log monitoring and fie integrity monitoring
TRANSCRIPT
![Page 1: Log Monitoring and Fie Integrity Monitoring](https://reader034.vdocuments.net/reader034/viewer/2022052401/55a416ea1a28abbb6f8b4571/html5/thumbnails/1.jpg)
Log Monitoring, FIM– PCI DSS, ISO 27001,
HIPAA, FISMA and EI3PA
By Kishor Vaswani, CEO - ControlCase
![Page 2: Log Monitoring and Fie Integrity Monitoring](https://reader034.vdocuments.net/reader034/viewer/2022052401/55a416ea1a28abbb6f8b4571/html5/thumbnails/2.jpg)
Agenda
• ControlCase Overview
• About PCI DSS, ISO 27001, HIPAA, FISMA and EI3PA
• Components of a scalable solution
• Challenges
• Q&A
![Page 3: Log Monitoring and Fie Integrity Monitoring](https://reader034.vdocuments.net/reader034/viewer/2022052401/55a416ea1a28abbb6f8b4571/html5/thumbnails/3.jpg)
ControlCase Overview
• More than 400 customers in more than 40 countries.
• Recognized as a Inc 500/5000 company.
• Focus on Compliance as a Service (CaaS).
• Continued update and use of technology based on feedback from customers (including many in this room)
![Page 4: Log Monitoring and Fie Integrity Monitoring](https://reader034.vdocuments.net/reader034/viewer/2022052401/55a416ea1a28abbb6f8b4571/html5/thumbnails/4.jpg)
About PCI DSS, ISO 27001, HIPAA,
FISMA and EI3PA
![Page 5: Log Monitoring and Fie Integrity Monitoring](https://reader034.vdocuments.net/reader034/viewer/2022052401/55a416ea1a28abbb6f8b4571/html5/thumbnails/5.jpg)
What is PCI DSS?
Payment Card Industry Data Security Standard:
• Guidelines for securely processing, storing, or transmitting payment card account data
• Established by leading payment card issuers
• Maintained by the PCI Security Standards Council (PCI SSC)
![Page 6: Log Monitoring and Fie Integrity Monitoring](https://reader034.vdocuments.net/reader034/viewer/2022052401/55a416ea1a28abbb6f8b4571/html5/thumbnails/6.jpg)
What is FISMA
• Federal Information Security Management Act (FISMA) of 2002› Requires federal agencies to implement a mandatory set of
processes, security controls and information security governance
• FISMA objectives:› Align security protections with risk and impact
› Establish accountability and performance measures
› Empower executives to make informed risk decisions
![Page 7: Log Monitoring and Fie Integrity Monitoring](https://reader034.vdocuments.net/reader034/viewer/2022052401/55a416ea1a28abbb6f8b4571/html5/thumbnails/7.jpg)
What is EI3PA?
Experian Security Audit Requirements:
• Experian is one of the three major consumer credit bureaus in the United States
• Guidelines for securely processing, storing, or transmitting Experian Provided Data
• Established by Experian to protect consumer data/credit history data provided by them
![Page 8: Log Monitoring and Fie Integrity Monitoring](https://reader034.vdocuments.net/reader034/viewer/2022052401/55a416ea1a28abbb6f8b4571/html5/thumbnails/8.jpg)
What is HIPAA
• HIPAA is the acronym for the Health Insurance Portability and Accountability Act that was passed by Congress in 1996. HIPAA does the following:› Provides the ability to transfer and continue health
insurance coverage for millions of American workers and their families when they change or lose their jobs;
› Reduces health care fraud and abuse;
› Mandates industry-wide standards for health care information on electronic billing and other processes; and
› Requires the protection and confidential handling of protected health information
![Page 9: Log Monitoring and Fie Integrity Monitoring](https://reader034.vdocuments.net/reader034/viewer/2022052401/55a416ea1a28abbb6f8b4571/html5/thumbnails/9.jpg)
What is ISO 27001/ISO 27002
ISO Standard:
• ISO 27001 is the management framework for implementing information security within an organization
• ISO 27002 are the detailed controls from an implementation perspective
![Page 10: Log Monitoring and Fie Integrity Monitoring](https://reader034.vdocuments.net/reader034/viewer/2022052401/55a416ea1a28abbb6f8b4571/html5/thumbnails/10.jpg)
Components of a solution
![Page 11: Log Monitoring and Fie Integrity Monitoring](https://reader034.vdocuments.net/reader034/viewer/2022052401/55a416ea1a28abbb6f8b4571/html5/thumbnails/11.jpg)
Logging and MonitoringReg/Standard Coverage area
ISO 27001 A.7, A.12
PCI 6, 11
EI3PA 10, 11
HIPAA 164.308a1iiD
FISMA SI-4
Logging
File Integrity Monitoring
24X7 monitoring
Managing volumes of data
![Page 12: Log Monitoring and Fie Integrity Monitoring](https://reader034.vdocuments.net/reader034/viewer/2022052401/55a416ea1a28abbb6f8b4571/html5/thumbnails/12.jpg)
Components of a Logging/FIM/Monitoring solution
List of Assets
Log Generation
FIM Alerts
Correlation using SIEM
Centralized Dashboard
24X7x365 monitoring
Change Management
Incident Management
![Page 13: Log Monitoring and Fie Integrity Monitoring](https://reader034.vdocuments.net/reader034/viewer/2022052401/55a416ea1a28abbb6f8b4571/html5/thumbnails/13.jpg)
Assets
• Comprehensive asset list during deployment
• Continuous monitoring for new assets and assets dropping off
• Correlation with other sources such as scanning and asset management repositories
• Alerts in case of new assets and assets dropping off
![Page 14: Log Monitoring and Fie Integrity Monitoring](https://reader034.vdocuments.net/reader034/viewer/2022052401/55a416ea1a28abbb6f8b4571/html5/thumbnails/14.jpg)
Log Generation
• Servers – syslog, Windows logs
• Network devices – syslog, SNMP, SDEE
• Security devices – syslog, SNMP, SDEE
• Mainframes – SFTP, flat files
• Databases – Localized logging, database logging software in case local logging is resource intensive
• Applications – Database lookup, SFTP, custom plugins
![Page 15: Log Monitoring and Fie Integrity Monitoring](https://reader034.vdocuments.net/reader034/viewer/2022052401/55a416ea1a28abbb6f8b4571/html5/thumbnails/15.jpg)
FIM Alerts
• Agents such as ossec
• Software such as ControlCase HIDS, Tripwire etc.
• Integration with log alerts
• Monitoring vs. expected changes
![Page 16: Log Monitoring and Fie Integrity Monitoring](https://reader034.vdocuments.net/reader034/viewer/2022052401/55a416ea1a28abbb6f8b4571/html5/thumbnails/16.jpg)
Security Information and Event Management
• Consolidated alerts from› Syslog
› Custom sources
› FIM alerts
› SFTP
• Correlation of data based on› Source/Destination IP addresses
› Source of alerts
› Vulnerabilities
› Past history
› User performing action
![Page 17: Log Monitoring and Fie Integrity Monitoring](https://reader034.vdocuments.net/reader034/viewer/2022052401/55a416ea1a28abbb6f8b4571/html5/thumbnails/17.jpg)
Centralized Dashboard
![Page 18: Log Monitoring and Fie Integrity Monitoring](https://reader034.vdocuments.net/reader034/viewer/2022052401/55a416ea1a28abbb6f8b4571/html5/thumbnails/18.jpg)
Example of 24X7X365 Monitoring
![Page 19: Log Monitoring and Fie Integrity Monitoring](https://reader034.vdocuments.net/reader034/viewer/2022052401/55a416ea1a28abbb6f8b4571/html5/thumbnails/19.jpg)
Change Management and Monitoring
Escalation to incident for unexpected logs/alerts
Response/Resolution process for expected logs/alerts
Correlation of logs/alerts to change requests
Change Management ticketing System
Logging and Monitoring (SIEM/FIM etc.)
Reg/Standard Coverage area
ISO 27001 A.10
PCI 1, 6, 10
EI3PA 1, 9, 10
FISMA SA-3
![Page 20: Log Monitoring and Fie Integrity Monitoring](https://reader034.vdocuments.net/reader034/viewer/2022052401/55a416ea1a28abbb6f8b4571/html5/thumbnails/20.jpg)
Incident and Problem Management
Monitoring
Detection
Reporting
Responding
ApprovingLost Laptop
Changes to firewall rulesets
Upgrades to applications
Intrusion Alerting
Reg/Standard Coverage area
ISO 27001 A.13
PCI 12
EI3PA 12
HIPAA 164.308a6i
FISMA IR Series
![Page 21: Log Monitoring and Fie Integrity Monitoring](https://reader034.vdocuments.net/reader034/viewer/2022052401/55a416ea1a28abbb6f8b4571/html5/thumbnails/21.jpg)
Challenges in Logging and Monitoring
Space
![Page 22: Log Monitoring and Fie Integrity Monitoring](https://reader034.vdocuments.net/reader034/viewer/2022052401/55a416ea1a28abbb6f8b4571/html5/thumbnails/22.jpg)
Challenges
• Long deployment cycles
• Skills to manage the product(s)
• Management of infrastructure
• Disparate components – FIM, syslog etc.
• 24X7X365 monitoring
• Increased regulations
• Reducing budgets (Do more with less)
![Page 23: Log Monitoring and Fie Integrity Monitoring](https://reader034.vdocuments.net/reader034/viewer/2022052401/55a416ea1a28abbb6f8b4571/html5/thumbnails/23.jpg)
ControlCase Solution
![Page 24: Log Monitoring and Fie Integrity Monitoring](https://reader034.vdocuments.net/reader034/viewer/2022052401/55a416ea1a28abbb6f8b4571/html5/thumbnails/24.jpg)
ControlCase Log Management Solution
•Agents are installed on each Workstation•Agents monitor File changes for the File Integrity Monitoring (FIM) requirement and also gather and transmit all logs relevant from a compliance perspective to the Log Collector/Sensor on our Appliance
• ControlCase appliance registers and tracks all agents in the field•The sensor/collector collects and compresses logs coming in from the various agents•The logs are finally transported securely to our SIEM console in our Security Operations Center (SOC)
•The SIEM console gathers all the logs, correlates them and identifies threats and anomalies as required by compliance regulations•SOC personnel monitor the SIEM console 24x7x365 and alert our clients and our Analyst teams about any potential issues
Customer Location Service Provider ControlCase SOC
![Page 25: Log Monitoring and Fie Integrity Monitoring](https://reader034.vdocuments.net/reader034/viewer/2022052401/55a416ea1a28abbb6f8b4571/html5/thumbnails/25.jpg)
Why Choose ControlCase?
• Global Reach
› Serving more than 400 clients in 40 countries and rapidly growing
• Certified Resources
› PCI DSS Qualified Security Assessor (QSA)
› QSA for Point-to-Point Encryption (QSA P2PE)
› Certified ASV vendor
› Certified ISO 27001 Assessment Department
› EI3PA Assessor
› HIPAA Assessor
![Page 26: Log Monitoring and Fie Integrity Monitoring](https://reader034.vdocuments.net/reader034/viewer/2022052401/55a416ea1a28abbb6f8b4571/html5/thumbnails/26.jpg)
Contact us for more information
• Visit www.controlcase.com
• Call +1 703 483 6383 (North America)
• Call +57 1 678 3716 (South America)
• Call +44 1276 686 048 (Europe)
• Call +971 4440 5958 (Middle East & Africa)
• Call +91 982 029 3399 (Asia Pacific)
• Email– [email protected]
![Page 27: Log Monitoring and Fie Integrity Monitoring](https://reader034.vdocuments.net/reader034/viewer/2022052401/55a416ea1a28abbb6f8b4571/html5/thumbnails/27.jpg)
Thank You for Your Time