MEJORES PRACTICAS EN
CIBERSEGURIDAD
Roberto Hernndez Rojas Valderrama, CISA, CISM, CGEIT, CRISC, ITIL Foundation
ISO 27001 LA, PMP, CFSP
Presidente ISACA Captulo Ciudad de Mxico
OBJETIVO
Revisar el contenido de algunas guas de
la ISACA que pueden apoyar a las
organizaciones en la mejora de la
ciberseguridad
Nota: Se presenta la documentacin en ingls, puesto que los
documentos actualmente no tienen traduccin al espaol
AGENDA
ISACA - Principios de Privacidad y
administracin del programa
NIST Marco de Trabajo para mejorar la
ciberseguridad en Infraestructura Crtica
Ciberseguridad y COBIT 5
ISACA - Principios de
Privacidad y administracin
del programa
DIFERENCIA ENTRE PRIVACIDAD Y
SEGURIDAD
Fuente: ISACA Privacy Principles and Program Management Guide
7 CATEGORAS DE PRIVACIDAD
Fuente: ISACA Privacy Principles and Program Management Guide
7 CATEGORAS DE PRIVACIDAD
Fuente: ISACA Privacy Principles and Program Management Guide
RIESGOS ASOCIADOS
Social media
Evolving cloud and container computing services
Mobile applications (apps)
Big data analytics
Internet of Things (IoT)
Bring your own device practices (BYOD)
Tracking/surveillance technologies
Fuente: ISACA Privacy Principles and Program Management Guide
14 PRINCIPIOS DE PRIVACIDAD DE
ISACA
Principle 1: Choice and consent
Principle 2: Legitimate purpose specification and use limitation
Principle 3: Personal information and sensitive information life cycle
Principle 4: Accuracy and quality
Principle 5: Openness, transparency and notice
Principle 6: Individual participation
Principle 7: Accountability
Principle 8: Security safeguards
Principle 9: Monitoring, measuring and reporting
Principle 10: Preventing harm
Principle 11: Third party/vendor management
Principle 12: Breach management
Principle 13: Security and privacy by design
Principle 14: Free flow of information and legitimate restriction
Fuente: ISACA Privacy Principles and Program Management Guide
NIST Marco de Trabajo para
mejorar la ciberseguridad en
Infraestructura Crtica
INFRAESTRUCTURA CRTICA
Critical infrastructure is defined in the Executive Order as
systems and assets, whether physical or virtual, so vital to the
United States that the incapacity or destruction of such systems
and assets would have a debilitating impact on security, national
economic security, national public health or safety, or any
combination of those matters.
Due to the increasing pressures from external and internal
threats, organizations responsible for critical infrastructure need
to have a consistent and iterative approach to identifying,
assessing, and managing cybersecurity risk. This approach is
necessary regardless of an organizations size, threat exposure,
or cybersecurity sophistication today
Fuente: NIST Framework for Improving Critical Infrastructure Cybersecurity
MARCO DE TRABAJO
The Framework Core is a set of cybersecurity activities, desired outcomes,
and applicable references that are common across critical infrastructure
sectors
Fuente: NIST Framework for Improving Critical Infrastructure Cybersecurity
MARCO DE TRABAJO
The Framework Core
Fuente: NIST Framework for Improving Critical Infrastructure Cybersecurity
MARCO DE TRABAJO
The Framework
Core
Fuente: NIST Framework for Improving Critical Infrastructure Cybersecurity
MARCO DE TRABAJO
Framework Implementation Tiers (Tiers) provide context on how an
organization views cybersecurity risk and the processes in place to manage
that risk. Tiers describe the degree to which an organizations cybersecurity
risk management practices exhibit the characteristics defined in the
Framework
Tier 1: Partial
Tier 2: Risk Informed
Tier 3: Repeatable
Tier 4: Adaptive
Risk Management Process
Integrated Risk Management Program
External Participation
Cyber Supply Chain Risk Management
Fuente: NIST Framework for Improving Critical Infrastructure Cybersecurity
MARCO DE TRABAJO
A Framework Profile (Profile) represents the outcomes based on business
needs that an organization has selected from the Framework Categories and
Subcategories. The Profile can be characterized as the alignment of
standards, guidelines, and practices to the Framework Core in a particular
implementation scenario. Profiles can be used to identify opportunities for
improving cybersecurity posture by comparing a Current Profile (the as is
state) with a Target Profile (the to be state).
Fuente: NIST Framework for Improving Critical Infrastructure Cybersecurity
IMPLANTACIN DEL MARCO DE
TRABAJO
Fuente: NIST Framework for Improving Critical Infrastructure Cybersecurity
IMPLANTACIN DEL MARCO DE
TRABAJO
Step 1: Prioritize and Scope. The organization identifies its business/mission objectives and high-level
organizational priorities. With this information, the organization makes strategic decisions regarding
cybersecurity implementations and determines the scope of systems and assets that support the selected
business line or process.
Step 2: Orient. Once the scope of the cybersecurity program has been determined for the business line or
process, the organization identifies related systems and assets, regulatory requirements, and overall risk
approach. The organization then consults sources to identify threats and vulnerabilities applicable to
those systems and assets. identifies threats to, and vulnerabilities of, those systems and assets.
Step 3: Create a Current Profile. The organization develops a Current Profile by indicating which
Category and Subcategory outcomes from the Framework Core are currently being achieved.
Step 4: Conduct a Risk Assessment. The organization analyzes the operational environment in order to
discern the likelihood of a cybersecurity event and the impact that the event could have on the
organization. It is important that organizations identify emerging risks and use cyber threat information
from internal and external sources to gain a better understanding of the likelihood and impact of
cybersecurity events.
Fuente: NIST Framework for Improving Critical Infrastructure Cybersecurity
IMPLANTACIN DEL MARCO DE
TRABAJO
Step 5: Create a Target Profile. The organization creates a Target Profile that focuses on the assessment
of the Framework Categories and Subcategories describing the organizations desired cybersecurity
outcomes.
Step 6: Determine, Analyze, and Prioritize Gaps. The organization compares the Current Profile and
the Target Profile to determine gaps. Next, it creates a prioritized action plan to address those gaps that
draws upon mission drivers, a cost/benefit analysis, and understanding of risk to achieve the outcomes in
the Target Profile - drawing upon mission drivers, a cost/benefit analysis, and risk understanding - to
achieve the outcomes in the Target Profile. The organization then determines resources necessary to
address the gaps.
Step 7: Implement Action Plan. The organization determines which actions to take in regards to the
gaps, if any, identified in the previous step. It then monitors its current cybersecurity practices against the
Target Profile. For further guidance, the Framework identifies example Informative References regarding
the Categories and Subcategories, but organizations should determine which standards, guidelines, and
practices, including those that are sector specific, work best for their needs.
Fuente: NIST Framework for Improving Critical Infrastructure Cybersecurity
CIBERSEGURIDAD Y COBIT 5
COBIT 5
CIBERSEGURIDAD VS.
SEGURIDAD DE LA INFORMACIN
Information security deals Cybersecurity is concerned
with information, regardless with protecting digital
of its format. It includes: assets. Includes:
Paper documents Networks
Digital and intellectual Hardware
property Software
Verbal or visual Information that is
communications processed, stored or
transported by
internetworked IS
SEVERIDADES DE LOS ATAQUES
Fuente: Transforming Cybersecurity: Using COBIT 5
RIESGOS ORGANIZACIONALES
Fuente: Transforming Cybersecurity: Using COBIT 5
RIESGOS SOCIALES
Fuente: Transforming Cybersecurity: Using COBIT 5
RIESGOS TCNICOS
Fuente: Transforming Cybersecurity: Using COBIT 5
DETALLE DE COBIT 5 Y CIBERSEGURIDAD
Fuente: Transforming Cybersecurity: Using COBIT 5
AGENTES DE AMENAZAS
FUENTE: ENISA Threat Landscape 2013
ATRIBUTOS DE UN CIBERATAQUE
Attack Target
Payload Exploit Vulnerability
Vector (Asset)
COBIT 5 CONJUNTO DE POLITICAS DE
SEGURIDAD DE LA INFORMACIN
Business
Continuity/
Disaster
Recovery
Risk Asset
Management Management
Compliance
Information Rules of
Behavior
Security
Acquisition/
Communications
and Operations Development/
Maintenance
Vendor
Management
Fuente: Transforming Cybersecurity: Using COBIT 5
ASEGURAMIENTO DE LA
CIBERSEGURIDAD
Fuente: Transforming Cybersecurity: Using COBIT 5
PASOS DE INVESTIGACIN
8 PRINCIPIOS PARA TRANSFORMAR LA
CIBERSEGURIDAD
Principle 1. Know the potential impact of cybercrime and
cyberwarfare.
Principle 2. Understand end users, their cultural values and their
behavior patterns.
Principle 3. Clearly state the business case for cybersecurity, and
the risk appetite of the enterprise.
Principle 4. Establish cybersecurity governance.
Principle 5. Manage cybersecurity using principles and enablers.
Principle 6. Know the cybersecurity assurance universe and
objectives.
Principle 7. Provide reasonable assurance over cybersecurity.
Principle 8. Establish and evolve systemic cybersecurity.
Fuente: Transforming Cybersecurity: Using COBIT 5
