Security

Note-to-self: MNM van KSZ (Minimale normen – Sociale Zekerheid)

Minimale Normen / Normes Minimales van de KSZ (Kruispuntbank van de Sociale Zekerheid) gebaseerd op de ISO27001/ISO27002

“De toepassing van de minimale normen informatieveiligheid en privacy is verplicht voor instellingen van sociale zekerheid overeenkomstig artikel 2, eerste lid, 2° van de wet van 15 januari 1990 houdende oprichting en organisatie van een Kruispuntbank van de Sociale Zekerheid (KSZ). Bovendien moeten de minimale normen informatieveiligheid en privacy eveneens toegepast worden door alle organisaties die deel uitmaken van het netwerk van de sociale zekerheid overeenkomstig artikel 18 van deze wet. Tenslotte kan het sectoraal comité van de sociale zekerheid en van de gezondheid de naleving van de minimale normen informatieveiligheid en privacy ook opleggen aan andere instanties dan de hogervermelde.  ”

Bookmark:

(NL) https://www.ksz-bcss.fgov.be/nl/gegevensbescherming/informatieveiligheidsbeleid

(FR) https://www.ksz-bcss.fgov.be/fr/protection-des-donnees/politique-de-securite-de-linformation

(edit)

Opmerking: voor alle duidelijkheid, op zich zijn deze documenten geen nieuwigheid maar buiten de SZ zijn deze normen minder gekend… vandaar dat het toch nuttig is om ze bij te houden als geheugensteun en referentie. Je komt er sneller mee in contact als je denkt…

Cybersecurity voor vrijeberoepen en KMO (Webinar bij VLAIO)

Afgelopen vrijdag 21 februari, organiseerde Agentschap Innoveren & Ondernemen een praktisch webinar over Cybersecurity.

We toonden een vernieuwende aanpak die de zelfredzaamheid en veerkracht bij KMO’s inzake cybersecurity helpt vergroten.

Cybersecurity wordt beschouwd als één van de grootste bekommernissen in het huidige ondernemerschap. De veiligheid van (klanten)gegevens is een topprioriteit en een beleid hieromtrent uitwerken is noodzakelijk. Als adviseur zult u wel vaker de vraag krijgen van uw klanten over hoe ze hiermee aan de slag moeten gaan.

Hartelijk dank Melissa Gasthuys als gastvrouw en Eveline Borgermans voor de perfecte begeleiding en opname bij Agentschap Innoveren & Ondernemen

Hier de link naar de slides

De link naar de opname:

En je kan altijd nog even gaan kijken op cybervoorkmo.be voor meer tips en hints.

Privatum – Privacy After Work (2020-02-06 collaterals)

OP 6 feb jongstleden, presenteerde ik een sessie bij Privatum, voor hun avondsessies van  “Privacy After Work”.

Dat is een lichte, interessante aanpak om mensen bij elkaar te brengen ivm privacy en gegevensbescherming, dus  ideaal voor netwerking en interessante dingen te leren.

Meer info hier: https://www.privatum.be/privacy-after-work-2/

Hieronder vind je een overzicht van de links en URLs waar ik naar verwees tijdens de sessie.

De handouts van de sessie vind je op SlideShare:

Slide 10; de ISO27701 bouwstenen:

 

Slide 11: (*) Gratis downloads

Slide 21

Uitgebreide ISO27701 mapping met GDPR in XLS formaat (wat handiger)

https://github.com/PeterGeelen/ISO27701Collaterals

Direct links

Extended mapping

https://github.com/PeterGeelen/ISO27701Collaterals/blob/master/20200129%20PECB%20ISO27701%20vs%20GDPR%20-%20extended%20mapping.xlsx?raw=true

Handy mapping

https://github.com/PeterGeelen/ISO27701Collaterals/blob/master/20200129%20PECB%20ISO27701%20vs%20GDPR%20-%20handy%20mapping.xlsx?raw=true

Slide 52

Meer info: https://identityunderground.wordpress.com/2017/11/06/note-to-self-iso27001-iso27002-downloads-tools/

http://www.iso27001security.com/html/toolkit.html

GDPR-ISO27k mapping:  http://www.iso27001security.com/ISO27k_GDPR_mapping_release_1.docx

Meer info over de ISO27701, incl webinars & LinkedIn articles met Q&A

https://www.linkedin.com/in/pgeelen/detail/recent-activity/posts/

Interessante update:

Microsoft heeft een open-source mapping gepubliceerd tussen de controles in ISO / IEC 27701 (de nieuwe uitbreiding van de gegevensbescherming van ISO 27001 en 27002) en verschillende wettelijke regels, waaronder de GDPR (Europese Unie).
Het project bevat een Excel-bestand met de onbewerkte gegevens: zie https://github.com/microsoft/data-protection-mapping-project/raw/master/src/assets/database.xlsx

De directe link naar het volledige open source-project zelf is: https://github.com/microsoft/data-protection-mapping-project

Note-to-self: logging policy considerations

Few days ago I got a question from a security officer for guidance on event and system logging.

What I can recommend: a good guideline and indication is this from OWASP.
You know OWASP is THE reference for software security …. with their OWASP top 10 etc.

Check this: https://owasp.org/www-project-cheat-sheets/cheatsheets/Logging_Cheat_Sheet

Another reference from NIST see below, very handy.

These are fairly complete in terms of guideline.

What you should pay special attention to from a policy point of view is

Special accounts

  •  Sensitive accounts
    • Highly priviliged accounts
    • Admin accounts
    • Service accounts
  • Sensitive systems
    • Domain controllers
    • Application servers
  • Sensitive data
    • HR data
    • Finance data
    • Legal data

Regarding the classification of accounts, check these:

For the users you also have to think carefully about events

  • Large volume of failed logons from sensitive users, may indicate
    • Attack
    • Denial of service
    • Hacking
  • Attack on the password database, large volumes of password change attempts …
    •  Smart password ‘testers’ will stay just below the blocking limit ..
  • Successful logons from special accounts at abnormal places or times
  • Changing the rights of sensitive accounts
    • Promotion of regular users to admins or other sensitive accounts in AD or central database

CLASSIFICATION

Make sure you have a data, user and system classification policy.
Define roles and / or categories.
Which objects are “not important”, “not sensitive”, sensitive, important, critical.
The protection must be tailored to the category type.

STORAGE

In addition, you should also write a policy on saving data.
This often poses a logistical problem with disk space.

If you know that sometimes attacks are only detected after 200-300 days, you should be able to do a forensic investigation in that period.
But that does not have to be on live data, if it is in backup, that is also good.

In terms of operational data you have to decide how much should be available immediately, for immediate consultation.
For example, that can be 1 month. (if the system can save so much)

BACKUP

Ensure that a backup can be guaranteed for a year (combination of full / differential and / or incremental backups or virtual snapshots …)
This is not a fixed period, but depending on risk management this may be more or less.

IMPORTANT: Time synchronization

Also make sure that you require NTP time synchronization, so that the clocks are exactly matched to each other on all systems.
Log analysis is impossible without correct timing.

SECURITY

Ensure that logs on source systems cannot be deleted by administrators.
Ensure that the logs following are shielded from system owners;
Ideally, you are obliged to store logs centrally (for example in a SIEM system).

Secure backups

Consider managed encryption of data and backups (not ransomware or malware).

Healthy logging and healthy backups

Make sure to test backups and restores!

Check the logs and backup for malware.

LOG CENTRALIZATION

Store logs centrally with sufficient storage capacity, security and backup.

LOG MANAGEMENT

A good management process and regular inspection must become mandatory.
Ensure monitoring for special events or special trends (sudden growth or sudden decrease or disappearance of logs)

Arrange forensic surveillance / detention if a burglary or data breach may need to be reported to the government / DPA / police.

The NIST documentation below provides useful hints and tips about the type of systems, routers, switches, firewalls, servers …

LEGISLATION

Take into account legislation such as GDPR or ePrivacy or others that impose your obligations (legal, judicial, international, fed gov, …)

EXPERIENCE

View and learn from past incidents and known use cases or accidents, which give a clear hint of what protect first.

PDCA – plan-do-check-act

Require a regular review of the policy and the rules, ensure that the guidelines are updated to the requirements and changing situations.

It is difficult if you find out after the facts that your log is not working properly.

Other references

And this is also a reference (NIST)

Note-to-self: 2019 …cost of a data breach…

Many InfoSec and data protection or privacy courses reference 3 authoritative yearly reports that show interesting numbers, statistics and trends about breaches year over year.

And these are extremely useful to talk about to your management…

Interesting to know they all have been updated for 2019.

1. Verizon DBIR

(The Verizon Data breach Investigations Report, DBIR)

https://enterprise.verizon.com/resources/reports/2019-data-breach-investigations-report.pdf (click the view only option)

2. IBM-Ponemon – Cost of a data breach report 2019

https://www.ibm.com/downloads/cas/ZBZLY7KL

(You can always use the official link and give away your privacy…at https://www.ibm.com/security/data-breach)

3. IAPP-EY Annual Governance Report 2019

(IAPP members get it for free)

Hint: the IAPP link below also shows reports of previous years.

https://iapp.org/resources/article/iapp-ey-annual-governance-report-2019/

V2018 also available from the EY website: https://assets.ey.com/content/dam/ey-sites/ey-com/en_gl/topics/financial-services/ey-iapp-ey-annual-privacy-gov-report-2018.pdf

Note-to-self: CCSK vs CCSP

Just for easy, future reference… the difference between CSA CCSK and (ISC)² CCSP, quickly explained:

https://blog.cloudsecurityalliance.org/2018/04/24/ccsk-vs-ccsp-unbiased-comparison/

http://www.confidis.co/cloud-security-certifications-ccsk-vs-ccsp/

 

Microsoft MVP for another year: Thank you!

Just a few hours ago, I got the confirmation that I was awarded the 2019-2020 Microsoft Most Valuable Professional (MVP) award.

It’s a yearly award granted by Microsoft to community leaders and influencers who passionately share their knowledge and drive the MS community.

For some it’s the ultimate goal to get in the MVP program, but as the reward is granted year after year again, based on your impact of last year, it’s never sure you’re in for the next round.
It’s not about the award, but about the drive and mindset to build community. You can’t simply keep up if you don’t have the drive.

But more important, you simply can’t keep up without support.

So I’m proud to receive this award.

And I’m utterly grateful that lots of people around support me in this, very close and very far.

Thank you, my dearest wife and kids to keep me alive.

Thank you, dearest Microsoft TechNet Wiki Geeks (TOO MANY to list here), you keep me going.

Thank you, Ed Price, the greatest Wiki Wizz Kid,

Thank you Tina for supporting the MVP BeNelux and Nordic Community manager.

And many many others, … without you I could not do this!
I dedicate this award to you.

Thank you.