Third Party Security Are your vendors compromising the

Third Party Security: Are your vendors compromising the security of your Agency? Wendy Nather, Texas Education Agency Michael Wyatt, Deloitte & Touche LLP TASSCC Annual Conference 3 August 2010

Agenda n n n n 3 rd Parties: Here to stay Size and Nature of the Problem Risks and Risk Mitigation Clouds in our Eyes Policies and Assessments Recommended resources Q/A

3 rd Parties: Here to Stay n n Public/Private Partnership Specialized Skill Sets Cost Considerations Net: Can’t unscramble the egg and probably wouldn’t if we could

SIZE OF THE PROBLEM

Dimensions of the Problem n On-Site Contractors n n External service providers n n n access to sensitive information Application Development IT OPS - admin rights to apps and systems Business services (HR, payments, printing, etc. ) Projects (web site development/hosting) Software / application vendors Outsourced support services ASP/ Saa. S / Cloud n n n Hosting Agency applications Housing sensitive data (PII, PHI) Handy Internet services (Survey Monkey, i. Tunes U, etc. )

What’s the Risk? n Verizon Business Data Breach Incident Report n n n 11% of breach events involved third-party partner as primary vector* 27% of breach events involve multiple sources (e. g. external + partner) 26% of compromised asset were managed externally; an additional 9 percent were co-managed *Note: based on data collected by VZB and Secret Service only and are for intentional breaches only, not contributory errors

e. g. Veterans Administration n n May 2010 3 rd party contractor’s unencrypted laptop stolen with Sensitive Information 3 rd party “certified” all laptops used encrypted hard drives VA policy requires encryption Over 500 3 rd parties refusing to sign encryption clause

RISKS AND RISK MITIGATION

Shared State of Texas Risk n n n How many different accounts does your vendor service? What are you willing to bet they’re using the same admin password for all of them? What are you willing to bet that the password is “password”?

Dude, Where’s Our Firewall? n n n How many trusted entry paths do you have to your network? How many connections do you have to third-party partners apart from outsourcing? Do you still really think you have a perimeter?

What’s Most Important? n n n Maintaining control over security Maintaining accountability Ensuring legal compliance

What’s Not? n n n Data Mapping Asset Classification Security Control Frameworks used by 3 rd parties Technical Controls in the absence of good business processes SAS-70 s *

Methods of Control n n n Technical control Business Processes / Procedural control Contractual control

The Password Problem n System administrators have ultimate technical control

Compensations n Balance: n n n Privileged Account Management Multifactor Authentication Balance: n n Separate, immediate log collection Regular audits Paper throttle n n n Workflow system Signoff requirements Balance: n n Process / Procedural Oversight n n Technical Contractual Acceptance or rejection of personnel Compliance with written policies

The Knowledge Problem n n If they have all the technical expertise, how do you know what they’re doing? Balance: Procedural n n n Separate technical expertise Regular reviews Balance: Contractual n Solutions and practices must comply with legal requirements

The Money Problem n n Vendor can influence decision-making by judicious use of price tags Balance: Contractual n n Preserve right to do it yourself On-demand cost reviews and bids

Security Separation of Duties n n Contractor provides high-level security design documents, generic procedures, baseline security settings Agency determines which technical measures are needed to comply with laws (HIPAA, FERPA, IRS, CJIS, etc. ) Consider having 3 rd party assess security of the source code and architecture This may cost extra

Application Security n Software Development Life Cycle (SDLC) n n Do they even have one? Include them in yours n n Threat modeling Test cases including security QA phase includes security scanning/pen testing Don’t forget the platform

Warranties n n n No, really Any security issues relating to flaws in the implementation or design of the software shall be remediated at the expense of the vendor, regardless of when they are discovered, for the life of the contract. If anyone screams at this, kindly remind them that Microsoft et al. do this already; it’s called “maintenance. ”

What about enhancements? n Any requests for new security functionality (such as different access control measures, new encryption, more detailed logging, etc. ) shall be considered the same as other new operational functionality and shall be handled according to the software enhancement agreements in this document.

System Integrators n n Purchased product not under System Integrator’s control Engagement Acceptance and Signoff Use of Off-shore vs. local resources Product Vendor Professional Services vs. Independent Professional Services

Verification n n Make the developer do their own security testing OWASP Application Security Verification Standard (ASVS) Project

Levels of Due Diligence n n n What is our obligation to assess and monitor security? What is “reasonable” to ask of 3 rd Party providers? What responsibility does the State have in this area?

Additional Recommendations n n n n Eliminate unnecessary data; keep tabs on what’s left Make sure essential controls are met Check the above again Test and review web applications Audit user accounts and monitor privileged activity Filter outbound traffic Monitor and mine event logs

CLOUD COMPUTING AND SAAS

Clouds get in our eyes n Software as a Service (Saa. S) n n n Quick to set up No review by procurement or legal License = EULA No capital procurement required Monthly subscription n n (Watch out for Pro. Card charges!) No internal management costs

Forecast – Cloudy with a 100% of chance of risk n n n Security by Obscurity: e. g. Amazon S 3 Controls: Lack there of for Security Loss: n n Not Lost: n n Agency data retention AFTER contract conclusion / termination Cloudy Staff: n n Of Physical control of agency information, Of Governance of the information Of Information itself Background checks for employees? Third party contractors? Water Leaks: n Multi-tenancy increase chance of intentional and unintentional data access by one tenant of another tenant’s information

Onward through the cloud n n n One size does not fit all Cloud providers allow different levels of visibility / auditability Cloud Audit project: aka Automated Audit, Assertion, Assessment, and Assurance API (A 6)

POLICIES, PROCEDURES AND ASSESSMENTS

Third Party Security Policies n n n You have internal Policies but what about third parties? Explicit third Party Policies and Procedures Contract language

What to put in the contract n General: Applicable All third Parties n n n n Data and Application: Hosting/Housing Agency data n n n n Security and Privacy Policies and Procedures & Legal Requirements Incident response Control and auditing of administrative privileges, user access Control and use of security software Right to Audit Laptops and removable media Account Management and Access Controls Inventory, Data classification levels, and record retention schedules Vulnerability scanning and remediation Security configuration standards Backup security Business continuity / disaster recovery Change Management Network Connectivity: 3 rd parties w/ direct access to Agency Network n n Business continuity / disaster recovery Encryption Telephone, email Pull vs. Push

Assessments n n To Self-Assess or Not to Self-Assess References and Referrals Model: Financial Services Industry Components to look at: n n n IT and Risk Security Policies Asset management Security Awareness Physical and Environmental Access control n n n Communications and Operations Business Continuity Management of Privacy Incident management Compliance

The bottom Line: Are all vendors bad? n n Well, not all of them Trusted partners with security expertise

Questions ? n Wendy Nather Texas Education Agency Wendy. Nather@tea. state. tx. us n Michael Wyatt Deloitte & Touche LLP miwyatt@deloitte. com

RESOURCES

Resources n n n The Shared Assessments Program – sponsored by BITS http: //www. sharedassessments. org “ General Electric Third Party Information Security Policy” http: //www. geae. com/aboutgeae/doingbusinesswith/docs/GE_thirdparty_po licy. doc The Cloud Security Alliance: http: //www. cloudsecurityalliance. org/ The Open Group's Jericho Forum: https: //www. opengroup. org/jericho/index. htm OWASP Application Security Verification Standard (ASVS) Project http: //www. owasp. org/index. php/Category: OWASP_Application_Security_V erification_Standard_Project Cloud Audit Project - http: //www. cloudaudit. org

This presentation contains general information only and Deloitte is not, by means of this presentation, rendering accounting, business, financial, investment, legal, tax, or other professional advice or services. This presentation is not a substitute for such professional advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified professional advisor. Deloitte, its affiliates, and related entities shall not be responsible for any loss sustained by any person who relies on this presentation. About Deloitte refers to one or more of Deloitte Touche Tohmatsu, a Swiss Verein, and its network of member firms, each of which is a legally separate and independent entity. Please see www. deloitte. com/about for a detailed description of the legal structure of Deloitte Touche Tohmatsu and its member firms. Please see www. deloitte. com/us/about for a detailed description of the legal structure of Deloitte LLP and its subsidiaries. Copyright © 2010 Deloitte Development LLC. All rights reserved.