Vous êtes ici :   Accueil » RSS - Isaca.org
Prévisualiser...  Imprimer...  Imprimer la page...
Base de connaissances

 1640091 visiteurs

 4 visiteurs en ligne


Notre site



Neuchâtel, Suisse

Mes coordonées

Crée votre Code

RSS - Isaca.org

ISACA Now: Posts


RSS feed for the Posts list.

Drive Your Own Destiny in Achieving Goals  Voir?


Adam KohnkeAn individual would be hard-pressed to debate that behaviors and habits individuals exercise in their personal lives have no bearing or effects on their professional career. To that end, the ability to visualize, establish and pursue goals is a useful tool to realizing our personal desires, both personally and professionally. This blog post will provide some insight on basic, but useful, practices that individuals may adopt to help them start setting and achieving relevant goals, as well as explore common problems individuals run into with setting goals, with examples of how to overcome those problems and achieve what they desire.

As individuals, we typically find ourselves strictly focusing on the end result we’d like without really assessing the actions, outcomes, time and effort necessary to achieve the desired result. This leads us to having eyes bigger than our stomachs and is likely to result in failure to achieve our goals. Whether the goal involves obtaining a new security certification, a desired job promotion or paying the mortgage off early, these goals require adequate thought and planning on the challenges to be faced. As Abraham Lincoln is quoted as having said, “Give me six hours to chop down a tree, and I’ll spend the first four sharpening the axe.” Focusing on the journey and preparation necessary to achieve our goals and not the final destination puts us on a track to action and allows us to shed wasted energy on wishful thinking.

My own approach to setting personal and professional goals always uses the SMART method. Goals should be Specific, Measurable, Achievable, Relevant and Time bound. Most organizations adopt the SMART goal method for employee goal-setting, but they are useful for setting personal goals, as well. For example, a SMART personal goal related to achieving the CISA certification could be as follows (assuming a 30 June start date):

  1. Schedule the CISA exam for 1 October
  2. Finish reading the CISA exam preparation guide by 31 July
  3. Complete all CISA practice exam questions with a passing scope of 85 percent by 31 August

Each element is specific to CISA exam preparation, is measurable with dates on each item included, is achievable (as three months of preparation are provided), is relevant to passing the certification exam and is time-bound because the first step of scheduling the exam is driving completion of the following steps. This example shows how achieving small steps can lead us to our larger desired end result. Obviously, there is no guarantee of a pass on the exam, but by setting necessary preparatory goals, there is an increased likelihood of success.

A useful tool for ensuring the continued pursuit of goals is a printed list, either written or typed and printed. The list should be hung somewhere where it serves as constant reminder to fulfill the actions written on it. The medium is not too important as long as the list stares you in the face every day and burns a hole in your brain to get it done! I personally aim to write down and achieve approximately 12 goals every quarter that fulfill a mix of professional and personal accomplishments. Some are easy, such as attend a volunteer event, and some are more difficult goals, such as finish my first Cybrary course.

Revisit your overall personal goals at least quarterly and set new goals on a non-stressful schedule. Make it fun and enjoyable, but ensure goals are meaningful to move you in the direction you desire. Slowly, you’ll start seeing the results and stronger habits will be formed to achieve loftier goals. By leveraging this mindset in my professional life, I have found that I start setting and achieving mini-goals at work when conducting audit engagements. I often use lists to drive my daily work activities and sometimes rework the daily list several times. I usually keep no more than six items on my list, then as I achieve 50 percent or more, I create a new list starting with what’s left over from the previous list.

Our goals will not achieve themselves. Getting what we want typically will require some patience, grit, experimentation and the desire to see things through to the bitter (or hopefully pleasant) end. We are the drivers of our destiny, so again, let’s focus on the journey, and soon enough we will arrive at our intended destination.

Category: Audit-Assurance
Published: 6/14/2019 3:23 PM

... / ... Lire la suite

(06/06/2019 @ 21:24)

Rethinking Cost Analysis in the Era of Cloud Computing and Emerging Tech  Voir?


Katsumi SakagawaHave you thought about cost analysis in the era of cloud operation, combined with other emerging technologies? There is an orthodox way of considering cost analysis: Costs can be fixed, variable or some combination of the two. However, when it comes to analyzing IT costs, traditional cost analysis in the era of emerging technologies is inadequate.

The entire cost element must be taken into account: from where the cost occurs to what the cost consumes. An enterprise not only has to consider emerging technologies, but also has to consider the current legacy system. An inevitable, necessary cost exists in the file service required to produce what an enterprise needs.

You have the groupware function relating to the workplace and project activities, and the firewall function to avoid malicious access and protect data, and their updated plans.

On the other side, a for-profit-enterprise has to earn a profit. A company may have to restructure its home pages and address new systems, possibly with newly emerging technologies like RPA, AI and so on.

The whole cost consists of three categories:

  • The first category involves the fixed costs to maintain the current computer system. There are costs for the hardware and software, middleware, network facility and applications to communicate with employees and outside partners (using, for example, Office 365® and its automatic updating systems), and maintenance of a cloud subscription.
  • The second category includes the inevitable costs to earn profit, such as restructuring a new site where customers access and select goods to purchase in order to gain an advantage against competitors. Here, a cost will vary depending on how much development and re-structuring is needed. A certain company may decide to invest huge amounts in RPA to reduce future cost. Another company may migrate the current on-premise environment to the cloud to pursue reduced costs. These are neither fixed costs nor variable costs, but the costs should be planned for in the budget. It is crucial to analyze the gap between the planned budget and costs consumed.
  • The third category deals with a contingency and risk response costs. I have seen many companies and projects budget for contingencies. For example, 10 percent of the fixed costs often is planned as a contingency cost or the risk response cost. In a sense, this is a semi-fixed cost, not a true fixed cost.
Category: Audit-Assurance
Published: 6/12/2019 3:01 PM

... / ... Lire la suite

(06/06/2019 @ 20:31)

A Look at CIS Controls Version 7.1  Voir?


K. HarisaiprasadCIS Controls Version 7.1, released in April 2019, was developed by Center for Internet Security (CIS), which consists of a community of IT experts. CIS Controls has a set of 20 prioritized controls, divided into three categories as basic, foundational and organizational, which are also termed as Implementation Group (IG) IG1, basic; IG2 – IG1, foundational; and IG3 – IG2, organizational.

The basic category consists of controls for the inventory and control of hardware assets, inventory and control of software assets, continuous vulnerability management, controlled use of admin rights, and the secure configuration for hardware and software on mobile devices, laptops, workstations and servers.

The foundational category has 10 controls: email and web browser protection, malware defenses, limitation and control of network ports protocols and services, data recovery capabilities, secure configuration for network devices, boundary defenses, data protection, controlled access based on the need to know, wireless access control, and account monitoring and control.

The organizational category includes controls for implementing a security awareness and training program, application software security, incident response and management, penetration tests and red team exercises. These controls together form a net that provides best practices for mitigating common attacks against systems and networks.

Organizations should implement basic controls first, followed by foundational and organizational. Basic controls also are referred to as “cyber hygiene,” as these are the essential protections that must be in place to defend against common attacks. IG1 is recommended for small businesses, IG2 is suitable for regional organizations and IG3 is implemented for large corporations. Each control has sub-controls with descriptions for each, and each control has the following elements:

  • Description mentioning criticality of control
  • Actions that the organization should take to implement the control
  • Procedure and tools to enable implementation
  • Entity relationship diagrams that show components of implementation

For example, control 5 is described below as given in the CIS V7.1 document.

CIS control 5: Secure Configuration for Hardware and Software on Mobile Devices, Laptops, Workstations and Servers
Establish, implement, and actively manage (track, report on, correct) the security configuration of mobile devices, laptops, servers, and workstations using a rigorous configuration management and change control process in order to prevent attackers from exploiting vulnerable services and settings.

Why is the control critical?
As delivered by manufacturers and resellers, the default configurations for operating systems and applications are normally geared toward ease-of-deployment and ease-of-use – not security. Basic controls, open services and ports, default accounts or passwords, older (vulnerable) protocols, and pre-installation of unneeded software can be exploitable in their default state.

Developing configuration settings with good security properties is a complex task beyond the ability of individual users, requiring analysis of potentially hundreds or thousands of options in order to make good choices (the procedures and tools section below provides resources for secure configurations). Even if a strong initial configuration is developed and installed, it must be continually managed to avoid security “decay” as software is updated or patched, new security vulnerabilities are reported, and configurations are “tweaked” to allow the installation of new software or to support new operational requirements. If not, attackers will find opportunities to exploit both network-accessible services and client software.

Actions organization should take to implement control


Asset Type

Security Function

Control Title

Control Description







Establish Secure Configurations

Maintain documented security configuration standards for all authorized operating systems and software






Protect Δ

Maintain Secure Images

Maintain secure images or templates for all systems in the enterprise based on the organization’s approved configuration standards. Any new system deployment or existing system that becomes compromised should be imaged using one of those images or templates







Securely Store Master Images

Store the master images and templates on securely configured servers, validated with integrity monitoring tools, to ensure that only authorized changes to the images are possible







Deploy System Configuration Management Tools

Deploy system configuration management tools that will automatically enforce and redeploy configuration settings to systems at regularly scheduled intervals







Implement Automated Configuration Monitoring Systems

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to verify all security configuration elements, catalogue approved exceptions, and alert when unauthorized changes occur




* Asset type includes assets such as applications, devices, users, network, data, etc.,
Δ Security function include Identify, protect, detect, respond and recover

Procedures and tools
Rather than start from scratch developing a security baseline for each software system, organizations should start from publicly developed, vetted, and supported security benchmarks, security guides, or checklists. Excellent resources include:

Organizations should augment or adjust these baselines to satisfy local policies and requirements, but deviations and rationale should be documented to facilitate later reviews or audits.

For a complex enterprise, the establishment of a single security baseline configuration (for example, a single installation image for all workstations across the entire enterprise) is sometimes impractical or deemed unacceptable. It is likely that you will need to support different standardized images, based on the proper hardening to address risks and needed functionality of the intended deployment – for example, a web server in the demilitarized zone (DMZ) versus an email or other application server in the internal network. The number of variations should be kept to a minimum in order to better understand and manage the security properties of each, but organizations then must be prepared to manage multiple baselines.

Commercial and/or free configuration management tools can then be employed to measure the settings of operating systems and applications of managed machines to look for deviations from the standard image configurations. Typical configuration management tools use some combination of an agent installed on each managed system, or agentless inspection of systems by remotely logging in to each managed machine using administrator credentials. Additionally, a hybrid approach is sometimes used whereby a remote session is initiated, a temporary or dynamic agent is deployed on the target system for the scan, and then the agent is removed.

Category: Security
Published: 6/10/2019 2:58 PM

... / ... Lire la suite

(06/06/2019 @ 21:02)

ISACA at Infosecurity Europe: Expert Speakers and New Research at Europe’s Largest Infosec Event  Voir?


ISACA expert speakers, past board directors and chapter leaders provided insight and new research while ISACA representatives highlighted ISACA certifications and training solutions at Infosecurity Europe 2019, 4-6 June in London. With more than 400 exhibitors and 240 educational sessions, the annual exposition and conference attracts the largest infosec and cybersecurity crowd in the region.

Vilius Benetis, president of the ISACA Lithuania chapter and CEO at NRD Cyber Security, presented twice at Infosecurity Europe: “Building or Modernising Own CSIRT/SOC: Practical Tips” and “National or Sectorial Cybersecurity Capability Build-Out: Capability Assessments, CSIRT/SOCs, Threat Landscapes & CIIs.” Benetis shared that if organizations have sensitive data, heavily automated processes, or are part of critical infrastructure, establishing a computer security incident response team (CSIRT) or a security operations center (SOC) will ensure they are ready to respond to threats with internationally accepted incident response methodology.

Leading a team, Benetis said, requires more than technical expertise. “You should be smiling and leading. Concentrate on the manager role when leading a team.” Also, relying on a third party does not mean that responsibility is handed over. “There are experienced consultants to help your journey, but the actual work is done by you,” he said. Benetis will be presenting “Auditing with SOC-CMM: Cyber Security Detection and Incident Response” at Africa CACS 2019 (19-20 August in Johannesburg, South Africa) and Euro CACS/CSX 2019 (16-18 October, in Geneva, Switzerland).

Session presenting is not the only way to reach an audience at Infosecurity Europe. BrightTalk films panels and interviews on the expo floor, taking advantage of the global thought leaders and experts in attendance to tackle hot topics and critical issues. ISACA expert speaker Raef Meeuwisse moderated a BrightTalk panel, “Protecting Against Phishing, Ransomware & Social Engineering,” where industry insiders discussed the imperatives of knowing where your data is, safeguarding your credentials, and educating your staff. Panelists debated whether an organization should identify and protect data depending on its value, or if all data should be protected. Meeuwisse also interviewed Carl Leonard, principal security analyst at Forcepoint, on “How to Protect your Business in the Cloud.”

ISACA Past Board Director Allan Boardman moderated a session dedicated to “Proactive Privacy and Security” – the impact of GDPR one year after implementation, the challenges of achieving compliance with the internet of things (IoT), and best practices for data protection and privacy. Boardman also sat for an interview of his own; BrightTalk visited the ISACA booth and filmed an interview on ISACA’s 2019 State of Cybersecurity Part 2 report, which was released in conjunction with Infosecurity Europe. Boardman will be presenting on “Implementing a Cybersecurity Skills Competencies Framework” and “Strategies for Dealing with an Increasingly Sophisticated Cyber Threat Landscape” as well as a workshop, “Cybersecurity Risk Management: A Practical Approach” at Africa CACS 2019. He also will present “Strategies for Dealing with an Increasingly Sophisticated Cyber Threat Landscape” at Euro CACS/CSX 2019.

CMMI Institute, an ISACA subsidiary, was also an exhibitor at Infosecurity 2019, demonstrating the CMMI Cybermaturity Platform for enterprises. Ivo Maritz, Leiter Cyber Security (CSO/CISO) at BKW, spoke with other attendees about the platform’s assessment tool and how using the platform identified gaps in various business units in the enterprise. “The ultimate goal is to change attitude and behavior  … to have the company and individuals operating in a cyber-safe way, to make it part of their daily work and responsibilities,” Maritz said.

Infosecurity and ISACA are teaming up for the first Infosecurity ISACA North America Expo and Conference 2019, 20-21 November, in New York City.

Category: Security
Published: 6/7/2019 12:07 PM

... / ... Lire la suite

(06/06/2019 @ 19:52)

Dernière mise à jour : 15/06/2019 @ 03:44