IH - Fit to ISP and IPP - Module 3 Powerpoint Presentation.pptx

IH - Fit to ISP and IPP - Module 3 Powerpoint Presentation.pptx

1. Dr. Kevin F. Streff Founder and Managing Partner 1 Incident Handler Certification

2. Dr. Kevin Streff American Security and Privacy, LLC Founder & Managing Partner www.americansecurityandprivacy.com [email protected] 605.270.4427 2

3. Agenda 3 Module 1 Incident Response Overview Module 2 Incident Response Laws and Regulations Module 3 The Fit of Incident Response in Information Security and Privacy Programs Module 4 Privacy Incidents Module 5 Security Incidents Module 6 Incident Response Program Overview Module 7 Step 1 - Preparation Module 8 Step 2 - Detection and Analysis Module 9 Step 3 - Contain, Eradicate, and Recover Module 10 Step 4 - Post Incident Activity Module 11 Incident Response Testing Module 12 Third Party Incident Response Requirements Module 13 Incident Response Auditing Module 14 Incident Response Metrics

4. Module 3 The Role of Incident Management in Information Security and Privacy Programs 4

5. Gramm-Leach-Bliley Act of 1999 Required financial institutions to implement an Information Security Program 5

6. Leading Security Frameworks NIST Security Framework OASIS Security Framework APEC Security Framework Nymity Security Management Accountability Framework HITRUST Security Framework American Security and Privacy Information Security Framework ISO 2700x Framework 6

7. Information Security Program Blueprint Inventories Policies Procedures Standards Guidelines Plans Audit/Test Results Reports SARS Meeting Minutes Committee Approvals Previous Exams Awareness/Training Materials Third Party Reports Network Diagram Organizational Chart Process Flows Incident Reports Strategies Budgets Memos FI Processes Documentation Asset Mgmt. Physical Security Business Continuity Incident Response Development & Acquisition Operations Security Risk Mgmt. Network Security Auditing Functions Personnel Security Reporting Remediation Assessment Changes Audit Recommendations Exam Findings Incident Reports Policy Changes Board Committee Operations Third Party Examiner FI and Technology Strategy ASP ISP v1.1 IT Audit Soc. Eng. Pen Test Scans Third Party Mgmt. Soft. Dev. Customer Employee Third Parties Systems Inventory Technology BIA AUP Roles & Resp. BCP Pandemic Preparedness 7

8. CFPB 1033 Required financial institutions to implement an Information Privacy Program Supports the Open Banking concept Requires for security and privacy 8

9. Leading Privacy Frameworks NIST Privacy Framework American Security and Privacy (ASP) Information Privacy Framework (IPP) ISO Privacy Framework (27701) 9

10. Data Mgmt Consent Mgmt Vendor Mgmt DSAR Mgmt Web Tracing & Cookie Mgmt Privacy Program Mgmt Privacy Engineering Emergency Mgmt. Information Privacy Program Blueprint Assessments Compliance Reporting Remediation Inventories Policies Procedures Standards Guidelines Plans Audit/Test Results Reports SARS Meeting Minutes Committee Approvals Previous Exams Awareness/Training Materials Vendor Reports Network Diagram Organizational Chart Process Flows Incident Reports Data Flows Privacy Audit Consent Mgmt Audit Id Mgmt Audit Cookie Tracking Audit Website Tracking Audit Data Masking Audit Pseudonymity Audit Privacy/PIA Cookie Tracking Website Tracking Data Masking Pseudonymity Assessment Changes Compliance Recommendations Exam Findings Regulatory Changes Legal Changes Board Committees Operations Vendor Examiner Strategies/Budgets Training Logs Memos DSARS ROPAS Data Mappings Functions Processes Documentation Privacy Notices Awareness & Training Mgmt ETC. User Mgmt 10

11. Summary Need both an Information Security Program (ISP) and Information Privacy Program (IPP) which include Incident Management 11

12. Dr. Kevin Streff American Security and Privacy, LLC Founder & Managing Partner www.americansecurityandprivacy.com [email protected] 605.270.4427 12 American Security and Privacy, LLC