ZenGRC Team

An Automated Approach To SOX Testing

ZenGRC Team · April 10, 2018 ·

The Sarbanes-Oxley Act of 2002 implements regulations on publicly traded companies. In 2002, the United States Congress passed the Sarbanes-Oxley Act (SOX) after a series of public scandals by large corporations such as Enron Corporation, Tyco International PLC, and WorldCom that led to a stock market plummet only a few months before the 2002 elections. The legislation intended to quell public fears of corporate misconduct and to require greater accountability by management and Boards of Directors for financial reporting. However, Sarbanes-Oxley turned into a larger and more complex piece of legislation than initially planned due to the integration technology in creating financial statements.

What is SOX Compliance Testing?

Sarbanes-Oxley compliance requirements fall into several different areas. Within the discussions of corporate responsibility and governance, some information security issues exist. Despite feeling overwhelmed by SOX compliance, organizations using automation can focus best on what pertains to them. Thus, SOX testing should center on those areas most important to your organization.

What is the PCAOB?

SOX established the Public Company Accounting Oversight Board (PCAOB) and imposed restrictions on public accounting firm auditors including independence standards. Since SOX views IT controls as the foundation for financial reporting controls, the auditing standards incorporate IT assessments as part of the regulatory requirement.

The PCAOB standards, however, offer little to help individual IT practitioners. The audit requirements specifically note the importance of using a risk-based, individualized approach to establishing controls. Therefore, unlike ISO 29001 or PCI DSS, SOX controls remain primarily individualized.

What benefits does COSO provide?

In the Committee of Sponsoring Organizations of the Treadway Commission (COSO) established the COSO framework to address areas of compliance such as information security controls, control environment, risk assessment control activities, information and communication and monitoring. In 2017, COSO updated its enterprise risk management (ERM) framework to address changes in the risk environment. The COSO update intended to helps align performance strategies to risk modeling. Since COSO and its framework act as the lynchpin for any SOX compliance program, reviewing the COSO Framework’s suggestions provide insight into compliance steps.

How do organizations establish internal controls?

The first step to appropriate SOX scoping involves performing a risk assessment focused on the organization’s ITGC. To appropriately assess risk, organizations must start by determining the purpose of the assessment. Each control should be evaluated based on confidentiality, integrity, and/or availability then defined with the risk criteria/parameters.

Establishing an internal control means reviewing an organization’s landscape. Not all areas need to be SOX compliant, thus focusing on areas of highest risk ease the burden of creating a program. Organizations, therefore, must find those areas within their IT landscape with the most significant threat and develop individualized controls to mitigate the risk involved.

How organizations engage in meaningful control objectives

Control owners must incorporate control awareness to understand not only how the controls work but why they matter and where they fit into the big picture. Thus, auditors want executives to recognize that the SOX assessment matters to the organization’s financial success otherwise the internal controls lose value.
Documentation, therefore, becomes essential. The executive suite must be able to articulate their decisions for acceptance, transference, mitigation, or denial of risk. They cannot explain their reasons for control choice if they do not understand its impact on their financial and reputation risk.

Why SOX compliance testing matters

Identifying risks and establishing controls under Section 404 only begins the long process of compliance. Effectiveness requires gathering evidence that controls work. Although the material misstatements may concern CEOs, CISOs and ISOs worry more about control failures.

Control failures that risk misstatements in financial reports should be those tested most strenuously. These controls, therefore, require more testing and more documentation. For example, access control failures make organizations vulnerable to misstatements in financial reports. Thus, they need more testing.
Continuously reviewing access controls becomes more overwhelming as organizations scale. A manageable review for 100 employees becomes more burdensome at 1000 employees. Therefore, automated role-based access controls provide companies a semblance of assurance that individuals will have the least amount of access needed to do their jobs. However, a single access control may not mitigate risk for sensitive data. Therefore, incorporating additional data access controls such as multifactor authentication may be necessary. While the SEC does not require automation, removing manual processes also acts as a control alleviating human error.

These controls and control testing require documentation that internal stakeholders must share across the organization.

How automating SOX testing documentation streamlines audits

Audits require a constant flow of information and documentation between internal and external stakeholders. ZenGRC’s SaaS platform provides organizations with multiple tools to enable efficient SOX audit tracking.

Internally, the ZenGRC platform allows organizations to map controls across frameworks to maintain consistency. For example, HIPAA compliance and SOX compliance both require user-access controls. However, while SOX controls focus on financial reporting, HIPAA focuses on privacy. Therefore, when a HIPAA compliant organization needs to become SOX compliant, the company needs to evaluate any control gaps. ZenGRC’s ability to map controls across multiple frameworks, regulations, and standards provides insight for organizations who want to implement additional compliance requirements.

Meanwhile, external auditors require proof that an organization has tested controls while compiling documentation in an easy-to-access single location. ZenGRC provides a single source of truth enabling streamlined audit information gathering. Rather than reaching out to multiple stakeholders who access information based on their roles, organizations using ZenGRC’s role-based authorization platform allows workforce members access to information they need to do their jobs. These authorizations enable compliance managers access to the IT department’s documentation but limit their ability to make changes. Not only does this maintain the data’s integrity, but it eases cross-departmental communication and saves time.
Finally, the ZenGRC risk heat maps provide easy-to-digest risk analyses that allow the Board of Directors to meet their oversight requirements. When the Board of Directors can articulate their decisions, they can prove to auditors and regulators that they have met their due diligence requirements.

Automating SOX control testing means more than automating the controls, it means automating the documentation that proves the controls work.

For more information about how ZenGRC enables agile compliance, schedule a demo.

Regulatory Compliance in Healthcare Organizations

ZenGRC Team · April 3, 2018 ·

2017 acted as a call to action for those in the healthcare industry. Patient Health Information (PHI) incorporates everything hackers need to steal identities and compromise an organization’s reputation. Therefore, protecting PHI, and more importantly, electronic patient health information (ePHI) means that healthcare organizations need to be more diligent ensuring that their daily compliance activities match their policies.

Healthcare Regulatory Compliance

What Regulatory Compliance Requirements Affect Healthcare

Although the Health Insurance Portability and Accountability Act (HIPAA) gets the most screen time, organizations involved in healthcare need to incorporate the Health Information Technology for Economic and Clinical Health Act( HITECH) compliance as well. Although interrelated, 2009’s HITECH specifically intended to promote information technology while protecting privacy and security concerns regarding ePHI.

HITECH modified not only HIPAA but also the Social Security Act. Thus, understanding how the different regulatory compliance puzzle pieces fit together became more difficult.

How HIPAA and HITECH Are Similar

The Health and Human Services Department (HHS) oversees both HIPAA and HITECH compliance.

Healthcare organizations most often focus on HIPAA compliance because it established the Privacy Rule setting national standards regarding medical record and PHI protection. Since the Privacy Rule’s adoption in 2000, HHS made only one modification 2002 thus establishing it as one of the first information security and privacy regulations.

The Office of the National Coordinator for Health Information Technology (ONC) promotes healthcare quality by promoting health IT and establishing guidelines for electronic health records (EHRs) and securing ePHI to protect privacy.

Thus, while HIPAA and HITECH integrate with one another, they come with distinct foci. HIPAA focuses on protecting privacy and expands beyond information systems. Meanwhile. HITECH focuses specifically on information technology and preserving electronic information.

How HIPAA and HITECH Differ

While HIPAA and HITECH have many similarities, they also differ on several important details.

Although HITECH extended HIPAA, HIPAA remains focused on breach notification and privacy to protect against fraud and identity theft.

Meanwhile, HITECH distinguishes itself from HIPAA since it created restructured civil and criminal compliance penalties. Moreover, it extended the breach notifications requirement beyond covered entities and incorporated business associates.
Finally, from an information technology perspective, compliance managers should focus on the importance of effective encryption. Even should a malicious actor breach the ePHI, effective encryption mitigates rule violations. Thus, if the encryption effectively makes the information unreadable, the organization breached may not be fined.

However, proving effective encryption additionally means being in compliance with the NIST Federal Information Process Standard. Thus, healthcare regulatory compliance requires understanding your organization’s IT architecture.

How HITECH’s Compliance of Medicare and Medicaid Impact HIPAA Business Associates

Understanding healthcare regulatory compliance requires understanding overlaps between business associates, their information, and how that can impact the overall supply chain.

The definition of Business Associate incorporates and person or entity not covered entity’s workforce member who provides services to or performs functions or activities for a covered entity.

Traditionally, the Omnibus Rule’s definition of Business Associate brings healthcare management companies, healthcare plans, and healthcare payment organizations under the arc of HIPAA and HITECH. However, for those working with Medicaid, additional services may be incorporated under these compliance requirements.
For example, HITECH and HIPAA consider Medicaid’s Non-Emergency Medical Transportation (NEMT) to be a Business Associate under the Omnibus Rule. Thus, despite being nothing more than a network of transportation brokers, information collected remains subject to these healthcare regulations.

Thus, organizations need to determine their location in the supply chain to ensure no HIPAA or HITRUST violations as well as to decide whether or not they want to assume the regulatory compliance risk if they choose to scale.

What the Board of Directors Needs to Know

Organizations looking to shift into the healthcare sector need to ensure that their Board recognizes the compliance implications. Providing the appropriate level of Board oversight requires visibility into both the healthcare landscape as well as the organization’s current compliance environment. Moreover, should an organization decide to incorporate healthcare providers or their vendors as part of its business plan, the Board of Directors needs to understand how they fit into that supply chain.

Under HIPAA, vendor risk creates corporate risk. Thus, whether your company sits at the top of the supply chain, in the middle, or at the bottom, any interaction with HIPAA regulated entities means you need to be compliant also.

Thinking about HIPAA and HITECH violations as dominoes in a row, if one domino falls so do all the others. Thus, vendor management’s importance may increase if you decide to expand into the healthcare industry.

How Automation Eases the Healthcare Regulatory Compliance Burden

ZenGRC’s SaaS platform enables organizations to visualize compliance gaps. Regulatory compliance no longer needs to act as a barrier to new markets. As you map controls to a particular standard or framework, ZenGRC allows you to assign that control to other standards or frameworks that it satisfies.

The first step for successful implementation of the Health Information Trust Alliance Cybersecurity Framework (HITRUST CSF) is to engage in a CSF Self-Assessment with the help of a CSF assessor. CSF assessors are consulting firms that HITRUST approved to perform the assessment. Using this information, you can gauge your system and regulatory requirements to help determine your risk and scope.
For example, an organization currently ISO 27001 compliant may be using a firewall. If you choose to incorporate PCI DSS compliance, a firewall is also an accepted control. Assuming that you want to expand to acting as a healthcare provider payment processor, you need to determine whether this control maps to HIPAA and HITECH compliance.

Once you set up your controls in ZenGRC, it automatically maps current controls to new standards as you add them. This means that your ISO 27001 controls will be mapped to your new PCI DSS compliance framework. All you need to do now is determine what additional controls you need to incorporate.

The HHS Office of the Inspector General (OIG) offers a guideline that discusses all the parties involved in your compliance efforts, from your employees to your Board of Directors. Automation helps you better communicate with your organization’s various stakeholders, providing them with the right information for their needs.
A HIPAA compliance audit is similar in that an audit management software that provides a single source of truth can help you save time. Saving time saves money because your employees can focus on securing your environment.

With an automation tool like ZenGRC, you can monitor your compliance while storing all your necessary documentation in one place.

ZenGRC’s compliance management software provides a risk dashboard that gives insight into the effectiveness of your ongoing monitoring so that you can meet internal audit standards.

Not only does this simplify incorporating new standards into your overall landscape, but it also means that you can expand your business into revenue streams that seemed too onerous before.

Here’s what GDPR means for your business

ZenGRC Team · March 19, 2018 ·

The term “business as usual” takes on a whole new meaning May 25, when the European Union’s General Data Protection Regulation (GDPR) goes into effect. This complex, game-changing law will mandate new ways of doing business in virtually every area of operations, from human resources to marketing, to technology and cybersecurity.

In fact, according to a PwC survey, 92 percent of U.S. companies consider preparing for GDPR compliance a top priority.
Is your enterprise ready?

The first-ever global privacy and security law, GDPR outlines new rules—99 of them– for protecting EU citizen data. These provisions:

Broaden the scope of the term “personal data”;
Grant EU citizens absolute rights over their personal data, including the “right to be forgotten”;
Set stringent requirements for how entities process, store, and share citizen data;
Establish rules for securing EU citizen data, including privacy protections;
Set timelines and guidelines for responding to and reporting data breaches;
Restrict the collection and processing of specific types of data, including that of minors;
Require accountability for security breaches and data theft;
Require that privacy protections be designed into business operations, and
Impose strict penalties for noncompliance, including up to €20 million or 4% of the company’s global annual revenues.

Why is GDPR needed?
In the information age, data defines us—increasingly so as the world becomes ever more connected. The European Commission adopted the GDPR in 2016 to address growing concerns about citizens’ control of their data, to protect Europeans from the potentially devastating consequences of data and identity theft, and to harmonize the various directives and laws across the EU’s 28 member states.

In this way, GDPR is intended to make it easier for enterprises to do business with EU companies and individuals.

Under the 95/46/EC EU Data Protection Directive, businesses struggled to comply with different sets of requirements for clients and customers in different EU member states. The GDPR, however, provides a single, overarching regulatory framework that, once met for a single EU entity, will apply to all.

Does GDPR apply to me?
Most every organization and individual doing business with citizens of the EU, even if they have no presence inside the EU, must show compliance with the GDPR by May 25th. If your business collects, processes, or stores personal information about EU citizens living in the EU, the GDPR almost certainly applies to you.

Organizations who employ or contract with EU citizens must meet GDPR requirements, as well.

If you collect, process, store, or share EU citizen personal data—defined as any information that can be used to identify someone, including, now, “pseudonymous” data processed under a false name—the GDPR applies to you.
“Personal data,” according to the regulation, includes a person’s name, address, date of birth, address, identification numbers, email address, and phone number.

Certain types of personal data—“special categories,” under the framework–have even more restrictions. The GDPR expanded the definition of personal data to include genetic, biometric, health, and criminal data as well as information about race, gender, religious beliefs, union membership, sexual orientation and political affiliation.

“Anonymized” data, or that which is permanently encrypted or made anonymous so that its owner cannot be identified, is not governed by the GDPR.
Because the GDPR’s primary objective is protecting people and their privacy, everyone who uses EU citizen data for any business purpose is subject to its requirements—and its severe penalties for non-compliance or a breach. This includes personal information collected, processed and stored manually—written by hand and kept in a filing cabinet, for instance—as long as you organize it in an intentional way, such as in alphabetical order.

Power to the people
Once you’ve taken possession of EU citizen’s data, you will want to handle it with the utmost care. Under GDPR, EU citizens have individual rights related to the use of their personal information that could make compliance difficult unless you are processing, tagging, and tracking it properly.

Citizens’ rights begin with your asking for their name. Before collecting any information about them, you must tell them exactly how you will use it, and why. They must “opt in” and grant consent; otherwise, you can’t collect, process, or store any data they provide.

Your business issues a privacy notice to customers, you say? Chances are, it isn’t good enough. The GDPR requires that privacy notices be clear, concise, simple to read and understand. If you’re offering the long, jargon-filled document so commonly presented today—which most people notoriously do not read—you’ll have to revise it to comply.

The framework also calls on businesses to be diligent and vigilant: always on your game, where data is concerned.

For instance, if you come up with a new use for any EU citizen data you have, or you want to share it with anyone else, you must notify the individuals associated with that data and gain their consent. Under the GDPR, individuals own their data, always; businesses merely borrow it, and must handle it with care and return it whenever asked.
It is the EU citizen’s prerogative to change their mind, always. Even after they have consented to your using, storing, or sharing their data, they can revoke their permission.
The “data portability” provision lets them ask for their data to be returned to them.
The “right to erasure” provision states that, if they ask you to erase their information from your databases, you must do so “without undue delay.”
This provision, also known as the “right to be forgotten,” could pose problems for those who lack a data tracking system.
How can you erase data if you don’t know where it is? How can you tell those you’ve shared it with to remove it from their database if you haven’t recorded where it has gone?
Simply not knowing the answers to these questions could put you at risk of noncompliance.

The GDPR requires data “controllers,” or those collecting and using the information, and processors to know where EU citizen personal data is located, who can access, and the purpose that it is being used.
When asked, you must be able to prove that you comply, and if you are processing large amounts of data you will need to have a designated Data Protection Officer (DPO) overseeing compliance. Ideally, you want someone that has a good understanding of the operational components of your business, data protection, compliance, infrastructure, and security.
Can you do this now?

Keeping it safe
Information security goes hand-in-hand with privacy, and the GDPR has very specific requirements for securing EU citizen data and what your enterprise must do in case of a breach.

Paying a hefty fine may be one of them. If your database is hacked, EU citizen data may be compromised. There are harsh penalties for data breaches that could lead to additional fines for non-compliance.
Under GDPR security and privacy design are required. They must be embedded into operational processes and your technology systems so that it occurs automatically.
It starts with protecting EU citizen’s Personal Identifiable Information (PII) whenever it is collected, processed or stored. Furthermore, data controllers and processors can pseudonymise and encrypt personal data as a means of protection. However, both controllers and processors must have a process in place to verify the identities of those who access that data.
In addition, enterprises must:

Continually ensure that all systems used to process EU citizen data are secure and resilient, and readily accessible in case of a breach;
Train their employees on privacy, security awareness;
Regularly test and evaluate information security measures;
Work to help third-party contractors secure their data, and
Be able to demonstrate that they comply.

If your enterprise is breached and unprotected data is exposed, the GDPR requires you to alert authorities and notify all affected consumers within 72 hours. If you have done your due diligence and securely encrypted your data, you may escape this obligation.

The ‘Zen’ mind of readiness
Clearly, for many organizations implementing GDPR will require a significant amount of time, effort, and resources. However, to continue doing business with EU citizens and to avoid steep fines; regardless to whether you have a EU presence or not, you will have to demonstrate that you comply with this lengthy, complex regulation by May 25th.

For many, meeting this deadline is an intimidating prospect.

According to one report, two-thirds of businesses expect they will need to change their global business strategies to comply with the GDPR.
More than half say they expect to incur fines for non-compliance.

Your business doesn’t have to be among them. ZenGRC governance, risk, and compliance software can evaluate your systems and networks to pinpoint gaps in your GDPR compliance, freeing you from uncertainty, stress, and spreadsheets.

Our powerful tool can generate user-friendly dashboards and checklists to help you meet all 99 GDPR provisions with clarity and calm serenity.
If you act now ZenGRC’s simple, fast deployment can help you get there before May 25th. Isn’t it time you entered the Zen ‘mind of readiness’ for the GDPR? Schedule a demo today.

Why International Women’s Day Matters to Information Security

ZenGRC Team · March 8, 2018 ·

International Women’s Day, celebrated on March 8 every year, focuses on women’s hidden contributions to society. In the information security space, women remain outnumbered. While in 2013, women represented 11% of the global cybersecurity workforce, the number increased to 20% for the first quarter of 2018. However, this percentage continues to be less than the representation of women in other fields. Focusing on diversity and inclusion means more than hiring people; it means raising voices and boosting those voices.

Why It Matters to Celebrate International Women’s Day in Information Security

What is International Women’s Day?

International Women’s Day, observed since the early 1900’s, represents a collective call for gender parity. With women still earning less money and notoriety than men in many workplaces, the day raises voices to help promote women’s continued contributions.

Why is Discussing International Women’s Day Important to Cybersecurity?

The movie Hidden Figures increased public awareness regarding women’s role in creating computers. Celebrating Dorothy Vaughan, Mary Jackson, Katherine Johnson, and Christine Darden provided the first step in sharing women’s contributions to computing. Within the smaller niche of cybersecurity, however, women remain woefully under-recognized.

On March 5, 2018, the new Our Security Advocates Conference (OURSA) announced its April 7 inaugural conference as a response to the woefully deficient representation of women at the annual RSA Conference. With only one female keynote speaker out of twenty, the RSA Conference’s 5% representation fell short of industry representation by a full 15%.

Therefore, promoting women’s roles in the information security and cybersecurity space becomes even more critical. When industry-standard conferences ignore women’s value in this space, female workforce members remain sidelined and ignored. However, their contributions have been many and valuable through the history of the information and cyber security spaces.

How One Woman Pioneered the Information Security Space: Becky Bace

In March 2017, the cyber security family lost one of it pioneers and first Founding Mothers, Becky Bace. Her career began in the 1980’s working at the U.S. Department of Defense with the NSA’s National Computer Security Center as an early information security program manager.

As prominent as her security work, Bace’s work as mentor and friend led many to refer to her as “Mama Bear.” Her email handle “infomom” testified to her desire for nurturing start-up companies and new entrants to the security space.

While people often use the word “pioneer” indiscriminately in the technology world, many agree that Bace’s impact defined the term. In August 2017, O’Reilly Media commemorated Bace’s active, emotionally powerful career by creating the Rebecca Bace Pioneer Award for Defensive Security, presented at its annual conference.

How One Woman Helped Establish Information Security Training: Judy Novak

Everyone in the cybersecurity and information security recognizes the SysAdmin Audit Network and Security Institute (SANS) as the premier training organization in the industry. SANS certifications continue to represent the highest standard in ongoing information security education.

What many new to the industry may not realize is that Judy Novak has been working with them since 1998. Over her twenty years with SANS, she has instructed at camps, written courses, and earned the 2010 Lifetime Achievement Award. She also holds patents for target based TCP timestamp reassembly, TCP reassembly, and IP fragmentation devices and systems. With this background, she developed a majority of the SANS TCP/IP course that analysts use for certification.

As a Founding Mother in the information security space, she worked as a founder of the Army Research Labs Computer and Incident Response Team.

How One Woman Broke Security Barriers: Michele Guel

As a woman working in information technology since 1983, Michele Guel epitomizes the definition of Founding Mother. In 1983, not only was IT a new field, but women faced a lower glass ceiling than today.

In 1985, she transitioned to the National Aeronautics and Space Administration (NASA) where she founded the information security program for the Numerical Aerodynamic Simulation (NAS) facility. Her work there included testing and installing new security tools and responding to security events while also providing training to workforce members.

In March 1996, she moved to Cisco Systems to work in what later became the Security and Trust Organization. In 2010, she became one of ten female Distinguished Engineers at Cisco. She continued to inspire women by co-founding the Cisco Women in Cybersecurity Community in 2014.

How One Woman Created Bug Bounty: Katie Moussouris

Founder of Luta Security, Katie Moussouris created Microsoft’s bug bounty program in 2008. A frequent speaker at conventions, Moussouris recently addressed the U.S. Senate about data security and bug bounty programs.

Her career began in the mid-1990s as a genotyping data manager at MIT. By 1999, she was developing initial security response teams which later allowed her to transition to creating automated test suites for intrusion detection software.

A Founding Mother in the security realm, she continues to advocate both for women and information security on Twitter where she has over 49,000 followers.

How One Woman Focused on Legal Protections in Cybersecurity: Christina Ayiotis

Christina Ayiotis began her legal career working with toxic tort and environmental insurance law during the heavily litigated late 1980’s. Alway at the cutting edge of legal issues, Ayiotis transitioned from protecting the physical environment to safeguard the information environment during her time at Ernst & Young International in the late 1990’s where she was responsible for the Global Knowledge-Sharing Agreement documentation process focusing on data protection, privacy, and copyright.

In 2011, she established an independent consulting business focusing on legal issues in the cybersecurity and information security field. Her work includes strategic and operations consulting for cyber risk management and preparedness as part of her variety of services and expertise.

How One Woman Worked to Create Sustainable Ethics and Diversity in Information Security: Cecily Joseph

Like several other Founding Mothers, Cecily Joseph began her information security career working outside of the cybersecurity space as director of the Veritas Software Corporation’s legal department.

Her July 2005 transition to Symantec focused her work on developing a more diverse workforce. Her corporate responsibility report won a 2008 Ceres-ACCA Sustainability Reporting Award. Her work led to Symantec’s listing on the HRC Best Places to Work for LGBT Equality and its reputation as World’s Most Ethical Company.

Her current work in online safety education and cybersecurity skill development overlaps with her ongoing work that champions diversity and inclusion.

How One Woman Protected Free Speech Online: Eva Galperin

As technology changed, so did the face of women in cybersecurity and its Founding. Eva Galperin’s work in protecting free speech online arose out of her political science and international relations background.

In 2007, Galperin started working with the Electronic Frontier Foundation (EFF) which focuses on protecting free speech rights on the Internet. With the rise of social media beginning at the same time, her work in cybersecurity, privacy, and the internet placed her directly into uncharted territory. Her work with EFF includes writing privacy and security training materials while her published research addresses malware in Syria, Vietnam, and Kazakhstan.

Why Celebrate Women’s Contribution to Information Security?

ZenGRC dedicates itself to enabling IT, security, and compliance community members. Showcasing the superpowers of governance, risk, and compliance means showcasing those who create the community. Supporting Women in Security and Privacy is only one step to showcasing our ethical and sustainable business model. Continuing to hire a diverse team and boosting diverse voices aligns with our corporate strategy and mission.

Tracy Z. Maleeff: Wednesday’s Women in Infosec

ZenGRC Team · February 14, 2018 ·

Tracy Z. Maleeff is a Cyber Analyst in a Security Operations Center for a global company. Tracy holds a Master of Library & Information Science degree from the University of Pittsburgh, and holds undergraduate degrees from both Temple University (magna cum laude) and the Pennsylvania State University. She brought her skills from being a law firm librarian into the Information Security industry about two years ago. Tracy has presented at several Security BSides cons as well as at DEF CON’s Recon Village in 2017. She is active online as your guide up a mountain of information on Twitter as @InfoSecSherpa and through her Nuzzel newsletter.

ZenGRC: If you had to choose one event that led you to work in information security, what would it be and why?

Tracy Z. Maleeff: I read an article entitled, “Futureproofing Your Career.” It lead me to reignite a love of tech inside me that I never pursued and going down that path led me to information security. My overused joke is that I realized that my natural paranoia and distrust of things was a career path.

ZenGRC: Why do you like working in the information security environment?

Tracy Z. Maleeff: I like problem-solving and helping people — creating teachable moments to help them better understand security to better protect themselves or at least be a bit wiser online.

ZenGRC: If a n00b to the infosec world asked you for a piece of advice, what would it be?

Tracy Z. Maleeff: Be a sponge. Talk to people, read a lot, be curious, and take it all in. Attend every meetup and conference you are able. Immerse yourself in it in order to learn and make connections with people.

ZenGRC: What is the most important issue facing professionals in the information security landscape today? Why?

Tracy Z. Maleeff: Burnout and stress. Information Security is the Centralia, Pennsylvania mine fire of professional industries. That underground fire began in 1962 and is still burning today. The fire and cybersecurity incidents, never stop. That constant barrage, coupled with unreasonable demands and expectations from executive and management can make Info Sec professionals feel overwhelmed and can easily become spirit and soul crushing. There are ways to manage those feelings so that it doesn’t have to descend into personal darkness.

ZenGRC: What is the most important issue facing consumers in the information security landscape today? Why?

Tracy Z. Maleeff: Paralysis by analysis, in a way. Consumers are overwhelmed by Information Security news and don’t know what to do. Info Sec is very fast moving and the average consumer who isn’t very tech savvy may be still trying to come to grips with what a phishing email is, when now they have to learn how to understand Multifactor Authentication. They have so many terms, concepts, and advice being thrown at them that they often just mentally shut down and wind up doing nothing, to their detriment.

ZenGRC: What are your three “guilty pleasures” that have nothing to do with information security?

Tracy Z. Maleeff: Knitting, cooking/baking, and cheering on my favorite sports teams.

ZenGRC: What’s your favorite book-to-movie adaptation and why?

Tracy Z. Maleeff: “The Namesake” by Jhumpa Lahiri. I thought the acting and cinematography really brought the story off the pages well. I like seeing images of India and film really cemented the culture clash between generations.