Chapter 10: Governance, Risk, and Compliance

As a security professional, you need to understand that identifying and managing risks can help keep your company environment safe from various types of attacks. We will look at the importance of policies and regulatory frameworks for reducing the risk of successful attacks. We will look at different threats, vulnerabilities, and the roles that different threat actors play.

This chapter is broken down into the following sections:

• Risk Management Processes and Concepts
• Threat Actors, Vectors, and Intelligence Concepts
• The Importance of Policies to Organizational Security
• Regulations, Standards, and Frameworks
• Privacy and Sensitive Data Concepts

Risk Management Processes and Concepts

Risk is the probability that an event will happen – risk can also bring profit. For example, if you place a bet in roulette at a casino, then you could win money. It is, however, more likely that risk will result in financial loss. Companies will adopt a risk management strategy to reduce the risk they are exposed to; however, they may not be able to eliminate risk. In IT, new technology comes out every day and poses new risks to businesses, and therefore risk management is ever-evolving. The main components of risk management are assets, risks, threats, and vulnerabilities. Let's look at each of these, starting with assets:

• Asset: The first stage in risk management is the identification and classification of the asset. If the asset is a top-secret document, you will handle and store it differently than an asset that is unclassified and available for free on the internet.

  For example, if you had 1 kg of trash and you placed...

Threat Actors, Vectors, and Intelligence Concepts

Let's look at threat actors, vectors, and intelligence concepts, starting with threat assessments.

Threat Actors

A threat assessment helps a company classify its assets and then looks at the vulnerabilities of that asset. It will look at all of the threats the company may face, the probability of the threat happening, and the potential loss should the threat be successful.

A threat actor is another name for a hacker or attacker who is likely to attack your company; they all have different attributes. They will investigate your company from the outside, looking for details on social media and search engines. Security companies provide an open-source intelligence test and inform you of your vulnerabilities in terms of threat actors.

Let's now look at threat actor types:

• Hackers: There are three different types of hackers. Let's look at each of them:

  a. Black Hat: The black hat hacker has no information...

The Importance of Policies for Organizational Security

Security policies are a good way to protect your environment against cybercriminals. Not having policies in place would mean that we would leave ourselves at the mercy of cybercriminals. Let's look at the policies that help keep our environments safe, starting with personnel policies, as personnel may be subjected to many types of social engineering attacks.

Personnel

Most cybercrime vulnerabilities relate to social engineering attacks carried out on employees. Therefore, we will put many policies in place to reduce the attack surface. Let's look at some of these policies, starting with onboarding:

• On-Boarding Policy: Companies can allow a Bring Your Own Device (BYOD) policy for employees, and part of that process is carrying out on-boarding and off-boarding. An on-boarding policy states that any device must be checked for viruses, and any application that could cause damage to the company's network...

Regulations, Standards, and Legislation

Regulations, standards, and legislation are put in place to ensure that compliance has been achieved, and most are legally enforceable. From these regulations and standards, we derive our policies to ensure compliance and prevent crime; if companies do not abide by these regulations, they will be fined. Other industry frameworks are only best practices and are not legally enforceable, but vendors will not support any product that has not been set up according to such best practices. In this section, we are going to look at regulations, standards, and legislation followed by a look at key frameworks, benchmarks, and secure configuration guides. Let's start with General Data Protection Regulation (GDPR):

• General Data Protection Regulation (GDPR): The European Union's (EU's) GDPR came into force on 25th May 2018, as a framework for data protection law. It is enforced by the EU Information Commissioner's Office (ICO)...

Privacy and Sensitive Data Concepts

Private and sensitive data must be labeled and handled correctly, as doing otherwise would adversely affect a company's reputation and could lead to a regulatory fine. Let's look at concepts relating to data, starting with the data sovereignty.

Data Sovereignty

Data that has been created and turned into digital data is subject to the laws and regulations of the company in which it was created. It cannot be moved to another region—even for a backup-related reason. This affects both cloud providers and multinational corporations, as they cannot simply move data where they want to. Let us look at the legal implications and then the geographical considerations.

Legal implications

Digital data is subject to the laws and regulations of the region in which it is created. The company creating the data must be compliant; for example, they may need to retain medical data for 25 years, financial data for 5 years, and...

Review Questions

Now it's time to check your knowledge. Answer the questions, then check your answers, found in the Solutions section at the end of the book:

1. What is a vulnerability in relation to risk management?
2. What is the purpose of BPA?
3. What is a multiparty risk?
4. What is IP theft?
5. What is the difference between an MOU and an MOA?
6. What is tokenization and why is it stronger than encryption?
7. One of the junior members of the IT team installs more copies of a piece of software than are allowed by the licenses that the company has purchased. What have they just carried out?
8. What is the purpose of an ISA?
9. How does the shadow IT threat actor operate and what type of attack could benefit from their actions?
10. What is an inherent risk?
11. What are the four stages of the information life cycle?
12. Why would you use STIX\TAXII?
13. What is the benefit of introducing a separation of duties in the finance department?
14. What is the...