Using COBIT 5 Framework for Cybersecurity Assessment · Using COBIT 5 Framework for Cybersecurity...
26
Conference 2018 Conference 2018 Using COBIT 5 Framework for Cybersecurity Assessment Hugh Burley, Trevor Hurst, and Ivor MacKay
Transcript of Using COBIT 5 Framework for Cybersecurity Assessment · Using COBIT 5 Framework for Cybersecurity...
Conference 2018Conference 2018
Using COBIT 5 Framework for Cybersecurity Assessment
Hugh Burley, Trevor Hurst, and Ivor MacKay
Conference 2018
Speakers
Trevor Hurst, Chief Information OfficerMinistry of Advanced Education, Skills & Training
Hugh Burley, Manager of Information Security/Information Security OfficerThompson Rivers University/BCNET
Ivor MacKay, Manager, Information TechnologyBCNET
Conference 2018
Agenda
1. COBIT 5 Refresher2. Why COBIT 53. Assessments4. Q & A
Conference 2018
COBIT 5 Refresher
Conference 2018
COBIT PRINCIPLES
Conference 2018
Meeting Stakeholder Needs
Conference 2018
COBIT 5 ENABLERS
Conference 2018
GOVERNANCE VS MANAGEMENT
Conference 2018
Conference 2018
Why COBIT 5?
Conference 2018
Alignment“How do I ensure all of our
Digital investments contribute to Stakeholder Value and enable the strategy of my Institution?
Audit preparation (Risk Management)
Tell a better story (funding)
“How do I ensure benefits are realized and IT risks are
mitigated? How can I prepare for upcoming Audit and/or
review activity?
“How do I better communicate the gaps in our
environment and achieve better funding?
Conference 2018
OAGBC General Computing Controls Report
http://www.bcauditor.com/sites/default/files/publications/reports/OAGBC%20General%20Computing%20Controls%20Report_FINAL.pdf
Conference 2018
COBIT Maturity
Conference 2018
COBIT Maturity
Conference 2018
Assessments
Conference 2018
Assessment vs Audit
Or is it really Gap Analysis vs. Internal Audit vs. Pre-Assessment
Conference 2018
Differences Between the COBIT 4.1 and the COBIT 5
APO12 Manage Risk
APO13 Manage Security
BAI06 Manage Changes
DSS02 Manage Service Requests and Incidents
Conference 2018
Assessment Methodology
Conference 2018
KEY AREA: RISK
a) Levelofriskacceptanceb) Riskreviewc) Riskapproval
KEY AREA: MANAGING SECURITY
Conference 2018
Risk Assessment Consequence Table
Conference 2018
KEY AREA: MANAGING CHANGE
a) Methods of assessing change and its risks
b) Approval process
KEY AREA: MANAGE SERVICE REQUESTS AND INCIDENTS
a) Problem trackingb) Evidence of reviewing Incidents and
Requests
Conference 2018
Self-Assessment
Conference 2018
Self-Assessmenthttp://www.isaca.org/COBIT/Pages/Self-Assessment-Guide.aspx
Conference 2018
Self-Assessmenthttp://www.isaca.org/COBIT/Pages/COBIT-5-PAM.aspx
Conference 2018
Info~Tech
