Information Security & Multi-Compliance: Avoiding Audit Fatigue with a Single IT Compliance Strategy

PRESCRIPTIVE
GUIDESERIES
Information Security
and
Multi-Compliance: Avoiding Audit Fatigue with a
Single IT Compliance Strategy
By Gene Kim CTO, Tripwire, Inc. & Jennifer Bayuk Cybersecurity Program Director, Stevens Institute of Technology
Configuration Control for A TACTICAL GUIDE ENABLING YOU TO TAKEVirtual and Physical IT Infrastructures ACTION AND ACHIEVE OPERATIONAL EXCELLENCE.PPRREESSCCRRIIPPTTIIVVEE GGUUIIDDEE:: FMISUMLTAI-COMPLIANCE
TABLE OF CONTENTS
Executive Summary. 4
Information Security Management's Dilemma. 5
Nine Steps to Building An Information Security Compliance Program that Works. 6
Terminology Used in This Document. 8
Step 1: Align with the tone at the top . 9
Step 2: Create a set of merged information security and compliance/business goals . 9
Step 3: Define ideal information security goal indicators. 11
Efficiently Using Change and Configuration Controls to Meet Business Process Goals. 11
Efficiently Using Access Controls to Meet Business Process Goals. . . . . . . . . . . . . . . . . . . . . . . . . . 11
Step 4: Gain an end-to-end understanding of information flow. 12
Step 5: Agree upon control ownership, roles and responsibilities. 13
Step 6: Define the control tests so business process control owners will agree with the results. 14
Step 7: Schedule and conduct regular control tests. 15
Step 8: Organize metrics and remediation reports. 15
Step 9: Detect and respond to significant changes to the control environment. . 16
The Role of Tripwire Enterprise in the Nine Steps. 17
Moving from Crisis Management to Routine Preparation. 17
Addendum To Step 3: Contrasting Approaches To Controlling Change And Access. 18
Meeting Management Objectives for Change Controls. 18
Meeting Management Objectives for Access Controls. 19
About the Authors. 20
Tripwire software has been recommended, endorsed and/or certified by these agencies.
©2009 Tripwire, Inc. Tripwire is a registered trademark of Tripwire, Inc. All oPthaerg pero 3duct and company names are property of their respective owners. All rights reserved.Executive SummaryExperienced managers typically do not want to be held accountable for situations where they have little control or influence. However, this is not an unusual scenario for information security managers. It happens every time they are held responsible for failed results of a compliance audit, even though they had tried to close decisively security implementation gaps that would have led to a more successful outcome.
This situation typically occurs because business process owners and information technology (IT) manage-ment often view information security as a distraction from "real work." Furthermore, information security managers often discover too late that business and IT management were not as prepared for the audits as was represented, resulting in last-minute, but often inadequate, emergency preparation work. As a result, busi-ness stakeholders, IT, and information securit... [download for more]