ZenGRC

Simply Powerful GRC

ZenGRC Team

Leah Figueroa: Wednesday’s Woman in Infosec

· ·

leah figueroa

Leah Figueroa is a 14 year veteran of the data analytics field and works at Gravwell as Lead Data Engineer. She holds a Master’s in Education, almost completed a Ph.D. in research psychology, and has taught kindergarten. A data aficionado, Leah enjoys working in various areas of data, while still remaining passionate about her crusade to improve student data security.  Leah also enjoys being a fiber artist (knitter) and loves cats, InfoSec, picking locks, cooking, and reading.

If you had to choose one event that led you to work in information security, what would it be and why?

Leah Figueroa: I’ve always been interested in the intersection of information security and data analytics. The one thing is when I was working in San Antonio in geriatric research trials. I had gone through all this HIPAA training to make sure data was secure, but I realized people were throwing out so much data or providing access to it without even seeming to care. I knew I had to do something.

Why do you like working in the information security environment?

Leah Figueroa: I love learning, however cliche that might sound, and working in an environment such as this keeps me on my toes. I’m always learning from someone. Infosec is a never-ending set of challenges, which is exciting for me.

If a n00b to the infosec world asked you for a piece of advice, what would it be?

Leah Figueroa: Keep asking questions. Sometimes, I know those questions feel stupid or silly, but in all reality, asking is how we learn. In infosec, the day you stop asking questions is the day you stop learning and that spell disaster.

What is the most important issue facing professionals in the information security landscape today? Why?

Leah Figueroa: Coming to term with biases. There is a distinct lack of color and gender diversity in infosec.  Times are changing, but it is still slow and it negatively impacts anyone who isn’t the standard infosec person. Infosec is young and is still growing. We need to change the landscape now, not in the future, and we need to do so proactively. Bringing in diversity provides creativity and differing points of views and helps foster an environment that supports continuous learning.  Diversity in an ever-evolving landscape ensures you’re ready for the next threat.

What is the most important issue facing consumers in the information security landscape today? Why?

Leah Figueroa: Complacency. So many breaches happen far beyond the control of the customer and many people feel like there is nothing they can do. It seems easier to just throw one’s hands up and just accept what is happening.  But there are so many things individual consumers can do to protect themselves: password managers, following best practices, like immediately changing passwords on consumer grade IoT devices, etc.

What are your three “guilty pleasures” that have nothing to do with information security?

Leah Figueroa: First, it would have to be bad movies. I enjoy thoroughly awful movies (and great ones, too).  Pauline Kale once said “Movies are so rarely great art, that if we cannot appreciate great trash, we have very little reason to be interested in them.” I find that to be true.

Second guilty pleasure would be science fiction – I LOVE science fiction. I’ve been spending time in the worlds built by Nnedi Okorafor lately.

Third, riding would have to be a guilty pleasure. I have an M endorsement and ride as often as I can.  The world on two wheels is a magical place.

What’s your favorite book-to-movie adaptation and why?

Leah Figueroa: Like Water For Chocolate (Como agua para chocolate).  It’s an adaption of the novel of the same name by Laura Esquivel. The movie manages to capture much of the magical realism that makes the novel so satisfying and wonderful.  I’ve read the book and seen the movie many times and it’s always a great indulgence for me. In many Latin cultures, food is a very important part of life (daily life and special events). Growing up as a Cuban American kid in a predominately Mexican American area, this film always reminds me of home and how food culture shapes us.

Audit Management Software: Finding Your Ferrari

· ·

audit management software

Audit management software seems like a huge cost to a lot of CEOs and Boards of Directors. The nuances between project management and audit management can make specialized audit software feel exorbitant. However, audit management software is like a fancy car. It’s easy to drive, but people don’t always understand what’s under the hood. That’s why audit managers have to help the CEOs, CFOs, and Boards understand why they need to buy the Ferrari as well as the Bugatti.

How is the Project Management Process Similar to the Audit Management Process?

Many steps in the project management process align with the steps in the audit management process. Both require scoping, planning, documentation, and monitoring and controlling. These similarities make a separate audit software appear redundant.

Audit standards set out by the American Institute of Certified Public Accountants (AICPA) control the audit process, and separate project management standards make it tricky to explain the difference.
 
Non-compliance with product management standards can leave a business open to civil liabilities in a product liability lawsuit. Not meeting audit standards, however, can open an organization up to criminal liabilities, as in the case of non-compliance with the Sarbanes-Oxley Act of 2002 (SOX).
 
These different drivers of compliance mean audit management and project management require different vehicles.

How is Project Management Software Different from Audit Management Software?

While project audits and compliance audits both contain the same word, they are different under the hood. As the audit manager, you understand that you can audit a project, but that a compliance audit is an entirely different beast.
 
This difference means both types of audits need individually-responsive management systems. We’re talking about the difference between a Bugatti and a Ferrari. They’re both expensive, sleek, and fast. However, they differ in the mechanics.
 
Both software systems offer ways to track, schedule, plan, and collaborate among stakeholders. However, while both audit and project management require these steps, audit management is much more complex and requires a software that reflects that complexity.
 

Why is Audit Management More Complex?

 
Project management requires groups to work together on a product. While standards exist, and many of them overlap, audit management comes with both internal audits and external audits.  Adding this external layer necessitates nearly constant documentation of the audit process that can be overwhelming when many different internal stakeholders are involved.
 
Moreover, compliance audits often contain overlapping requirements, further complicating the compliance process as information silos keep departments from talking to one another. For example, during an ISO audit, IT audit, PCI DSS audit, and SOX audit, you need to prove that your firewalls are appropriately protecting your data. This may seem easy since everyone uses the same firewall.
 
Except, the requirements for how to configure the firewall and identify which data must be protected don’t always overlap.
 
When departments are setting different controls over the same IT asset, then you have a compliance problem. Although part of the internal audit’s job is to find these problems first, you don’t want to have this problem at all.

Why Are Shared Drives and Spreadsheets So Bad?

 
When your organization started out, you tried to cut costs so that you could continue to grow. As you grew, your business became more complex. For example, perhaps you were a small organization that initially marketed cloud storage solutions to businesses. However, your product is also suitable for healthcare providers. To grow, you need to add HIPAA compliance to your repertoire.
 
As a regulation (not a standard), HIPAA comes with criminal and civil penalties for noncompliance. This means that you really don’t want to make mistakes.
 
Shared drives and spreadsheets can lead to compliance problems for a few reasons. First, without the appropriate controls, employees can accidentally or maliciously change information. Second, using shared drives and spreadsheets as your audit trail can lead to multiple versions of information if different internal stakeholders enter information at different times. This kind of inconsistency and lack of access control often lead to problematic audit reports.
 
Functionally, spreadsheets and shared drives are the used jalopy of the audit management world. They’re great when you’re just starting out because even if they top out at 60MPH, they still work. However, as your organization grows, you need a reliable, state-of-the-art vehicle.

How Automated Audit Management Software Offers You Speed and Value

 
Increasing the sophistication of your business means adding complexity to your compliance by incorporating new types of audits. For example, you may need to manage your vendors as part of HIPAA compliance while also adding SOC 1 or SOC 2 reporting so you can be someone else’s vendor.
 
Outgrowing your legacy systems requires purchasing new systems, setting new controls, and documenting your compliance. ZenGRC’s compliance software allows you to map your new controls to your current stance and then offers rapid updates to your compliance program. As the internal audit manager, you no longer have to compare multiple documents to track your program. You can do it with a single click.
 
ZenGRC’s compliance management software also provides a risk dashboard that gives insight into the effectiveness of your ongoing monitoring so that you can meet internal audit standards.
 
Moreover, the vendor risk dashboard makes the internal audit risk assessment of vendors easy to manage. You can send pre-written Vendor Assessment Surveys that align with PCI DSS requirements and track responses with just a few clicks of your mouse.
 
The Ferarri speed of deployment comes with a Honda price point. This means that you don’t have to choose between the Ferrari project management tool and the Ferrari audit management software. Your CEO, CFO, and Board can have both and still have money left in the budget.
 
For a demo of our speed machine, click here to schedule a demo or contact one of our GRC experts today.
 

Cybersecurity Dangers of Repealing Net Neutrality

· ·

net neutrality words overlaying circuitboard

Although discussions of the upcoming net neutrality repeal abound on the internet, the cybersecurity dangers of repealing net neutrality are less easy to find. Pundits for the repeal argue that it will strengthen the security stance by lessening DDoS attacks. Pundits against the repeal argue that net neutrality is necessary for free information to flow.

The reality is that repealing net neutrality places your customers’ information at risk, regardless of your compliance stance.

Why do proponents argue against the cybersecurity dangers of repealing net neutrality in terms of DDoS attacks?

DDoS attacks are effective because it’s hard to identify which servers are being targeted. Proponents of net neutrality’s repeal bang this drum all day long.
The reality is that narrowing the field of potential targets makes it easier for hackers to find weaknesses.

What are the inherent cybsersecurity dangers of repealing net neutrality?

Presently, companies utilize HTTPS for their websites as well as Transport Layer Security (TLS) and Secure Sockets Layer (SSL) to protect information. The nontechnical short story here is that protecting a site’s visitors means browsers and applications have to ensure that customers are appropriately validating certificates to protect themselves.

TLS requires people browsing to authenticate themselves through code. Called a TLS Handshake, the process basically requires one computer to send a “hello” message that gets verified on the server, encrypted, and then authenticated with a “hello” from the server back to the original computer.

The cybersecurity dangers of repealing net neutrality problem lies in people’s lack of education on security. Think about the number of times that you’ve gotten an error message about an outdated certificate when logging into a WiFi network or a website. If you’re still clicking through because you’ve used the website before, you’re putting information at risk.

Repealing net neutrality would lead people into a false sense of safety because only a few providers could manage the ensuing traffic. If one provider is compromised, the average internet user would likely assume that their device is to blame or that the certificate doesn’t matter. That creates potential for a huge breach.
There’s a lot of technical information out there about end-to-end encryption. The short story: locks at both ends don’t necessarily protect you from people who tunnel in from below.

If your business is like many others out there, you’re installing firewalls and antivirus software to be in compliance with the standards governing your industry. You’re also tracking your updates to make sure that you’re using the most updated software and protecting your customers to build their trust for your brand.

What does the research show about how end-to-end encryption is not protecting against the cybsersecurity dangers of repealing net neutrality?

The research indicates that security products may actually weaken your ability to protect customers. Though they try to keep up with malicious actors, these products are unable to close the security gaps efficiently. Trying to keep up with the ongoing monitoring required by compliance and trying to staying up to date with security patches is only one way to protect information, and it is not enough in isolation. Repealing net neutrality makes this even more difficult.

Imagine the internet as a physical highway with tolls. Imagine that the only way on or off that highway is to pay a toll. No one likes tolls, so part of the population will try to find an alternative. End-to-end encryption acts as the toll at the on and off ramps of the internet highway.

Everyone who has ever tried to avoid a toll has taken backroads and gone the long way. The internet works the same way, and this is how DDoS service attacks work. If one or two side roads get shut down, it messes with only a portion of the daily travel network.

Most people who travel toll highways regularly use some kind of electronic identification card such as FastPass. In many areas of the country, cameras now scan license plate numbers and later send payment requests. This means that all toll highways are collecting personal information, in the same way that internet providers collect information about what people search for and buy.
Imagine a coordinated attack at a series of toll booths. Armed men get out of cars, holding the toll booth workers at gunpoint. They now have access to the toll computers and can access all the data inside.

Just as net neutrality allows a few broadband providers to throttle speed, it also allows those who would steal information to gain easier access to important data. By simply attacking a single endpoint or digging underneath the highway to coordinate an armed attack against toll booth workers, those malicious attackers can now gain access to information that we would all prefer remained private.
Net neutrality protects people’s rights. Small businesses don’t have the means to share their products when they need to pay a premium for the visibility of their content. More importantly, however, net neutrality protects information safety, privacy, and information by diversifying the endpoint vulnerabilities.

Meg Layton: Wednesday’s Women in InfoSec

· ·

person

Dr. Margaret Layton (Meg) has been working in the IT industry for over two decades. In 2001, she joined a start-up company that was acquired by Symantec, and she has since been working in various roles within the company, both on products and working on the intelligence that fuels the front-line responders. She is Director of Engineering for the Cyber Security Services business unit, working with a talented team of software engineers and security professionals building tools for our defenders in cyberspace. Meg has a Doctorate of Information Assurance from the University of Fairfax. She also holds a Master of Science degree in Telecommunications and Computing Management from Polytechnic University in New York, which is now a part of NYU; and a Bachelor’s of Art in Political Science from Albertus Magnus College.  Meg maintains several certifications in the Cyber Security realm that she is passionate about, including both the CISSP and CSSLP certifications from ISC(2), and GIAC certifications for Incident Handling, Forensic Analysis, and Penetration Testing. She is CNSS 4011 and 4012 certified. In her role as Director of Engineering, she also holds Agile certifications. She lives in Virginia with her husband and children, and volunteers as a Technical Mentor for local CyberPatriot organizations, as well as serving as Adjunct Professor for colleges, teaching courses in Information Security, including Computer Forensics and Risk Assessment.

If you had to choose one event that led you to work in information security, what would it be and why?

Meg Layton: There’s probably a couple of different things that led down the path.  When I tell of my start, I often discuss the influence of working in telecom during the dotcom era and working in Africa while learning security.  Security in a developing country is much different than what happens in the U.S.
However, if I had to consider the defining “Here I am and I should stay here” would be the Nimda virus outbreak in 2001. It was what I like to call “the other date in September” that year. I was working in a government facility which was still on severe lockdown. My job was to monitor early versions of SIEM alerting and contact the contractor if I saw anything unusual. There were a lot of delays getting through security in the morning because I forgot that I had my husband’s fishing rods in the van, and metal tubes are suspicious to facilities on lockdown.
I got to my desk, put down my things, checked my screens (it looked fine) and went to get coffee. By the time I returned to the desk, my screen was scrolling through alerts in a ridiculous manner. Because it was a locked down facility, I could only make phone calls.

I called my office. They called a couple of people, and that’s where I found out how collaborative the community really was. By the time the external monitoring service called the facility to “warn of suspicious activity,” we had already removed most of the servers, had an executive briefing, and written rules that would group together and let us know if other infections existed.
A lot of the work that goes on in infosec seems like it is not recognized. But that day, I found the power of smart people working together and making a difference. And plus, I was good at it.

Why do you like working in the information security environment?

Meg Layton: Every day you are solving problems. It isn’t always obvious how, but every day you solve a problem. And in infosec, those problems are often what I tell my kids are “People problems.” Infosec exists because of human traits: desire, doubt, trust, integrity. Human beings are unpredictable and fallible, and all of that is why infosec exists. So there is not always a right answer to a problem, there is just a more secure one or a different way of approaching it. That makes it interesting, every day.

If a n00b to the infosec world asked you for a piece of advice, what would it be?

Meg Layton: Infosec is a wide river, and to get across you need to pick a wave to ride and always learn. The best and most talented people I know in infosec know there is always more to learn. Remember you have to keep learning, since the technology changes so fast you won’t ever get to the “end” and “know everything.” Make mistakes, learn from them, and move on. I guess that was more than a single piece of advice.

What is the most important issue facing professionals in the information security landscape today? Why?

Meg Layton: That’s a hard one because I think there’s a lot. But I think the biggest issue is likely the inability for many professionals to connect their issues with the business needs. The ability to do that will influence investments, regulations, laws, and the future of technology.
I often think of that line from Jurassic Park, “you were so preoccupied with whether you could, you didn’t stop to think if you should.” As we push for agile and faster and more connected, this springs to mind often. How do you articulate how to make things safer in a way that matters not only today, but will matter tomorrow? The infosec professionals better figure it out, and fast.

What is the most important issue facing consumers in the information security landscape today? Why?

Meg Layton: Also hard. Because there is so much facing consumers and so many of them don’t even know it. Probably the biggest issue is understanding the difference between privacy and security combined with  the transparency that organizations provide surrounding these topics. Many consumers are simply unaware, or consider things hard. The stigma needs to change so that the security is accessible and easy to the user so they can have the power to protect themselves.

What are your three “guilty pleasures” that have nothing to do with information security?

Meg Layton: Buffy the Vampire Slayer, because obviously. Musical theater, or really any theater. I often tell folks that my first computer was actually a lighting board, so really theater is why I got into tech. It is not beyond the possibility that I will randomly break into song if I need to. Yay Stage Crew! Third, scrapbooking. I do a lot of preserving of memories and putting pictures on the page kind of soothes me.

What’s your favorite book-to-movie adaptation and why?

Meg Layton: This is tricky. Because I like books so much more than the movies in most cases, and I always have my kids read the books first. What world you enter in your mind when you read is seldom what is created on the screen. So it is going to have to be a toss up, and both because of the sheer talent of the people who created characters: The original Willy Wonka and the Chocolate Factory with Gene Wilder, and the Princess Bride – because, that casting was just genius.

Compliance Offers Internal Stakeholder Value: Automation as Transmogrifier

· ·

compliance offers internal stakeholders value

Compliance offers internal stakeholder value even though your stakeholders don’t always see it. Anyone who’s ever been a fan of Calvin and Hobbes cartoons will remember Calvin’s transmogrifier, the cardboard box that magically transforms him into whatever he wants to be. Compliance automation is the way CISOs and CIOs magically transform compliance into internal stakeholder value.
Request a demo today to see how you can transform compliance into internal stakeholder value.

How to Define Stakeholders

Defining your stakeholders is the first step to showing them the value of compliance. You have internal stakeholders as well as external stakeholders. You have high level stakeholders, and you have those who need detailed information.
Internal stakeholders are often the ones you worry about most because they make decisions about your resources. If you provide them with clear information, they will value you more.

ZenGRC offers different levels of information presentation that allow you to give your stakeholders what they need, the way they need it. Being able to decompose your reporting by demographic makes you more effective and helps transform compliance into more than a requirement. Now, you can show your internal and external partners how your value affects them.

Board of Directors

Your Board needs to know the high level vision of your compliance to prove that they have done their due diligence. For companies that need to be SOX compliant, reporting to the Board has legal ramifications as well as business concerns.
With this in mind, you need a compliance tool that offers your Board a quick view of where you’re compliant, how you manage your vendors, and how this relates to the financial bottom line. If you’re currently managing this information on spreadsheets, making this information clear to your Board is time consuming.

ZenGRC offers high level views such as risk heat maps and a system of record dashboard that gives an easy to digest visual showing the percentages of controls finalized and mapped. When your Board wants to know what you’ve been doing to protect the company, this shows them exactly what they need in a way that they’ll understand.

Executives

You know as a member of the c-suite what your cohort needs. However, you’re also the technical one in the group. Your vice presidents, chief financial officers, and chief executive officers don’t need to understand the technical side of compliance. They need you to show them how compliance fits into their corporate strategies.

Your c-suite wants to know their risk, how you’re mitigating it, and how they can turn that into a financial asset. This means they don’t want the details of your definitions of the threats, vulnerabilities, and controls. They want the overview that shows how you’re protecting the organization and how that affects their strategies.

Automated tools allow you to use clean visuals that show the needed metrics. With ZenGRC’s comprehensive dashboard, you can show your c-suite the current risk profile and your controls for those risks. For example, the status bar graph offers your c-suite a color-coded visual of the tasks assigned, in progress, and completed. This provides the metrics needed to inform long-term business decisions.

Senior Management

These are your guys “in the weeds.” They’re helping you do the work to protect your organization. They’re the ones reviewing access logs. They’re the ones creating passwords. They’re the ones training your company’s employees.

These stakeholders need to be able to share information with you and with each other. If you’re collecting their reviews in documents and spreadsheets, you’re putting your information at risk. If two departments use different controls to protect the same asset, you have a compliance problem.

Automation allows you to store information in a single location while offering your internal stakeholders a comprehensive workflow that organizes information. ZenGRC’s tool for compliance increases stakeholder value by allowing your senior managers to see each other’s information so they can streamline their reviews and documentation. More importantly, you get to set access controls. This means that you decide not only what people see but also what they can change. With automation, you can destroy information silos, give people the information needed for their own tasks, and control your program.

Contributors

These stakeholders are everyone else in the organization who need to understand your compliance stance. They can be middle managers, specialists, auditors, or analysts. For example, your sales team may need to understand your vendor management stance to help sell the organization to a client.

With ZenGRC’s platform, your compliance offers stakeholder value by giving you an easy way to share the compliance posture and milestones. If your sales team needs to know your vendor risk tolerance, they can see it. If your business analyst is trying to streamline business processes, they need to see what controls you have in place before implementing a new application, such as payment processing. This means that ZenGRC’s single source of truth can give the information your stakeholders need to do their jobs more efficiently.

Automating Compliance Offers Internal Stakeholder Value

Your internal stakeholders need to know how you’re servicing them. To do that, you have to share information in ways they understand.

ZenGRC is not only easy for your internal stakeholders to use but also provides easy-to-digest information. Request a demo today.