DOCSLIB.ORG

The Technology Sector with Keylight®

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
The Technology Sector with Keylight® The Technology Sector with Keylight® that handle customer data have standards and even customer and audit requirements, records ® ® The Lockpath Keylight Platform the responsibility of protecting vendor contracts. management protocols, and it, and are often times subject security controls must be aligned, enables technology firms to efficiently manage to the same regulations as The platform can map an frequently reviewed and visible their customers. For example, a organization’s compliance across the organization. And the organizational and information security risks, technology firm offering products documents to internal controls, larger a firm grows, the more and services to clients in the regulatory requirements and audits it becomes accountable for. conduct and respond to audits, healthcare field must now adhere citations. The platform can be and demonstrate regulatory compliance. to HIPAA regulations regarding IT configured to manage risk based Traditionally within technology security. Also, many technology on policy specific workflows that companies, the audit team is providers choose to implement incorporate IT data, risk data, small and resources are limited. data security standards and best incident data and other correlated The team needs a solution that The technology sector finds Manage risk controls and business practices like ISO 27001 . data, and workflows that start is efficient and flexible to quickly itself at the epicenter of cyber How do you increase the visibility continuity plans, which and effectively respond to their security and IT risk management. of the risks your company faces increases visibility into the exponentially growing workload. Customers of technology firms when data is siloed? How do potential impact on the expect them to know and employ you communicate the complex organization. The Keylight Platform helps the most advanced security and technical nature of certain • Assess internal and external technology companies who must solutions, while increasing risks to executives and board risks. “Unlike most platform providers, frequently respond to customer government regulation and members and equate them to and third-party audits to: industry standards place a greater business strategy and return on The platform also helps compliance burden on the sector. investment? businesses create custom Lockpath’s goal is to implement • Create a question bank to continuity plans, manage answer client audits and A lack of manpower, time and The Keylight Platform provides associated risks and minimize assessments. financial resources hinders the a holistic picture of your the impact of potential losses. Its the Keylight Platform • Track previous responses typical tech firm from efficiently organization’s risk posture, making business continuity management over time for answer tackling proactive compliance it more visible throughout the planning (BCMP) capabilities consistency and accuracy. and security. Point solutions and organization. include: within 30 days to yield a timely • Take advantage of scanners are often brought in as standardized questionnaire temporary fixes to shore up certain Technology companies use • Support for major BCMP templates, including the SIG areas of their infrastructure or the platform to centralize risk frameworks such as ISO return on investment.” and SIG Lite from Shared compliance program, but this lacks data, enabling them to break 22301, FFIEC BCM, and BS- Assessments. the visibility of their risk posture down data silos. This increases 25999-1. as a whole. Many companies will the visibility of information, • The ability for organizations Technology firms must also choose to do nothing, relying on leading to better communication to test their BCM plans via audit their vendors and third out-of-date processes or only and collaboration between tabletop exercises to ensure The Keylight Platform supports the policy management review parties, which requires integration addressing some issues, leaving departments. they are accurate and centralized repositories for process. of information from multiple themselves completely vulnerable. comprehensive. compliance documents, asset sources. The Keylight Platform The platform is used to: • The ability to link BCM plans lists and other data for quick Conduct and respond to audits enables technology firms to Lockpath’s Keylight Platform to policies and controls to access. It supports multiple As vendors to a variety of efficiently assess their vendors, enables technology firms to • Identify gaps in policies, prove compliance. risk and security frameworks, clients -- many themselves suppliers and third parties for efficiently and effectively align compliance and risk including ISO 27001, PCI DSS, heavily regulated -- tech firms risk and compliance. Users can compliance, IT security and management that require Manage policies and compliance NIST, FEDRAMP, and many are increasingly scrutinized manage the full vendor lifecycle risk management practices in attention. The growing use of technology others. The platform’s compliance for the security of their IT from vendor due diligence and the platform with their existing • Link risks, vulnerabilities in today’s business environment mapping capabilities incorporate infrastructure, data management contract negotiation, to review business operations and manage and incidents to policies, has brought data security to the authoritative documents such and email policies. A firm’s and, if needed, termination using it all with a minimal staff. procedures, framework foreground. Technology firms as state regulations, IT industry policy management, client the Keylight Platform. © 2019 Lockpath, Inc. All rights reserved. The platform streamlines the vendor web application, configuration risk, audit, and compliance assessment process by offering: scanners, SIEMs and others. programs in a code-free • Conduct Business Impact manner • A vendor library to centralize Analyses (BIAs) to see the • Is flexible enough to adapt all third-party data, including impact of disruptive events to your processes, rather processes, contacts, on the organization and to than forcing you to adopt an contracts, historical risk prioritize business continuity unfamiliar paradigm. assessments, and other procedures. metrics. Keylight was created by industry • A vendor portal so third Keep stakeholders informed experts who recognized the parties can complete risk The platform’s real-time reporting need for easy-to-use software assessments outside of your capabilities support data-driven that was flexible and scalable environment. decision making. Its click-and- to serve ever-changing and • The ability to automatically configure tools enable users expanding organizational goals generate findings and help to efficiently create real-time and objectives. identify risks and easily route snapshots without the need for risks through workflow for additional programming code. Unlike most GRC providers, remediation. Lockpath’s goal is to implement The Keylight Platform streamlines the Keylight Platform within 30 Prioritize risk and compliance the ability to measure Key days to yield a timely return on The Keylight Platform has the Performance Indicators and Key investment. unmatched capability of storing, Risk Indicators, enabling users centralizing, and integrating large to set program benchmarks Keylight is easily configurable, amounts of data, making it a and identify trends before risks so it can adapt to changes in a valuable tool for organizations to become incidents. The platform’s firm’s operational, regulatory, prioritize their risk management permission-based dashboards or security needs. In fact, while and compliance efforts. The provide stakeholders only the data most platforms require additional platform enables users to: they need. programming and code-writing to reflect changes in a business • Streamline business The most efficient, intuitive GRC environment, Keylight’s point-and- processes via standardized platform on the market click, drag-and-drop approach to workflows and identify Compliance, risk management and configuring a solution removes redundancies, which helps to security needs that exist today may programmers from the staffing create efficiencies. broaden tomorrow, and concerns equation, often resulting in faster • Identify and prioritize you don’t have today will manifest results at a lower cost. organizational risks based when you least expect them. In on business impact by the complex world of technology If you’re frustrated by the slow automatically scoring risk development, you can’t settle for implementation of your current assessments based on an just any solution. You need one that: platform, still trying to retrofit your acceptable risk criticality existing technology to meet new threshold and then • Won’t take months to standards, or just throwing in the routing action items to the implement and configure towel and hoping spreadsheets appropriate party. • Can scale as your company and other antiquated tools can do • Integrate disparate data grows and expands the job, contact Lockpath at sources such as vulnerability, • Can evolve alongside your [email protected]. Lockpath®, the Lockpath icon™, Dynamic Content Framework™, Keylight®, and Blacklight® are property and trademarks of Lockpath, Inc. and registered in the United States. The trademarks and names of other companies and products mentioned herein are the property of their respective owners. © 2019 Lockpath, Inc. All rights reserved. 18032309.
Load more

Recommended publications
  • Information Assurance 101
    BUILT FOR SECURITY Information Assurance 101 Barbara Wert, Regulatory Compliance Specialist FoxGuard Solutions, Inc. “The value of an organization lies within its information – its security is critical for business operations, as well as retaining credibility and earning the trust of clients.” – Margaret Rouse, TechTarget Barbara Wert Regulatory Compliance Specialist September 2017 FoxGuard Solutions, Inc. Executive Summary What is Information Assurance, and why should we care? Headlines over the past 24 months have cited security breaches in Anthem, the Philippines’ Commission on Elections (COMELEC), Wendy’s, LinkedIn, the Red Cross, Cisco, Yahoo, financial institutions around the world, and even the U.S. Department of Justice. As well, statistics show that 43% of cyberattacks target small businesses. Earlier this year, a high school server system in Illinois was infiltrated and the perpetrator attempted to extort the district for $37,000 in order to restore their access to the information on the servers. (1) Information Assurance programs provide a comprehensive approach to addressing the urgent need to protect sensitive data and the systems that house the information for organizations of any size and industry. This white paper will: • Look at some key definitions in the scope of information assurance • Discuss the basic factors of information assurance found in the CIA Triad • Consider the role of risk management in an information assurance program • Explore framework options Contents Executive Summary ......................................................................................................................................
    [Show full text]
  • Minimum Security Requirements for Federal Information and Information Systems
    FIPS PUB 200 _______________________________________________________________ FEDERAL INFORMATION PROCESSING STANDARDS PUBLICATION Minimum Security Requirements for Federal Information and Information Systems _______________________________________________________________ Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8930 March 2006 U.S. DEPARTMENT OF COMMERCE Carlos M. Gutierrez, Secretary NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY William Jeffrey, Director FIPS Publication 200 Minimum Security Requirements for Federal Information and Information Systems ________________________________________________________________________________________________ FOREWORD The Federal Information Processing Standards (FIPS) Publication Series of the National Institute of Standards and Technology (NIST) is the official series of publications relating to standards and guidelines adopted and promulgated under the provisions of the Federal Information Security Management Act (FISMA) of 2002. Comments concerning FIPS publications are welcomed and should be addressed to the Director, Information Technology Laboratory, National Institute of Standards and Technology, 100 Bureau Drive, Stop 8900, Gaithersburg, MD 20899-8900. -- CITA M. FURLANI, ACTING DIRECTOR INFORMATION TECHNOLOGY LABORATORY ii FIPS Publication 200 Minimum Security Requirements for Federal Information and Information Systems ________________________________________________________________________________________________
    [Show full text]
  • Guide for Assessing the Security Controls in Federal
    Archived NIST Technical Series Publication The attached publication has been archived (withdrawn), and is provided solely for historical purposes. It may have been superseded by another publication (indicated below). Archived Publication Series/Number: NIST Special Publication 800-53A Title: Guide for Assessing the Security Controls in Federal Information Systems : Building Effective Security Assessment Plans Publication Date(s): July 2008 Withdrawal Date: June 29, 2011 Withdrawal Note: SP 800-53A is superseded in its entirety by the publication of SP 800-53A Revision 1 (June 2010). Superseding Publication(s) The attached publication has been superseded by the following publication(s): Series/Number: NIST Special Publication 800-53A Revision 1 Title: Guide for Assessing the Security Controls in Federal Information Systems and Organizations: Building Effective Security Assessment Plans Author(s): Joint Task Force Transformation Initiative Publication Date(s): June 2010 URL/DOI: http://dx.doi.org/10.6028/NIST.SP.800-53Ar1 Additional Information (if applicable) Contact: Computer Security Division (Information Technology Lab) Latest revision of the SP 800-53A Revision 4 (as of July 14, 2015) attached publication: Related information: http://csrc.nist.gov/groups/SMA/fisma/ Withdrawal N/A announcement (link): Date updated: JuůLJϭϰ, 2015 NIST Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems Building Effective Security Assessment Plans Ron Ross Arnold Johnson Stu Katzke Patricia Toth Gary Stoneburner George Rogers I N F O R M A T I O N S E C U R I T Y Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8930 July 2008 U.S.
    [Show full text]
  • Tr 103 305-1 V3.1.1 (2018-09)
    ETSI TR 103 305-1 V3.1.1 (2018-09) TECHNICAL REPORT CYBER; Critical Security Controls for Effective Cyber Defence; Part 1: The Critical Security Controls 2 ETSI TR 103 305-1 V3.1.1 (2018-09) Reference RTR/CYBER-0034-1 Keywords cyber security, cyber-defence, information assurance ETSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 Siret N° 348 623 562 00017 - NAF 742 C Association à but non lucratif enregistrée à la Sous-Préfecture de Grasse (06) N° 7803/88 Important notice The present document can be downloaded from: http://www.etsi.org/standards-search The present document may be made available in electronic versions and/or in print. The content of any electronic and/or print versions of the present document shall not be modified without the prior written authorization of ETSI. In case of any existing or perceived difference in contents between such versions and/or in print, the only prevailing document is the print of the Portable Document Format (PDF) version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may be subject to revision or change of status. Information on the current status of this and other ETSI documents is available at https://portal.etsi.org/TB/ETSIDeliverableStatus.aspx If you find errors in the present document, please send your comment to one of the following services: https://portal.etsi.org/People/CommiteeSupportStaff.aspx Copyright Notification No part may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying and microfilm except as authorized by written permission of ETSI.
    [Show full text]
  • Risk Management Guide for Information Technology Systems
    Special Publication 800-30 Risk Management Guide for Information Technology Systems Recommendations of the National Institute of Standards and Technology Gary Stoneburner, Alice Goguen, and Alexis Feringa NIST Special Publication 800-30 Risk Management Guide for Information Technology Systems Recommendations of the National Institute of Standards and Technology Gary Stoneburner, Alice Goguen1, and Alexis Feringa1 C O M P U T E R S E C U R I T Y Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8930 1Booz Allen Hamilton Inc. 3190 Fairview Park Drive Falls Church, VA 22042 July 2002 U.S. DEPARTMENT OF COMMERCE Donald L. Evans, Secretary TECHNOLOGY ADMINISTRATION Phillip J. Bond, Under Secretary for Technology NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY Arden L. Bement, Jr., Director SP 800-30 Page ii Reports on Computer Systems Technology The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology promotes the U.S. economy and public welfare by providing technical leadership for the nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof-of- concept implementations, and technical analyses to advance the development and productive use of information technology. ITL’s responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in federal computer systems. The Special Publication 800-series reports on ITL’s research, guidance, and outreach efforts in computer security, and its collaborative activities with industry, government, and academic organizations. National Institute of Standards and Technology Special Publication 800-30 Natl.
    [Show full text]
  • Catalog of Control Systems Security: Recommendations for Standards Developers 1
    DISCLAIMER This report was prepared as an account of work sponsored by an agency of the U.S. Government. Neither the U.S. Government nor any agency thereof, nor any employee, makes any warranty, expressed or implied, or assumes any legal liability or responsibility for any third party’s use, or the results of such use, or any information, apparatus, product, or process disclosed in this publication, or represents that its use by such third party would not infringe privately owned rights. ACKNOWLEDGMENT This document was developed by the U.S. Department of Homeland Security to help facilitate the development of control systems cybersecurity industry standards. The original author team consisted of representatives from the Department of Homeland Security Control Systems Security Program (CSSP), National Institute of Standards and Technology (NIST), Argonne National Laboratory (ANL), Idaho National Laboratory (INL), Oak Ridge National Laboratory (ORNL), Pacific Northwest National Laboratory (PNNL), and Sandia National Laboratories (SNL). For additional information or comments, please send inquires to the Control Systems Security Program at [email protected] with the word “Catalog” in the subject line. iii iv EXECUTIVE SUMMARY This catalog presents a compilation of practices that various industry bodies have recommended to increase the security of control systems from both physical and cyber attacks. The recommendations in this catalog are grouped into 19 families, or categories, that have similar emphasis. The recommendations within each family are displayed with a summary statement of the recommendation, supplemental guidance or clarification, and a requirement enhancements statement providing augmentation for the recommendation under special situations. This catalog is not limited for use by a specific industry sector.
    [Show full text]
  • The CIS Critical Security Controls for Effective Cyber Defense
    The CIS Critical Security Controls for Effective Cyber Defense Version 6.1 The Center for Internet Security Critical Security Controls for Effective Cyber Defense Version 6.1 August 31, 2016 This work is licensed under a Creative Commons Attribution-Non Commercial-No Derivatives 4.0 International Public License (the link can be found at https://creativecommons.org/licenses/by-nc- nd/4.0/legalcode To further clarify the Creative Commons license related to the CIS Critical Security Controls content, you are authorized to copy and redistribute the content as a framework for use by you, within your organization and outside of your organization for non-commercial purposes only, provided that (i) appropriate credit is given to CIS, and (ii) a link to the license is provided. Additionally, if you remix, transform or build upon the CIS Critical Security Controls, you may not distribute the modified materials. Users of the CIS Critical Security Controls framework are also required to refer to (http://www.cisecurity.org/critical-controls.cfm) when referring to the CIS Critical Security Controls in order to ensure that users are employing the most up to date guidance. Commercial use of the CIS Critical Security Controls is subject to the prior approval of The Center for Internet Security. i The CIS Critical Security Controls for Effective Cyber Defense Introduction 1 CSC 1: Inventory of Authorized and Unauthorized Devices 6 CSC 2: Inventory of Authorized and Unauthorized Software 10 CSC 3: Secure Configurations for Hardware and Software on Mobile
    [Show full text]
  • Competitive Landscape: Integrated Risk Management
    Competitive Landscape: Integrated Risk Management Published: 18 December 2019 ID: G00450383 Analyst(s): Elizabeth Kim The integrated risk management landscape has been rapidly evolving. This has created greater urgency for technology and service providers to reevaluate how they are strategically positioned in the market and how to uniquely position themselves for the future. Key Findings ■ Technology provider consolidation has accelerated over the past year. Risk management technology providers will continue to expand their capabilities through acquisitions to support the integrated risk management (IRM) mindset. ■ Risk management technology providers are adopting a more modular approach to IRM implementation by offering scalable product packaging and pricing that allows customers to gradually expand functionalities. The modular approach supports different customers in their respective risk management journeys. ■ For cybersecurity, delivering support for risk quantification models that are traditionally used for communicating operations risk is a short-term opportunity. Growing scrutiny on cyberexposures will drive demand for security-related business risk quantification beyond the banking, financial services and insurance (BFSI) vertical as means for chief information security officers (CISOs) to improve risk communication in the mid to long term. ■ Risk management technology providers focused on providing visibility and assessment of risks in information security, privacy, resilience and new technology are emerging. Recommendations Technology and service providers in the risk management marketplace should: ■ Identify potential partnerships and integrations with technology providers that offer little or no overlap in capabilities, risk domain or the primary buyers of your solution. ■ Align product messaging around the customer’s risk management maturity and the compliance- centric, operation-centric and business-outcome-centric use cases.
    [Show full text]
  • NIST 800-30, Revision 1, “Guide for Conducting Risk Assessments
    NIST Special Publication 800-30 Revision 1 Guide for Conducting Risk Assessments JOINT TASK FORCE TRANSFORMATION INITIATIVE I N F O R M A T I O N S E C U R I T Y Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8930 September 2012 U.S. Department of Commerce Rebecca M. Blank, Acting Secretary National Institute of Standards and Technology Patrick D. Gallagher, Under Secretary for Standards and Technology and Director Special Publication 800-30 Guide for Conducting Risk Assessments ________________________________________________________________________________________________ Reports on Computer Systems Technology The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL’s responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL’s research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government,
    [Show full text]
  • Assessing Cybersecurity Risk Roles of the Three Lines of Defense
    Assessing Cybersecurity Risk Roles of the Three Lines of Defense GTAG / Assessing Cybersecurity Risk Table of Contents Executive Summary ................................................................................................................... 3 Introduction and Business Significance ..................................................................................... 4 Key Risks and Threats Related to Cybersecurity ...................................................................... 5 Three Lines of Defense: Roles and Responsibilities ................................................................. 5 Owners and Key Activities of the First Line of Defense.......................................................... 6 Common Cyber Threat Controls ......................................................................................... 8 Owners and Key Activities of the Second Line of Defense .................................................... 9 Pitfalls of the First and Second Lines of Defense ............................................................. 10 Role of the Internal Audit Activity as the Third Line of Defense ........................................... 11 Internal Audit Scope and Collaboration ............................................................................ 15 An Approach for Assessing Cybersecurity Risks and Controls ................................................ 17 Cybersecurity Risk Assessment Framework ........................................................................ 17 Component 1: Cybersecurity
    [Show full text]
  • An Introduction to Information Security
    NIST Special Publication 800-12 Revision 1 An Introduction to Information Security Michael Nieles Kelley Dempsey Victoria Yan Pillitteri This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-12r1 C O M P U T E R S E C U R I T Y NIST Special Publication 800-12 Revision 1 An Introduction to Information Security Michael Nieles Kelley Dempsey Victoria Yan Pillitteri Computer Security Division Information Technology Laboratory This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-12r1 June 2017 U.S. Department of Commerce Wilbur L. Ross, Jr., Secretary National Institute of Standards and Technology Kent Rochford, Acting NIST Director and Under Secretary of Commerce for Standards and Technology Authority This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official.
    [Show full text]