Information security frameworks assisting GDPR compliance in bank industry

In the last years, with the consequent increase use of Information Technology (IT) by the population, we watched an increase in the collection and processing of data by the organizations, for various purposes, such as for example the necessary provision of services or marketing campaigns. As a result of the increase of data, there have been several attempts to steal the data to sell or request redemptions from organizations. This situation has shown that organizations as regards data protection and security do not all have the same degree of maturity, and a determining aspect is also that the existing legislation is not the most adequate for the level of IT use in the days of today. To address these issues, the European Union (EU) decided to create the General Data Protection Regulation (GDPR), which entered into force on May 25, 2018, applicable to all organizations dealing with personal data of citizens residing in the European Union. In effect, the organizations combine all their efforts for the implementation of this new regulation, so that fines for non-compliance are not applied. Based on the previous description and with base on a set of best practices and existing frameworks of information security existent currently in the market, this thesis aims to explore how can current IS frameworks help Banks comply with GDPR by mapping the requirements of the regulation with the practices of the frameworks. In a second phase, interviews will be conducted with professionals in the field, in a specific sector where there is more sensitivity for these topics, the bank industry.Nos últimos anos com o consequente aumento do uso de Tecnologias de Informação (TI) pela população, assistimos a um aumento da recolha e tratamento dos dados por parte das organizações, destinando-se a diversos fins, como por exemplo, para a necessária prestação de serviços ou campanhas de marketing. Como consequência do aumento de dados, têm existido diversas tentativas de roubo dos mesmos para se vender ou pedir resgates às organizações. Esta situação tem revelado que as organizações no que respeita à segurança e proteção de dados nem todas têm o mesmo grau de maturidade, sendo que um aspeto também determinante é a legislação existente não ser a mais adequada para o nível de utilização das TI nos dias de hoje. Para colmatar estas falhas a União Europeia (UE) decidiu criar o Regulamento Geral de Proteção de Dados (RGPD), com entrada em vigor a 25 de maio de 2018, aplicável a todos as organizações que tratam dados pessoais de cidadãos residentes na União Europeia (EU). Com efeito as organizações conjugam todos os seus esforços para a implementação deste novo regulamento, de forma a que não sejam aplicadas multas por incumprimento ao mesmo. À imagem do que foi descrito anteriormente e com base num conjunto de boas práticas e frameworks existentes sobre segurança da informação atualmente no mercado, esta tese propõe explorar como os frameworks de segurança da informação podem ajudar os bancos a cumprir com o RGPD, através do mapeamento dos requisitos do regulamento com as práticas dos frameworks. Numa segunda fase realizar-se-á entrevistas com responsáveis na matéria, num setor específico onde existe mais sensibilidade no que toca a estes temas, o setor da banca

Recommendations on European data protection certification

The objective of this report is to identify and analyse challenges and opportunities of data protection certification mechanisms, including seals and marks, as introduced by the GDPR, focusing also on existing initiatives and voluntary schemes

Architecture-based Qualitative Risk Analysis for Availability of IT Infrastructures

An IT risk assessment must deliver the best possible quality of results in a time-effective way. Organisations are used to customise the general-purpose standard risk assessment methods in a way that can satisfy their requirements. In this paper we present the QualTD Model and method, which is meant to be employed together with standard risk assessment methods for the qualitative assessment of availability risks of IT architectures, or parts of them. The QualTD Model is based on our previous quantitative model, but geared to industrial practice since it does not require quantitative data which is often too costly to acquire. We validate the model and method in a real-world case by performing a risk assessment on the authentication and authorisation system of a large multinational company and by evaluating the results w.r.t. the goals of the stakeholders of the system. We also perform a review of the most popular standard risk assessment methods and an analysis of which one can be actually integrated with our QualTD Model

Information Security Governance Simplified

Security practitioners must be able to build cost-effective security programs while also complying with government regulations. Information Security Governance Simplified: From the Boardroom to the Keyboard lays out these regulations in simple terms and explains how to use control frameworks to build an air-tight information security (IS) program and governance structure. Defining the leadership skills required by IS officers, the book examines the pros and cons of different reporting structures and highlights the various control frameworks available. It details the functions of the security department and considers the control areas, including physical, network, application, business continuity/disaster recover, and identity management. Todd Fitzgerald explains how to establish a solid foundation for building your security program and shares time-tested insights about what works and what doesn’t when building an IS program. Highlighting security considerations for managerial, technical, and operational controls, it provides helpful tips for selling your program to management. It also includes tools to help you create a workable IS charter and your own IS policies. Based on proven experience rather than theory, the book gives you the tools and real-world insight needed to secure your information while ensuring compliance with government regulations

”Development and Importance of Management Systems According to ISO for IT Organizations and the Resulting Demand for Consulting Services. An Analysis Between USA and Germany.”

This research analyzes the demand of two international standards, ISO 27001 (Information Security) and ISO 20000-1 (IT Service Management), and the resulting impact on the demand for ISO consulting. Due to rising security breaches with increased media coverage, the public and the government is starting to recognize the importance of protecting critical data. Implementing an Information Security Management System enables companies to sufficiently safeguard their information in the long-term and adhere to governmental regulations. Companies seek to implement an IT Service Management System in order to implement best practices in their organization and enable themselves to compete in the market on a global basis. ISO 27001 and ISO 20000-1 enable a company to operate in more successful ways by reducing the cost of operations and reducing the risk of severe damages to a company’s reputation in case of any cyberattacks. The standards are complex in nature and most companies do not have enough internal resources to implement the standards on their own. Also, the introduction of an Information Security Management System requires adoption by the entire organization and not just single departments. The scope of such a system requires deepener knowledge of the standards in order to successfully implement the management system and for the company to benefit from its long-term effectiveness. Thus, the demand for the implementation of ISO 27001 and ISO 20000-1 result in an increased demand for the services of ISO consulting firms

Run-time risk management in adaptive ICT systems

We will present results of the SERSCIS project related to risk management and mitigation strategies in adaptive multi-stakeholder ICT systems. The SERSCIS approach involves using semantic threat models to support automated design-time threat identification and mitigation analysis. The focus of this paper is the use of these models at run-time for automated threat detection and diagnosis. This is based on a combination of semantic reasoning and Bayesian inference applied to run-time system monitoring data. The resulting dynamic risk management approach is compared to a conventional ISO 27000 type approach, and validation test results presented from an Airport Collaborative Decision Making (A-CDM) scenario involving data exchange between multiple airport service providers

Tietoturvahallintajärjestelmän käyttöönotto CERT-organisaatiossa

This thesis is about implementing an ISMS (Information Security Management System) for a CERT (Computer Emergency Response Team). In this thesis the ISMS is based on the ISO 27000 standard family which is an internationally recognized standard developed by the International Organization for Standardization. This thesis will provide a clear guideline on how to implement the ISO 27001 requirements for ISMS in an effective way for a CERT. A CERT is a team that is responsible for being the single point of contact when something goes wrong. A CERT usually handles vulnerability coordination, incident response and other information security related areas. It is very important that the level of information security inside the CERT is at a decent level. The ISO 27001 is a general level standard meant for every organization there is, so it has to be tailored for the use of the target organization. The implementation of the ISMS requires a lot of research and effort if one wants to implement that for a CERT. This thesis provides one way to have the ISMS successfully implemented. However the actual certification is not in the scope of this thesis as it is not often required for a CERT

Exiting the risk assessment maze: A meta-survey

Organizations are exposed to threats that increase the risk factor of their ICT systems. The assurance of their protection is crucial, as their reliance on information technology is a continuing challenge for both security experts and chief executives. As risk assessment could be a necessary process in an organization, one of its deliverables could be utilized in addressing threats and thus facilitate the development of a security strategy. Given the large number of heterogeneous methods and risk assessment tools that exist, comparison criteria can provide better understanding of their options and characteristics and facilitate the selection of a method that best fits an organization’s needs. This paper aims to address the problem of selecting an appropriate risk assessment method to assess and manage information security risks, by proposing a set of comparison criteria, grouped into 4 categories. Based upon them, it provides a comparison of the 10 popular risk assessment methods that could be utilized by organizations to determine the method that is more suitable for their needs. Finally, a case study is presented to demonstrate the selection of a method based on the proposed criteri

A Collaborative Process Based Risk Analysis for Information Security Management Systems

Today, many organizations quote intent for ISO/IEC 27001:2005 certification. Also, some organizations are en route to certification or already certified. Certification process requires performing a risk analysis in the specified scope. Risk analysis is a challenging process especially when the topic is information security. Today, a number of methods and tools are available for information security risk analysis. The hard task is to use the best fit for the certification. In this work we have proposed a process based risk analysis method which is suitable for ISO/IEC 27001:2005 certifications. Our risk analysis method allows the participation of staff to the determination of the scope and provides a good fit for the certification process. The proposed method has been conducted for an organization and the results of the applications are shared with the audience. The proposed collaborative risk analysis method allows for the participation of staff and managers while still being manageable in a timely manner to uncover crucial information security risks