g Qsec Suitzxe
-
Upload
ari-pribadi -
Category
Documents
-
view
231 -
download
3
description
Transcript of g Qsec Suitzxe
-
2014 WMC GmbH
1
QSEC - ISMS / eGRC
according to
international standards an
methods
-
2014 WMC GmbH
2
WMC IT GRC / ISMS Software + Consulting
Consulting
Information Security Management
Compliance Management
Information Security
IT Security
IT Risk Management
Data Security
Business Impact Analysis (BIA)
Business Continuity Management
QSEC multi-standard compliance management according to international standards!
Information Security Management
Compliance Management
IT Risk Management
Security Incident Management
Measure Management
Business Impact Analysis (BIA)
Data Security
Reporting
+ more: PCI DSS; SOX, ISO 20000
PKA
QSEC references implementation and operation in time and budget
Software and Support
WMC
QSEC partner
-
2014 WMC GmbH
3
GRC ISMS - definition and strategic objectives
Information Security Management System (ISMS) management system with all procedures and rules necessary to implement information security permanent and sustainable in an organization define, steer, check, maintain and Improve constandtly the status of the infomation security
With GRC and ISMS organizations pursue important targets: Liability reduction by providing the proof of
their responsible action
Coverage of company values by steady improvement of the process security and information security
Risk reduction by creation of transparency and implementation of adequate activities against threats
Image improvement and competitive advantage by gaining of trust (with customers, suppliers, banks, insurances and investors)
Cost optimization by increase of the cost value ratio
Governance, Risk Management and Compliance (GRC) the generic term for all activities of an organization to establish
governance und control = Governance reduction of risks = Risk Management compliance to standards, laws and rules = Compliance
QSEC
-
2014 WMC GmbH
4
24,148 Apps heruntergeladen vom
Apple AppStore
463 mobil banking- transactions in Europe
70+ new domains registered
168 million emails sent
1,500 and more Blogposts
510,000 comments on facbook
@
@
@
@
mobility user behavior
social media
applications
IN 60 SEconds
IT-GRC / ISMS the situation today!
Consulting
Implemenation of IT GRC / ISMS up to now:
expensive complex risky
costly in terms of time and staff
often incomplete
intransparent
often only technical
ISO / IEC or DIN/ISO norms are international accepted standards for the implementation of Information Security, Risk and Compliance Management Systems
Complex IT infrastruture and shared data management
Countless access on business data
Increasing risks and threats for the core business +
Complexity: Risks control is a factor of the iteraction of human beeings, organization and technics!
QSEC the IT GRC / ISMS all in one solution!
+
Challenge:
Actual:
Method:
Dilemma:
Solution:
-
2014 WMC GmbH
5
IT GRC / ISMS - topics of managerial level
+ The cost of non-compliance can not be ignored!
+ Know the legal liability risks and minimize!
+ Define management processes and control!
+ Protect the values of the company!
+ Improve the company image and protect the future!
Summary
Management Staff (e.g. IS-agent) Responsible person (e.g. CIO,
CISO, DPS, IS RM)
+ Reduce the cost of eGRC with ISMS!
+ Provide a high level of process quality!
+ Know and assess the operational risks!
+ Implement best practice methods and processes for eGRC!
+ Identifiy liability risks! + Identify and minimize business
process Impacts! + Classify the values of the
company and assure them! + Plan new technology!
+ Monitor, evaluate and optimize business processes and business process change!
+ Conduct compliance reviews quickly and effectively!
+ Keep documentation up to date! + Create effective measure
management! + Plan costs on valid data! + Optimized, uninterrupted work + Improve knowledge management
Where, Who, When, Why, How
-
2014 WMC GmbH
6
QSEC operates exactly according to standards and guidelines
Plan
Do Check
Act
-
2014 WMC GmbH
7
Processes of information security
Processes of the management system Information security management processes (ISMS)
ISMS
Risk
Document
Compliance
Audit/Review
ISMS improvement process for each Control
sensitization processs
Employee recruitment, -lead, and exit precess
Disciplinary process for security breach
Information classification process
Asset inventorying / classification process
Technical process
Security Incident process
BIA / BCM process
IT management process
Policy creation process
Monitoring process
Consulting
plan, support, operate, measure, improve
Assessment of IS-risks Treatment of IS-risks
Document management
Legally-, contractual-, organizational requirements
Review process for KVP and Compliance
-
2014 WMC GmbH
8
QSEC: IT-GRC / ISMS complete solution with added value
Method / Process
Best Practice
Programming/ Technology
extensive support , guidance and provided content
Microsoft SQL data base (SQL Server 2008/2008R2) and .Net web technology (Windows Server 2003 2008 R2, Microsoft IIS, ASP.NET 4.0), Client (Web Browser, SSL)
International accepted standard ISO 27001/2 plus further standards like ISO 9001, ISO 14001, ISO 20000, OHSAS 18001, SOX, PCI DSS (optional)
Consulting
Sustainable software support by the combination of:
ISO 27001/2 original text complete and exact represented Risk Management methodology according to ISO 27005 complete implemented BIA according to ISO 22301 complete implemented Guidance through the whole process (plan-do-check-act) of ISO method Implementation of all demands and requirements out of the ISO standards Logic interconnection of all data and information with their dependent
relationship
Worldwide approved best practice are offered within the solution Usability Outstanding measure management Approved pattern documents Progress supervision, mail reminder Integration of compliance and risk management, measure management, security
incident management and document management
integrated programming (MS Visual Studio 2010) Flexible adabtability to customer needs Extensive reporting-Functions Authorization concept Language option Data migration from existing systems (interfaces)
No double collection of data Reduction of mistakes
-
2014 WMC GmbH
9
QSEC connects business processes and IT assets over all levels
-
2014 WMC GmbH
10
QSEC: IT-GRC / ISMS the solution with added value!
+
Low
sec
uri
ty le
vel a
nd
hig
h r
isks
an
d c
ost
s
Without QSEC: H
igh
val
ue
crea
tio
n
ho
hes
Sic
her
hei
tsn
ivea
u
sin
ken
de
Ko
sten
/Ris
iken
With QSEC:
QSEC
all security activities and data in one system
complete identification and appropriate treatment of critical business processes
handling of information according to their unique classification
established and implemented security organization to the departments
valid data from the IT risk management provide facts for decisions
faster processes with simultaneous time and cost savings
only selective security
no classification of information
no consistent security organization
no valid data for IT Risk Management
high time and cost effort for incomplete security activities
no reference to business processes
Infrastructure
Applications
Information
Busi- ness
-
2014 WMC GmbH
11
QSEC USPs at a glance
Multi-norm compliance
Support of worldwide recognized standards including ISO 9001 (Quality Management), ISO 14001 (Environmental Management), ISO 20000 (IT Service Management), ISO 22301 (BIA & BCM), ISO 27001/2 (Information Security
Management), ISO 27005 (IT Risk Management) PCI DSS, SOX, Basel II, OHSAS 18001 (Occupational Health and
Safety). Subject to individual requirements own contents or sector-specific standards can be integrated
Competitive edge No other IT-GRC solution is as comprehensive
in terms of best practices in the field of measure management
Variable license model
Easy Express and two
suites fit to all customer needs
Interfaces Via optional interfaces
data from mail systems, Active Directory, asset
management systems (e.g. Spider) and ticket systems
(e.g. helpline) can be integrated into QSEC
Usability
Customers confirm high operational guidance and a clear user interface
Quick implementation
QSEC is a flexible out of the box software that can be implemented on a tight schedule
with accurate cost planning
QSEC
Content
QSEC provides norms including measure catalog, risk management
with threats and vulnerability catalog, as well as measure
proposal
Best Practice
In QSEC implemented methods and processes for ISMS, Risk, BIA, BCM are based on international proven
best practice standards
-
2014 WMC GmbH
12
QSEC "all in one compliance (1/2)
QSEC - more result faster!
QSEC
Easy Express Enterprise Edition GRC Edition
QSEC our products Standard browser application Administration-Tool / User authorization
Technology
International standards (ISO 72001/2/5; ISO 20000 etc.) Use patterns, measure proposal, risk catalog
Content
Mail System , Active Directory, Ticket System Data Migration (CSV, XML )
Interfaces
ISMS Process (Compliance-, Risk assessment, BIA/BCM) measure-, document and incident management
Process support
More than 45 reports with maturity degree report Dashboard
Reporting
High user acceptance because of user friendlyness Permanent software support and continiuous improvement
process Usability
-
2014 WMC GmbH
13
QSEC "all in one compliance(2/2) Sustainable support of all ISMS and IT GRC targets!
comprehensively sustainable cost saving
QSEC
QSEC - result complete verification of history and changes
Reduction of liability
permanent, extensive and sustainable information security management
Coverage of company value
identification of really business critical processes and adaquadte measures angainst threats
Risk reduction
increasing trust from business partners (customer,s vendors, banks, ensurances , investors)
Image improvement / competitive advantage
increase of security satus and decrease of risks and at the same time
cost optimization (staff, time and IT budget)
Cost Optimization
Heatmap number of asset groups per risk merit
thre
ats
+ vu
lner
abili
ties
8 5 43 4 3 5
7 8 45 3 4 6
6 56 6 3 6 45
5 7 7 6 8 4
4 4 8 9 8 3
3 3 7 8 7 2
2 6 4 7 6 3
1 2 6 5 2 4
0 6 4 3 3 6
S+B (bzw. S*B)^ AG-Wert > 0 1 2 3 4
asset groups
Scope: location Hamburg
-
2014 WMC GmbH
14
QSEC-Enterprise and GRC Edition module overview
Dashboard Compliance Security- Incidents
Report Risk Measure Document
Business Continuity
BCM Business Continuity
BIA Audit (in planed) Master data
Administration
Core Server, Common platform, Permissions
QSEC interfaces: Mail system, Asset Management (e. g.. SAP, Spider),
AD, Ticket system (z. B. SAP, helpLine)
Katalog Tool (KEP)
Administration Tool
QSEC Versions
QSEC Enterprise Edition QSEC GRC Edition QSEC extensions
-
2014 WMC GmbH
15
QSEC integrates into the existing IT landscape via interfaces!
asset group criticality business processes confidentiality availability integrity
asset group
vulnerability
measures
mail advice
user authorization
business processes
security incidents
QSEC
QSEC-Suite ISMS / BDSG
Integrated
Management System
Active Directory
(AD)
Mail System Incident
Management SAP / helpLine
Asset
Management SAP / Spider
Vulnerability
Management
e.g. Qualys
Prozess
Management
Aris / Adonis
operational risks event Risk Management SIEM
-
2014 WMC GmbH
16
QSEC creates transparency valid data via reporting
available reports:
standard reports
management report
work report
SOA
Actions
Risk
maturity degree
individual reports on demand
QSEC
0,0
1,0
2,0
3,0
4,0
5,0
6,0
7,0
8,0
9,0
10,0
A5 A6 A7 A8 A9 A10 A11 A12 A13 A14 A15
assessm
ent
Controls for ISO 27001
IT security level Q4/2010, Q1/2011 and Q1/2012
Status 2010 Q4
Status 2011 Q1
Status 2012 Q1
Status of
020406080
100120140160
it green
it yellow
it red
total number of
compliance measure status
13%
13%
15%
19%
10%
7%
23%
IT security level
-
2014 WMC GmbH
17
IS - Key Performance Indicator (IS-KPIs) / business ratio by QSEC (excerpt)
IS-Organiztion Maturity degree employee role
Compliance Management Maturity degree per Scope / Scope-comparison / measure per control incl. degree of realization
BIA/BCM Number of ciritical business processes, critical asset groups; asset group
actual-theoretical comparison (GAP analysis), number of disaster recovery
pan and IT disaster recovery plan
Security Incident Management
Measure Management Number of security measures, due date per employee, costs, maturity
degree
Document Management Number of documents, editing status, follow-up
Risk Management Cirtical asset groups incl. risk, measure or risk acceptance
Zurck
C WMC GmbH 2014
KPI
number
of
roles number of employees
2 0
6
4
1
0
16
8
8 4
Maturity degree of scope
Scope1 Scope2
Scope3 Scope4
Number of security incidents per asset group and business process
-
2014 WMC GmbH
18
QSEC-Suite technics
QSEC a web browser based application:
QSEC-Suite - comprehensive IT GRC / Information Security Management System
(ISMS) according to ISO/IEC
Client Web-Server Data base
Web-Browser
SSL
No installation
No maintenance
Microsoft Windows Server 2003/2008R2/2012R2
Microsoft IIS
ASP.NET 4.0
Microsoft SQL Server 2008/ 2008R2
Interfaces
to further systems
Programming by Microsoft Visual Studio 2010
Current Version: 4.2
QSEC
Dashboard Compliance Incident Reporting Risiko Manahmen Dokument
BCM BIA Audit (in Planung)
A
Stammdaten
Administration
Core Server, Gemeinsame Plattform, Berechtigungen
QSEC Schnittstellen: Mailsystem, Asset Management (z. B. SAP, Spider),
AD, Ticketsystem (z. B. SAP, helpLine)
Katalog Erfassungs- und Pflege Tool (KEP)
Administrations Tool
Risk Manager
Compliance Manager
Security
Manager
Auditor
Administrator
Key User
Mitarbeiter
Prozessowner
Vorstand / GF
Aufsichtsrat
CIO
Revision
Datenschutz-beauftragter
Werkschutz
Manahmen
Bewertungen Vorgaben
Genehmigungen
Risiken Chancen
Reifegrad
Analysen
Anforderungen Compliance Informationssicherheit Risikomanagement
Methoden Normen & Gesetze ISO 27001 ISO 27005
Business Impact Analyse Risikomanagement Compliancemanagement
Wirksamkeitsverbesserung Sicherheitsverbesserung Haftungsreduzierung
Ergebnisse Prozesse
-
2014 WMC GmbH
19
Version 4.2
WMC GmbH 2014