Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Blog da Tenable

Inscrever-se

Como criar uma estrutura de segurança da informação mais eficaz

Build a comprehensive defense against cyberattacks with a strong information security framework that leverages the world's best standards and infosec tools. 

A term like "information security framework" can be interpreted in many different ways, and as such, there are a number of overlapping standards throughout the infosec field. 

Some of these are required for legal compliance — which must be followed to the letter if they apply to you — while others are technically voluntary but highly regarded throughout the industry. It’s wise to learn about all of these mandatory and voluntary standards and decide how best to adopt them alongside the right set of vulnerability assessment and interdiction tools. 

ISO standards: Firm foundations

Given that the International Organization for Standardization (ISO) has guidelines covering all major industries, it's little surprise that they created several focused on infosec: ISO 270011 and 27701.2 Both were created alongside the International Electrotechnical Commission. 

ISO 27001: Developed around a risk-based approach to information security, in which you continuously identify hazards and select controls to properly address them. ISO 27001's "controls" for infosec are divided into categories including a written security policy, HR security, asset management, access control, cryptography, physical and environmental security, incident management, business continuity management and compliance with government regulations.3

ISO 27701: Focused more on the specific issue of data privacy. In fact, its 2019 update was a direct response to the European Union's implementation of the General Data Protection Regulation (GDPR) the previous year. It requires organizations to factor protection of personally identifiable information (PII) into all information security risk assessments, and demands that data processors or controllers make PII protections their highest priority.4

Whether you're a small business or an enterprise with facilities in multiple countries, you're responsible for safeguarding not only customer PII but also that of your workforce. The international standards shouldn't comprise the whole of your infosec practice — in fact, in some cases that would mean being noncompliant - but receiving ISO certification makes a solid foundation for any business's information security program. (Combining the practices of ISO 27001 with a tool like Tenable.sc makes for a particularly potent defense against infosec threats.) 

It's wise to learn about all of the mandatory and voluntary standards when building your information security framework

CIS benchmarks: The infosec professional's infosec guidelines

The Center for Internet Security (CIS), a nonprofit dedicated to promoting sound infosec practices, refers to its Controls and Benchmarks5 as "the global standard … for securing IT systems and data against the most pervasive attacks." 6

To call CIS Benchmarks "detailed" would be a major understatement: The manual for Windows 10 Enterprise's latest version, for example, is 1,312 pages and covers every single facet of that operating system. It'd be wise to take a look through CIS's library of Benchmarks, find the documents most closely related to your operations and spend some time poring over them as you work to develop the ideal information security framework for your organization's unique needs. 

Industry- and government-mandated standards

All of the following may be required by either industry governing bodies or the government itself, with penalties applying for noncompliance. If your organization falls under their purview, their rules have to be part of your information security program.

HIPAA: If you handle personal health information in the U.S. for any reason, whether as a health care provider or as tertiary material (like employee health data for benefits administration purposes), you must follow the Health Insurance Portability and Accountability Act's (HIPAA) Security Rule.7 This mandates the establishment of "administrative, physical and technical safeguards" for any electronically stored PII.

HIPAA doesn't list specific infosec practices to abide by or tools to use. (This is why leveraging multiple standards is necessary to create an information security framework.) One thing that isn't vague, however, is HIPAA's penalty system: Violations can mean penalties ranging from $100 to $1.5 million, depending on an organization's level of culpability.8

PCI DSS: Any business, government department or nonprofit that processes debit or credit card payments is subject to the Payment Card Industry Data Security Standards (PCI DSS) created by Visa, MasterCard and American Express.9 PCI DSS has more specific requirements for organizations, such as around firewall configurations and encryption. Like HIPAA, violations incur fines — for government and private-sector organizations alike10 — but instead of being one-time payments, they accrue monthly until the noncompliant party corrects its practices. 

NIST: If you want a lucrative federal contract for your business, you'd better be ready to adopt and maintain the National Institute of Standards and Technology's (NIST) unique Cybersecurity Framework.11 But NIST's basic phases of information security are also an undeniably solid foundation for any organization: identifying cybersecurity risks, preemptively implementing appropriate protections, searching for and detecting anomalous network activity, and enacting immediate response and containment efforts in breaches' wake and data recovery.12

DISA: Although the requirements outlined in the Defense Information Systems Agency's (DISA) Security Technical Implementation Guides13 are only mandatory for the Defense Department, they're updated more frequently than almost any other infosec protocol, making them an excellent resource for developing your own framework. 

GDPR: These requirements affect any organization that collects or processes personal data from residents of EU member states.14 Almost all modern organizations will need to implement GDPR standards to at least some extent.

Security framework development 

The first step to any security framework is to get full visibility into your assets. Regardless of which framework you decide to go with, you can’t secure what you can’t see. A vulnerability assessment or vulnerability management solution can help you get a full picture of what’s on your network. 

Once you are ready to create the ideal information security framework, you obviously must start with standards you're legally obligated to follow (HIPAA, GDPR, NIST) and those for which noncompliance is fiscally devastating (PCI DSS). But beyond them, you should consider the value other standards can bring. 

For example, maybe ISO 27001 covers your infosec needs pretty well, but you appreciate CIS's exhaustive guidance for safeguarding the assets you host on Amazon Web Services. Adopting the relevant CIS standards can't hurt your cloud operations and will almost certainly help. Other voluntary certifications may not apply directly to your business, but it's still worthwhile to understand them before deciding whether to follow their guidelines. It's also critical to use vulnerability scanning, penetration testing and threat modeling to project how damaging attacks would be handled under different configurations. 

You need the right tools to help along the way - and at Tenable, we've got them. Nessus Pro, the industry-leading vulnerability assessment solution, is the ideal complement to many information security frameworks, including custom approaches. Alternatively, we offer solutions to help observe specific protocols, such as Tenable.sc's support for ISO 27001 compliance and Tenable.io's PCI ASV variant

Learn more and choose the product that’s right for you.

Start Your Free Nessus Trial

1. ISO, "ISO/IEC 27001 Information Security Management"
2. ISO, "ISO/IEC 27701:2019 Security Techniques," August 2019
3. IT Governance Blog, "ISO 27001: The 14 Control Sets of Annex A Explained," July 2020
4. IT Governance USA, "ISO 27701: Privacy Information Management Systems"
5. Center for Internet Security, "CIS Benchmarks"
6. Center for Internet Security, "About Us," July 2020
7. American Medical Association, "HIPAA Security Rule & Risk Analysis," December 2019
8. Modern Healthcare, "HHS to Cap HIPAA Fines Based on 'Culpability'," April 2019
9. PCI Security Standards Council, "Maintaining Payment Security"
10. FivePoint Payments, "Do Governments Need to Maintain PCI Compliance?", February 2018
11. National Institute of Standards and Technology, "NIST Cybersecurity Framework"
12. IT Governance USA, "What is the NIST Cybersecurity Framework?"
13. DoD Cyber Exchange, "Security Technical Implementation Guides (STIGs)"
14. GDPR.eu, "Does the GDPR apply to companies outside of the EU?"

Artigos relacionados

Você está vulnerável às últimas explorações?

Insira seu e-mail para receber os alertas de cyber exposure mais recentes em sua caixa de entrada.

tenable.io

Tenha acesso completo a uma plataforma moderna de gerenciamento de vulnerabilidades baseada na nuvem, que permite que você veja e rastreie todos os seus ativos com uma precisão sem precedentes.

tenable.io COMPRAR

Tenha acesso completo a uma plataforma moderna de gerenciamento de vulnerabilidades baseada na nuvem, que permite que você veja e rastreie todos os seus ativos com uma precisão sem precedentes. Compre hoje a sua assinatura anual.

65 ativos

Escolha sua opção de assinatura:

Compre já

Teste gratuitamente o Nessus Professional

GRÁTIS POR 7 DIAS

O Nessus® é o verificador de vulnerabilidades mais abrangente do mercado atualmente. O Nessus Professional ajudará a automatizar o processo de verificação de vulnerabilidades, economizar tempo nos seus ciclos de conformidade e permitirá que você envolva a sua equipe de TI.

Comprar o Nessus Professional

O Nessus® é o verificador de vulnerabilidades mais abrangente do mercado atualmente. O Nessus Professional ajudará a automatizar o processo de verificação de vulnerabilidades, economizar tempo nos seus ciclos de conformidade e permitirá que você envolva a sua equipe de TI.

Compre uma licença para vários anos e economize. Inclua o Suporte avançado para ter acesso ao suporte por telefone, pela comunidade e por bate-papo 24 horas por dia, 365 dias por ano.

Selecione sua licença

Compre uma licença para vários anos e economize.

Adicionar suporte e treinamento

Tenable.io

Tenha acesso completo a uma plataforma moderna de gerenciamento de vulnerabilidades baseada na nuvem, que permite que você veja e rastreie todos os seus ativos com uma precisão sem precedentes.

Tenable.io COMPRAR

Tenha acesso completo a uma plataforma moderna de gerenciamento de vulnerabilidades baseada na nuvem, que permite que você veja e rastreie todos os seus ativos com uma precisão sem precedentes. Compre hoje a sua assinatura anual.

65 ativos

Escolha sua opção de assinatura:

Compre já

Teste o Tenable.io Web Application Scanning

Tenha acesso completo à nossa oferta mais recente de verificação de aplicações Web desenvolvida para aplicações modernas como parte da plataforma do Tenable.io. Verifique com segurança por vulnerabilidades em todo o seu portfólio online com um alto grau de precisão sem grandes esforços manuais ou interrupção de aplicações Web críticas. Inscreva-se agora mesmo.

Comprar o Tenable.io Web Application Scanning

Tenha acesso completo a uma plataforma moderna de gerenciamento de vulnerabilidades baseada na nuvem, que permite que você veja e rastreie todos os seus ativos com uma precisão sem precedentes. Compre hoje a sua assinatura anual.

5 FQDNs

US$ 3.578,00

Compre já

Teste o Tenable.io Container Security

Tenha acesso completo à única oferta de segurança de contêiner integrada a uma plataforma de gerenciamento de vulnerabilidades. Monitore imagens de contêiner por vulnerabilidades, malware e violações de segurança. Unifique sistemas de integração contínua e implantação contínua (CI/CD) para dar suporte às práticas de DevOps, reforçar a segurança e ajudar na conformidade com as políticas da empresa.

Comprar o Tenable.io Container Security

O Tenable.io Container Security habilita com perfeição e segurança os processos de DevOps ao fornecer visibilidade da segurança das imagens de contêiner, incluindo vulnerabilidades, malware e violações de segurança através da integração com o processo de compilação.

Avalie o Tenable Lumin

Visualize e explore sua Cyber Exposure, monitore a redução do risco ao longo do tempo e faça uma análise comparativa com outras empresas do mesmo setor com o Tenable Lumin.

Compre o Tenable Lumin

Entre em contato com um representante de vendas para ver como o Lumin pode ajudar você a obter informações sobre toda a organização e gerenciar o risco cibernético.

Experimente o Tenable.cs

Aproveite o acesso completo para detectar e corrigir erros de configuração da infraestrutura da nuvem e ver vulnerabilidades no tempo de execução. Inscreva-se para uma avaliação gratuita agora mesmo.

Entre em contato com um representante de vendas para comprar o Tenable.cs

Entre em contato com um representante de vendas para saber mais sobre o Tenable.cs Cloud Security e veja como é fácil integrar suas contas na nuvem e obter visibilidade das configurações incorretas e vulnerabilidades da nuvem em questão de minutos.

Teste o Nessus Expert gratuitamente

GRÁTIS POR 7 DIAS

Desenvolvido para a superfície de ataque moderna, o Nessus Expert permite ver mais e proteger sua organização de vulnerabilidades, da TI à nuvem.

Já tem uma licença do Nessus Professional?
Atualize para o Nessus Expert gratuitamente por 7 dias.

Comprar o Nessus Expert

Desenvolvido para a superfície de ataque moderna, o Nessus Expert permite ver mais e proteger sua organização de vulnerabilidades, da TI à nuvem.

Selecione sua licença

Compre uma licença para vários anos e economize.

Adicionar suporte