Gestión de Riesgos efectiva y sustentable

Transcripción

1 Gestión de Riesgos efectiva y sustentable

2 QUÉ ES RIESGO? 2

3 CONTENIDO 1. Los retos de la Gestión de Riesgos 2. HPRMM 3. Resumen 4. Para llevar 3

4 RETOS DE GESTIÓN DE RIESGOS Desconexión del negocio Resultados vagos Opera en arranques 4

5 LO QUE NECESITAMOS Se require un modelo que refleje necesidades reales de negocio y que genere entendimiento al negocio; debe proporcionar resultados específicos y concretos que guíen la remediación y conviertan las iniciativas en prácticas sustentables. 5

6 HPRMM Mejora contínua HIGH PERFORMANCE RISK MANAGEMENT MODEL (HPRMM) Alineación de negocio Personalización Evaluación INSIGHT Remediación / Sustentabilidad Monitoreo 6

7 Pre-work HPRMM Preparación Framework Mejora contínua Transición Ejecución EVALUACIÓN REMEDIACIÓN CONTINUIDAD 6a

8 HPRMM - ALINEACIÓN ESTRATÉGICA - 1a. Alineación con el negocio Para asegurar la alineación estratégica, se debe entender el contexto. Los lineamientos del modelo de capacidad de GRC pueden utilizarse para obtener el contexto y definir los objetivos y alcance del programa. Contexto (C) MEDIR RESPONDER ORGANIZAR INTERACTUAR DETECTAR ANALIZAR - EVALUAR PRO- ACTUAR Entender el contexto de los negocios y la cultura actual, de manera que la Organización pueda direccionar, y proactivamente influenciar las condiciones para soportar los objetivos. C1 Contexto Externo C2 Contexto Interno C3 Cultura C4 Objetivos OCEG. All rights reserved. 6b

9 HPRMM - ALINEACIÓN ESTRATÉGICA - 1b. Alineación con el negocio Ahora es posible definir el alcance y objetivos: Qué procesos de negocio son afectados? Qué objetivos de negocio están en juego? Podemos utilizar el modelo de Cascada de metas de COBIT: 6b ISACA. All rights reserved.

10 HPRMM - PERSONALIZACIÓN - Se debe generar un marco de trabajo personalizado para la organización en función de los objetivos y el alcance de la iniciativa. Para la parte de Gobernanza se utilizarán los meta-marcos: 1) GRC Capability Model (Principled Performance) de OCEG 2) COBIT 5 Framework (IT Governance) de ISACA Dichos modelos y las necesidades específicas de cualquier entorno tecnológico debe robustecerse con normas, lineamientos y mejores practicas: ISO ISA (antes ISA 99), NISTIR 7268, NIST SP , NIST SP , Requerimientos y lineamientos regulatorios específicos de la industria. FDA, EMEA, SFDA, MHRA, COFEPRIS, SOX, CNBV, GxP, 6c

11 HPRMM - PERSONALIZACIÓN - El marco de trabajo resultante servirá de guía para la implementación, la verificación y el aseguramiento. Area # Assessment Requirements Objective Administration 1.1 Administration 1.2 Current Support Model(s) Administration 1.3 Existing SLA with internal/external providers Organization charts of areas managing and supporting IT and Automation systems identifying specific resources Validate existence of SLA Validate existence and effectiveness of support model and history of execution with internal/external providers for critical components (per site) Dominios Gobernanza Gente Seguridad TI Infraestuctura Cumplimiento Guidelines questions/output 1. SLA exists? 2. Revise the SLA for each chosen critical system (hdw & sfw) 1. Support model defined? 2. Internal or external 3. History of support model (log) 4. Vulnerabilities? Identify the existence or lack of 1. Are all the a structured positions covered? support organization Guideline of Risk Factors under Consideration Vulnerability due to lack or existence of SLA with internal/external providers for critical Lack or Adequacy of Support Model(s) Lack of clear accountability across functional areas 6c Sizing Chosen critical systems INPUT In Scope Per site N/A Yes Per site Critical systems list as well as its components (Hdw & sewn) Organization charts Yes Yes Output Matrix with detail of hdw and sfw and whether it has SLA or not Report & fill risk matrix Report & fill risk matrix /System AWHS FBP 300 FBP 600 TRC-T1 BCD Empower CMS N/A N/A

12 HPRMM - EVALUACIÓN - Planeación y solicitud de información Análisis documental Evaluación Validación de hallazgos Reportes 6d

13 6d HPRMM - EVALUACIÓN - RISK MATRIX Area # Assessment Requirements Objective Guidelines questions/output Guideline of Risk Factors under Consideration Sizing INPUT In Scope Output /System Probability Rating (1-5) Impact Rating (1-3) Risk Factor (Probability x Impact) Systems/Equipment Access Control for Employees, contractors and visitors for data centers, MDF & IDF Validate physical access control procedures PEOPLE 2.1 (Main distribution frame and application to mitigate risks Intermediate distribution frame) as well as control rooms Security awareness program for Evaluate the security culture and the PEOPLE 2.2 employees, contractors & visitors, existence of a security awareness program trainings, documentation and roles. Evaluate the maintenance of security PEOPLE 2.3 Periodic Drills & Tests awareness Periodic Internal/3rd Party audits/risk Validate the existence of assurance PEOPLE 2.4 assessments mechanisms for Information Security Review Access Control policies, procedures and logs for effectiveness: 1. Existence? Information security, IT: 2. Evidence? reliability, compliance/regulatory gaps 3. Review the ACL 4. Is it enforced? 1. Is there mandatory security awareness training for newcomers (internal/external) [evidence). 2. Is there an agreement/document that confirms awareness and understanding 3. Gaps detected Schedule and evidence Are internal/external assessments periodically realized? Schedule Results (verify existence) Are actions taken upon results/recommendations Per site Yes Report & Fill risk Matrix System Security awareness program Per site Yes Report & Fill risk Matrix System materials The awareness training is mandatory training every year. Per site Physical access to the facility is Yes Report & Fill risk Matrix System denied unless the training is completed each year. An assessment is typically only performed every 3 years if the services or systems change within Per site the 3 year window for IT systems. A Yes Report & Fill risk Matrix System similar security assessment life cycle has not been identified or put into place yet for automation PEOPLE 2.5 Departure/Exit Procedure (& changes) Evaluate the measures and risk due to the existent departure/exit/change in HR 1. Is there a process related to information security and system access for whenever people leave or change positions 2. For which systems 3. Execute a walkthrough for one person that has left within 6 months (user of has to be a user of a manufacturing critical system) Per site N/A Yes Report & Fill risk Matrix System Lack of adequate expertise Validate that the personnel has the technical Assemble a matrix with identified personnel (1.4) And map Resources competencies for supporting critical against the critical technology list (provided by J&J) to PEOPLE 2.6 background/expertise/developmental technologies. Identify possible risks due to identify primary and backup of competency / critical plans critical dependencies (sole experts) technology coverage Critical talent without backup Outdated Technical Competencies Training curriculums adequacy & adherence Regulatory & compliance gaps Per site 1) Critical technology list MSS:Layer7_resource_skills_templa Yes Report & fill risk matrix System te (West has this document) Governance for Business and Strategic Leadership/Alignment and Plan (i.e. Identify possible misalignments of IT & 1. Is there governance in place for these projects/programs JJF Template, IT role in s strategic automation projects/programs as well as the in accordance with the enterprise's standards (MSS & JJF, PEOPLE 2.7 plan, business forums existence of a process that guarantees that PPM)? role/participation, reporting enterprise standards are being followed 2. How? relationships) Misalignment between IT/Automation/Business Per site Project Portfolio Yes Report & fill risk matrix system Scorecard/Metrics (i.e. training, CAPAs, number of outages, local/critical systems performance, PEOPLE 2.8 Measure the health of systems operation Events closure on time, Clarity data accuracy, PPM (on time, on budget), SOP revision, etc.) List of Standard Operations Procedure Measure the organizations compliance risks PEOPLE 2.9 (SOP) (on systems operations) 1. Obtain list of systems operation metrics a. Metrics exist b. Are they current c. Are they in control d. Is there a plan to get in control 2. Emit an opinion on the metrics (or lack of them) 1. Are there systems SOPs in place 2. Obtain a list of existing procedures 3. Inquire whether and which processes cover critical operations areas (obtain evidence for one system) a. Backup and restore b. Sys Admin c. Security Regulatory & compliance gaps Too many projects at the same time Misalignment with IT, MSS Compliance Per site project metrics Yes Report & fill risk matrix System System System 1 N/A N/A Chosen System 1 N/A N/A critical org chart Yes Report & fill risk matrix System 1 N/A N/A systems System 1 N/A N/A System 1 N/A N/A System 1 N/A N/A Total Total 69 Number of items in category Number of items in category 9 Overall Risk Overall Risk 7.7

14 HPRMM - EVALUACIÓN - GAP REGISTER Control Application Life Cycle Risk Level Gap Name Gap Category Domain Gap Description Country Region Owner Gap Cause Proposed solution objective Affected (Y/N) (L/M/H) Water Treatment Vulnerable PLC LCM Security 7.1 Plant System Obsolete PLC model MX North L1 Yes Planning H - Upgrade obsolete equipment immediately. - Create a full component level inventory for all critical systems. Outdated Outdated network diagrams in manufacturing - Document all procedures for critical systems. Network Security 7.2 Critical System MX North L1 No Process H Documentation network - Update system and network diagrams immediately. - Implement USB restriction mechanism in critical systems devices. There are obsolete operating systems MS - Upgrade obsolete MS Windows XP operating systems. Vulnerable Software LCM Security 7.3 Windows XP in Control computer and HMI in MX North L1 Yes Process H - Replace Water Treatment Plant server immediately. critical systems - Identify all network protocols and analyse their risks. Vulnerable Software LCM Security 7.3 Water Treatment Plant System Outdated Antivirus Antivirus Security 7.4 Critical Systems Inadequate up to date process Unadequate Patching process Inadequate Backup procedure Inadequate Backup procedure Antivirus Security 7.4 Critical Systems Security Security 7.5 Critical Systems Obsolete MS Windows 2000 operating system in Water Treatment Plant server MS Windows based operating systems in critical systems have an outdated version of McAfee antivirus. Signatures updates are deployed manually twice a year into critical systems Patches are applied to systems connected to the business network automatically managed by ITS, meanwhile all critical systems in manufacturing network security patches are applied twice a year. MX North L1 Yes Process H MX North L1 No Process H MX North L1 No Process H MX North L1 No Process H DRP Security 7.6 Backups are not tested, reviewed or audited. MX North L1 No Process H DRP Security 7.6 Critical Systems All backups are performed manually in PLC and HMI and Ghost images for operating systems. Athens US No Process H - Implement USB restriction mechanism in critical systems devices. - Upgrade obsolete MS Windows XP operating systems. - Replace Water Treatment Plant server immediately. - Identify all network protocols and analyse their risks. - Create and document a standard operations procedure to update manually critical equipment at least once a week. - Implement an automated solution to deploy antivirus signatures daily. - Create and document a standard operations procedure to update manually critical equipment at least once a week. - Implement an automated solution to deploy antivirus signatures daily. - Upgrade all obsolete operating systems in critical systems devices immediately. - Implement a patch deployment solution such as Marimba, WSUS, which is equivalent, etc. - Validate and document backup and restore procedures for all critical systems. - Review and audit all backups. - Implement a revision program to test backups in regular basis. - Integrate all recovery procedures in the current BCP/DRP. - Encrypt all backups. - Validate and document backup and restore procedures for all critical systems. - Review and audit all backups. - Implement a revision program to test backups in regular basis. - Integrate all recovery procedures in the current BCP/DRP. - Encrypt all backups. 6e

15 6e HPRMM - EVALUACIÓN - SYSTEM SCORECARD

16 HPRMM - EVALUACIÓN - CYBERSECURITY ANALYSIS GLOBAL CYBERSECURITY COMMONALITIES Process PB Area PB Sub-Area Assessment requirement Total affected sites Logical AC Password management Remote administration Perimetral Security Monitoring Security 7.7 Weak authentication procedures x x x x x x x x x x x 11 Security 7.8 Password sharing x x x x x x x x 8 Security 7.8 Weak password conformation x x x x x x x x x 9 Security 7.16 Lack of session monitoring in remote support x x x x x x x x 8 Security 7.16 Use of jump servers to avoid firewall x x x x x x x 7 Security 7.16 Vendor remote access to support systems x x x x x x x x x 9 NIST N/A Lack of IDS in perimetral security x x x x x x x x x x x x x x x x x x x 19 Security 7.11 Inadequate firewall rules x x x x x x x x x 9 Security 7.19 Lack of security logs (Audit) x x x x x x x x x x x x x x x x 16 Facilities 4.1 Inadequate CCTV procedures x x x x x x x 7 Security 7.3 USB ports unblocked x x x x x x x x x x x x x x x x 16 Hardening Security 7.4 Inadequate antivirus/malware protection x x x x x x x x x x x 11 Security 7.5 Inadequate patch management procedures x x x x x x x x x x x x x x 14 Security 7.6 Lack of scheduled backups x x x x x x x x 8 Backups Security 7.6 Lack offsite backups x x x x x x x 7 Security 7.6 Backups with no encryption x x x x x x x x x x x x x x x x x x x 19 Security 7.6 Backups are not tested, reviewed or audited x x x x x x x x x x x x 12 Recovery Assurance Mechanism System 5.2 Weak recovery procedures x x x x x x x x x x x x x 13 NIST N/A Lack of vulnerability assessment x x x x x x x x x x x x x x x x x x x 19 Inventory 3.7 Lack of design/implementation review by SME x x x x x x x x x x x x x x x x x x x 19 ISO Lack of risk analysis x x x x x x x x x x x x x x x x x x f

17 HPRMM - REMEDIACIÓN / MONITOREO- REMEDIATION PROJECT STATUS 6i

18 MEJORAS DE NEGOCIO CON HPRMM SITUACIÓN ACTUAL Desconexión del negocio Resultados vagos Operación en arranques Visión limitada de riesgosy dependencias MEJORAS DE NEGOCIO CON HPRMM Alineación estratégica Estandarización y flexibilidad Confiabilidad Consistencia en el logro de objetivos RESULTADOS Mejora de cultura organizacional Identificación de riesgos y controles Entendimiento (riesgo negocio) Sustentabilidad 7

19 PARA REFLEXIONAR Alineación estratégica Existe un modelo formal de ERM en mi organización? Se tomó en cuenta el contexto? Para las diferentes iniciativas de RM podemos decir claramente que objetivos apoyan/atienden? Evaluación de Riesgos Existe una guía que funja como baseline para la implementación y revisión? Los resultados generan valor y dan claridad a los tomadores de decisiones y a los responsables de activos/actividades? Sustentabilidad Hay un entendimiento claro de riesgo negocio? Se da seguimiento formal y ordenado al tratamiento de riesgos? Se repiten los hallazgos en las revisiones periódicas? 8

20 Gracias! Ing. Oscar Viniegra Lira 9

21