, change management policy, remote access policy, disaster recovery policy

Security standards specify the specific details of security controls that an organization must follow, such as organization-approved encryption protocols, where data is stored, configuration parameters, and other technical and operational details. When it comes to complex configuration standards, industry standards are often drawn upon, such as the Security Configuration Guide provided by the Center for Internet Security.

Compliance with safety standards is mandatory. The security baseline is related to standards, which establishes a minimum security level for a system, network, or device. If the baseline requirements are not met, it cannot go online.

Safety procedures are step-by-step instructions that employees can follow when performing specific safety tasks.

Guides are where security professionals provide advice to other members of the organization, including best practices for information security. Compliance with safety guidelines is optional.

1. Start by establishing your BC project team, scope and budget

2. Identify critical business foundations (CBFs) and other essential business elements, including

3． Conduct risk analysis on key businesses:

1. Maximum Tolerable Downtime (MTD) or Maximum Acceptable Downtime (MAO) represents the total length of time that critical business functions are unavailable. The MTD must be determined by the system owner, who has ultimate responsibility for the proper functioning of the organization's CBF.

2. Recovery Time Objective (RTO) is the maximum period of time that critical business must resume after an outage to avoid unacceptable business consequences. RTO must be less than or equal to MTD.

3. Recovery Point Objective (RPO) is a measurement of tolerable data loss, expressed in time periods.

A business continuity plan is designed to protect an organization's critical business functions and customers and ensure that the organization can continue to operate effectively within specified service levels and time periods to meet legal and regulatory requirements, as well as the MTD, RTO, and RPO set by the organization.

Business Continuity Plan BCP Phase

critical business functions

Threats, Vulnerabilities and Risks

Data backup and recovery plan

FBCP related personnel

communication plan

BCP testing requirements

Ensuring the safety of people inside and outside the organization during emergencies is the primary goal of BCP. Provide appropriate training and education so employees know how to act in an emergency.

Assess critical business functions and determine resources needed in the event of a disaster. Develop backup site plans for critical data processing facilities and capabilities to ensure continued operations.

Anticipate software and hardware failures and develop controls to reduce risk. Implement data backup and redundant systems, including infrastructure such as power, water, communications and network connectivity.

Education background

work experience

-citizenship

-Criminal record

drug testing

Grade

Credit and financial history

social media activity

Note: Foreign companies generally do not pay attention to physical examinations (ordinary physical health examinations)

The most common employee agreements are non-disclosure agreements (NDA) and non-competition agreements (NCA)

1• Non-Disclosure Agreement (NDA)

2 • Non-Competition Agreement (NCA)

In addition to NDAs and NCAs, employees may be required to sign other requirements of the organization, such as an acceptable use policy (AUP), code of conduct, or conflict of interest policy.

After joining the company, you must first sign an employment agreement. Depending on the position, you may need to sign a non-disclosure agreement (NDA) and a non-competition agreement (NCA). System access rights are assigned according to the employee's position. Then, provide training to employees, including organizational culture, strategies, processes, skills, etc.

Managers should periodically review or evaluate each employee's job description, tasks, authorities, and responsibilities throughout an employee's position to ensure they are still meeting the requirements of the position.

•Privilege creep (privilege drift): As employees' work content increases, they may obtain permissions that exceed the requirements of the position.

•Mandatory vacations: Require employees to be away from their jobs for 1-2 weeks and replaced by other employees to detect abuse, fraud or negligence.

•Collusion: Reduce the likelihood that employees will be willing to cooperate in an illegal or abusive scheme through measures such as segregation of duties, forced leave, job rotation, and cross-training because of the higher risk of detection.

•User and Entity Behavior Analytics (UEBA): Analysis of users and entities to help optimize people management plans.

When employees resign, they should pay attention to the following points:

Supplier, Consultant and Contractor Agreements and Controls Multiparty risk exists when multiple entities or organizations are involved in a project. The service level agreement (SLA) ensures that the supplier's product or service level meets expectations. If it fails to meet expectations, compensation will be involved to ensure service quality. Suppliers, consultants and contractors are sometimes referred to as outsourcing. Organizations can also improve the efficiency of outsourcing management through a vendor management system (VMS).

Personnel security management needs to meet legal and regulatory requirements, such as PCI DSS.

Personnel security management also needs to meet the requirements of privacy policies, such as GDPR.

Remind employees of their obligation to protect information and guard against threats, and should be aware that their actions may be scrutinized.

Remove access rights that are no longer needed when reassigning, and follow the principle of least privilege.

Resignation is divided into voluntary and involuntary. When an employee leaves on good terms, it is enough to go through the organization's separation process.

If the separation is involuntary, appropriate actions should be taken to protect the assets of the organization

•Exit interview, reminder of signed NDA and other relevant agreements

•Closing access to the system while notifying employees of termination and conducting separation checklist checks

•Inform the remaining employees that the terminated employee will no longer be allowed into the organization

The separation checklist includes: revoking access rights, recovering keys, badges, equipment and documents.

-Implement access control

Oral review of document exchange

Manage and monitor maintenance hooks (backdoors)

Conduct on-site assessment

Review processes and policies

Develop service level agreement

•Employee training: Provide initial and recurring training to employees and other relevant personnel to ensure policy compliance.

•Security Awareness: Improve attention and understanding of information security.

•Job-related training: Provide specific training based on employees’ job requirements.

•Make policy consequences clear: State in the policy the potential consequences of non-compliance, such as disciplinary action, suspension or dismissal.

•Compliance with laws and regulations: Ensures that organizational policies comply with applicable laws, regulations and other legal obligations.

•Policy Consistency: The organization's requirements, controls and procedures must be consistent with policy.

•Minimization principle: Only collect information necessary to complete the legitimate employment process.

•Restricted Access: Provide access only to those who need to know such information.

•Use encryption: Use encryption technology as much as possible to prevent information from being read through abnormal channels.

•Inherent risks are those that exist before any control measures are implemented

•Residual risk is the level of risk that remains after controls are in place

A person or entity that may intentionally or unintentionally breach the security of an asset, such as a hacker, a disgruntled employee, or a natural disaster.

Weaknesses or vulnerabilities in the system may create risks if exploited by threat actors.

An asset is anything of value, which may include people, property, and information.

Risk is the intersection between threats, vulnerabilities and assets. Risk assessment is a series of activities that includes identifying potential threats and vulnerabilities and determining the impact and likelihood of those threats exploiting the identified vulnerabilities.

1. Risk Identification: Identifying assets and their value to the organization

2. Risk analysis: Determine the likelihood that a threat will exploit a vulnerability

3. Risk Assessment: Determine the business impact of these potential threats

4. Risk treatment: Provide an economic balance between the impact of the threat and the cost of countermeasures

It begins by identifying the organization's assets and determining the value of those assets, then identifying and describing the vulnerabilities and threats that pose risks to the assets.

Risk analysis starts with vulnerability assessment and threat analysis, calculating the likelihood of risks occurring and ranking them according to their impact.

1.10.2.4.1 Qualitative risk analysis

1.10.2.4.2 Quantitative risk analysis

Eliminate identified risks by stopping or removing the activities or technologies that contribute to the risk.

Reduce the harm that risks can cause by implementing policy and technical measures.

Also called risk assignment (Risk Assignmen0), the responsibility and potential losses related to risks are transferred to a third party.

Common way: buy insurance.

Accepting a risk becomes an option when the cost of avoiding, mitigating, or transferring the risk exceeds the expected losses from the realized threat.

•Personnel related:

•Management related

•Technology related:

•Physics related:

Examine perceptions from the perspectives of prevention, detection, and correction to ensure the effectiveness of risk countermeasures. For example, if encryption cannot solve a specific risk, try another approach, such as considering backup.

Make sure the cost of security measures is commensurate with the value of the assets being protected.

Consider whether the implementation and use of countermeasures is too difficult to avoid increasing risks due to incorrect use.

•Prevention: Prevent incidents from happening, such as firewalls, system backups, IPS.

•Detection: Identify event activity and potential intruders, such as 1DS.

•Correction: Repairing a component or system after an incident occurs, such as patching.

•Threats: Dissuade potential attackers, such as fences, police dogs.

•Recovery: Returning the environment to normal operating status, such as system and data backups, disaster recovery sites.

•Compensation: Provide alternative control measures.

•Inspection: The assessor usually requires the organization to provide a list of security policies, configuration files, etc. for review, review, observation, research or analysis, and to form a preliminary opinion.

•Interviews: Assessors meet with key stakeholders to learn more about the security controls in place and how they operate.

. Testing: Testing confirms that security controls are implemented as documented, are effective, and operate as expected.

Internal audit (e.g. self-assessment)

•External audits (e.g. regulators or other third party audits)

•Significant changes in the organization’s risk profile

•Major changes to security or privacy controls

•Related or confirmed security breaches (or other incidents)

Usually contains five levels:

The six stages of the Risk Management Framework (RMF) in NIST800-37Rev.2:

The earlier threat modeling is performed, the more cost-effective it is. Generally from the following three aspects

1.

2.

3.

4. DREAD (deprecated, quantitative risk ranking of vulnerabilities from damage, replicability, exploitability, affected users, discoverability)

5. Other Threat Modeling Methods

•Spoofing identity

•Tampering with data(Tampering with data)

•Repudiation

•Information disclosure

•Denial of service

•Elevation of privilege

PASTA is a risk-based approach to threat modeling that combines business objectives with technical requirements, making the output more understandable to senior management. Unlike STRIDE, the PASTA approach is strictly a threat identification framework that provides a powerful process for identifying and mitigating threats.

The PASTA process consists of the following seven stages:

Image of defective parts or parts that do not meet standards

Counterfeit or counterfeit parts

Image of an electronic component containing firmware-level malware

Trojan horse was implanted

There are vulnerabilities in the component library used

data leakage

1.NIST IR 7622

2.ISO 28000

3. UK National Cyber ​​Security Center (NCSC) Guidance

Social engineering is a manipulation tactic in which an attacker pretends to be someone else in an attempt to obtain sensitive information.

Phishing is the most common form of social engineering and a major source of security risks.

Safety champions are advocates for safety best practices, and these are employees who don't make safety their primary job.

Gamification is the application of game elements to non-game situations to engage and educate a target audience.

Such as training completion rate, number of participants and other brief indicators.

Quizzes are an effective way to evaluate the effectiveness of training.

Security Awareness Days are designed to increase security awareness while collecting employee opinions and suggestions on security programs through anonymous questionnaires.

Assessment methods include collecting increases or decreases in the number of security incidents or reported suspected phishing incidents following the training.