Welcome to Defensix GOVERN RISK COMPLAINCE VENDOR MANAGEMENT PASSWORD AUDIT

Transcription

1 GOVERN RISK COMPLAINCE Defensix simplifies, condenses, and organizes all of your GRC requirements in one centralized set of controls. Welcome to Defensix Our mission is to provide organizations with an effective tool to aid in implementing and maintaining a highly robust security program. We have combined our experience from cyber ops in the private sector and government agencies in the development of Defensix to provide organizations with an exclusive approach to information security. VENDOR MANAGEMENT Defensix streamlines vendor due diligence, calculates vendor risk, and manages vendor contracts. PASSWORD AUDIT Defensix simplifies the execution and management of vulnerability scans and the path to remediation. Developed by Silent Break Security

2 Governance Risk Compliance Your security control panel. Framework The Defensix control framework provides a best-practice baseline to benchmark your organization's current information security program. Each control, along with relevant special requirements pertaining to your compliance needs, can be used to manage your implementation status. Unified Framework Comprehensive and customizable frameworks combined into one simple platform Roadmap Assign and map control tasks to track progress of security program Procedures Follow control guidance by creating procedures around defined control tasks Implemented Not Implemented

3 Your Defensix QA Framework Wizard Framework Wizard Asset and Configuration Management AM.01 Roadmap Procedures Information classification and handling requirements Defensix Control Are information classifica AM.01 o account legal Roadmap Procedures Control Owner: E Hulse requirements, values, cri r modification High Priority The Defensix GRC module maps 14 common compliance and certification frameworks to a unified control framework consisting of 125 controls across 11 domains. This allows organizations to efficiently assess audit status across multiple frameworks, and identify potential gaps in control coverage, enabling the security team to focus on other important aspects of the security program. Special Requirements Control Guidance References Implementation Status Implemented Related Technology Information classification and handling requirements Defensix Control Are information classification and handling requirements defined, taking into account legal requirements, values, criticality and sensitivity to unauthorized disclosure or modification Special Requirements Control Guidance References Control Owner: E Hulse High Priority Special Requirements Some compliance frameworks will add additional sub controls to the best practices framework, often providing more granularity to a control, and should be included to provide a more holistic view of your organization s security posture. Evidence Implementation Status Implemented Comments Related Technology Implementation Details Control Guidance Supplemental information related to the control question (this supplemental information can often assist in answering the why around why a control exists). References Each Defensix control refers to sections from various compliance frameworks. Evidence Priority All Defensix controls are required for a complete security program. Control priority is meant to help your organization know which controls to focus on implementing first.

4 Roadmap In Defensix you can manage the tasks relevant to the security control, assign ownership of the tasks, and track the projected implementation date. See what your gaps are, and know what to do about them. Tracking Status All Active Open In Progress Complete On Hold Canceled Procedures Within each control, you can create one or more procedures. Each procedure has an owner, description, and completion frequency. At the specified interval, Defensix s the owner the procedure instructions, who then carries out the procedure and marks the task as complete. An audit log is also maintained showing the procedure completion at each recurring interval. AM.01 Roadmap Procedures AM.01 Roadmap Procedures Implement 2FA on Office 365 Implement 2FA on VPN Complete Open 8/30/2018 9/15/2018 Information classification and handling procedure (Disabled) New Task We need to do: Next scheduled date: 9/22/2018 Interval:2 Days AM.01 - Information classification and handling requirements: Are information classification and handling requirements defined, taken into account legal requirements, value, criticality and sensitivity to unauthorized disclosure or modification Procedure Name:* Task Name: Task Name Procedure Name Assignee: (No User) Procedure Description: Task Status: Open Start Date: MM/DD/YYYY Due Date: MM/DD/YYYY Description: Schedule Start Date:* MM/DD/YYYY Save Changes Cancel Procedure Repeats Every:* 0 Days Disable Save Changes Cancel

5 Deficient: 29 Dashboard Get a quick view of your organization s progress status on the Defensix dashboard. Admin@silentbreaksecurity.com QA Visual charts show general control compliance status, deficient controls breakdown, and compliant controls breakdown. Dashboard Compliant Control Breakdown Deficient Control Breakdown Not Applicable: 24 Not Implemented: 11 Risk Accepted: 27 Implemented: 57 Partially Implemented: 18 My Upcoming Tasks Deficient Controls Needing Work Task 1 for compliance open 8/24/18 IA.01 - Accept use of information and assets Partially implemented Have IT remove employee account in progress 9/13/18 IA.18 - Unseccessful login management Not implemented Need to meet with IT open 9/15/18 PS Information security awareness education Partially implemented Compliant: 108

6 Overview Questionnaires Brick and Mortar Vendor Management Creation Date: Renewal Interval: Handles Customer Data: Handles Employee Data: Has Network Access: 9/14/ year No Combined Vendor Rating: C Onboarding new vendors and ongoing vendor management is an overly time-consuming task. Defensix streamlines vendor due diligence, calculates vendor risk, and manages vendor contracts, saving time to focus on other aspects of security that matter. Vendor Overview Questionnaires Vendor Questionnaires Completed / Assigned 3 / 3 Admin@silentbreaksecurity.com Weighted Points Possible: Correct: Incorrect: Total Score QA Score Approvals 1 / 1 Approved Creation Date: Renewal Interval: Handles Customer Data: Handles Employee Data: Has Network Access: 9/14/ year No Combined Vendor Rating: Incomplete (Vendor has outstanding questionaires) Contacts Points of contact for the vendor. Questionnaires assigned to this vendor will be sent to contacts selected from this list. Approvers Users chosen from your organization who are responsible for vetting the vendor. Contacts John Smith Approvers Joe Campbell Attachments Questionnaires Completed / Assigned 2 / 0 John Smith@gmail.com Approvals 1 / 1 Decline Approved Attachments Allowed file types: pdf, doc, docx, xls, xlsx, ppt, pptx, png, jpg, jpeg, gif, txt, html, csv, zip No attachments Create. Customize your own vendor questionnaires, or use common best-practice templates provided by Defensix. Assess. Quickly determine vendor risk through automated due-diligence, risk scoring and reporting, and a helpful dashboard. Approve. Maintain a standardized process for ongoing vendor risk assessments and approvals, never losing track of anyone.

7 UNIFIED COMPLIANCE VENDOR MANAGMENT PASSWORD AUDIT COMING SOON PASSWORD AUDIT Ask us about our free 7-day trial (801) Developed by Silent Break Security