Showing posts with label SoX. Show all posts
Showing posts with label SoX. Show all posts

Sunday, March 13, 2016

Resources for workshop on security standards/frameworks/regulations for information security professionals

At the 2016 Security BSides Orlando conference, I gave a workshop on security standards, frameworks, regulations for information security professionals.  While not an exhaustive survey of such, I focused on the ones that seem the most known, and which I typically see on job descriptions.

Not covered were enterprise architecture models like Zachman or TOGAF.  Left out are other security frameworks like SABSA or things like RESILIA, FedRAMP or Cloud Control Matrix, SSAE 16/SOC, Secure DevOps, or Maturity Models for security.

Covered were:
  • CIS CSC
  • NIST CSF (plus FFIEC CAT)
  • ISO/IEC 27001
  • FISMA
  • HIPAA
  • GLBA 
  • SOX (plus COSO)
  • PCI-DSS
  • COBIT 5
  • ITIL

Wednesday, June 26, 2013

SL Powers IT Security Lunch & Learn event

Tying in with my recent posting on getting involved with local security events, today I attending a "lunch and learn" event organized by one of our local IT services companies, SL Powers.   They apparently do these events in our local area about once a month, in different locations.  This one had two presentations, both were pretty good.

First up, we had Silka Gonzalez, President & CEO of Enterprise Risk Management, a local company focused on helping their clients with risk management and assessments.  She gave a good overview of some of the various regulatory compliance standards out there that many of us have to deal with:  GLBA, FACTA, SoX, HIPAA/HITECH, FERPA, FISMA, and PCI-DSS.  What I particularly liked was how she pointed out the similarities among many of these, and what are the basic underlining concepts that are common in all of them.

The second talk was by Tom Leffingwell of Juniper Networks.  Now, I have known Juniper as a competitor to Cisco in terms of networking equipment.  What I wasn't aware of was their work in the area of network security.  So it was good to learn more about what they do in this area.  As with these kinds of presentations, you run the risk of being more a sales pitch then a technical overview, and I think he did a good job of staying more technical then sales.

I will keep my eye out for further sessions like these.  SL Powers also has a series of sessions called "Tech on Tap", which also sounds interesting.

I found out about this event via Eventbrite.  If you aren't familiar with this site, check it out.  Great way to find out about events in your area, both free and fee.  As IT people, we need to keep up our skills, so attending these events have multiple benefits.