ISOAG Meeting August 2, 2017 - Virginia
ISOAG MeetingAugust 2, 2017Welcome to CESCwww.vita.virginia.gov1
Welcome and Opening RemarksMichael WatsonAugust 2, 2017www.vita.virginia.gov2 2
ISOAG August 2, 2017 AgendaI.Welcome & Opening RemarksMike Watson, VITAII. Investigations, Law Enforcementand the CloudSteven Hernandez, HHS,OIGIII. Enterprise Cloud Oversight ServicesDemetrias Rodgers, VITAIV. Building a Pentest Program on aShoestring BudgetGrayson Walters, TAX & Andy Hallberg, ABCV. Upcoming EventsMike Watson, VITAVI. Partnership UpdateNorthrop Grumman3
Information Assurance Overview: Cloud,Trusted Internet Connections andContinuous MonitoringSteven HernandezChief Information Security OfficerHHS/OIGAugust 2nd 2017LIMITED OFFICIAL USE ONLYDHHS/OIG
Agenda IntroductionCloud assurance overviewCloud AssessmentContinuous Monitoring Challenges in the Cloud Trusted Internet Challenges in the CloudLegal concerns with cloud providersLitigation Hold and eDiscoveryMoving forward with best recommendations Questions8/2/2017LIMITED OFFICIAL USE ONLYDHHS/OIG5
Introduction Who I am: Steven Hernandez MBA, CISSP, CISA, CSSLP, CAP,SSCP, CNSS(4011-4016), HCISPP, ITIL– Director of the HHS/OIG InformationAssurance Division– Chief Information Security Officer8/2/2017LIMITED OFFICIAL USE ONLYDHHS/OIG6
What is Cloud? Possibilities:– Software as a Service (SaaS) Vendor is responsible for the vast majority ofsecurity control implementation and operation.– Platform as a Service (PaaS) Vendor is responsible for typically the operatingsystem and hardware security controls.– Infrastructure as a Service (IaaS) Customer is responsible for the Majority of Controls.8/2/2017LIMITED OFFICIAL USE ONLYDHHS/OIG7
Security Control Responsibility8/2/2017LIMITED OFFICIAL USE ONLYDHHS/OIG8
Security Controls: Low and Moderate8/2/2017LIMITED OFFICIAL USE ONLYDHHS/OIG9
Cloud Control Req. FedRAMP High Impact Control Baseline– Finalized June 22nd 2016– Implements the NIST SP 800-53 Rev 4 “High”baseline controls– Would allow CSP’s to handle most all data withthe exception of classified data and data subjectto specific legal requirements– Approx. 421 Control Test Points8/2/2017LIMITED OFFICIAL USE ONLYDHHS/OIG10
Cloud Control Req. FedRAMP High Impact Control Baseline– Why? Only 20% of federal systems need this?– Because 50% of federal spending is on Highimpact systems!– Three Vendors are Piloting CSRA/Autonomic Resources – ARC-P PaaS Microsoft – Azure Government Amazon Web Service – AWS GovCloud8/2/2017LIMITED OFFICIAL USE ONLYDHHS/OIG11
Federal Agency /uploads/2012/09/fedrampmemo.pdf8/2/2017LIMITED OFFICIAL USE ONLYDHHS/OIG12
Federal ploads/2012/09/fedrampmemo.pdfFedRAMP launched June 6th 2012: Agencies must be compliant since June 6th, 20148/2/2017LIMITED OFFICIAL USE ONLYDHHS/OIG13
Document Examples Templates (Fedramp)– https://www.fedramp.gov/ Package Request Form Security Assessment Framework Guide to UnderstandingFedRAMP FedRAMP Revision 4 TransitionGuide Quick Guide to FedRAMPReadiness Process FedRAMP Policy Memo Security Controls Control Quick Guide8/2/2017 Standard Contract ClausesControl Specific Contract ClausesCloud Procurement Best PracticesTemplate FedRAMP ATO LetterJAB CharterContinuous Monitoring StrategyGuide Significant Change Form Incident CommunicationsProcedure Branding GuidanceLIMITED OFFICIAL USE ONLYDHHS/OIG14
Assessment Process The FedRAMP Agency ATOauthorization process should followthe FedRAMP Security AssessmentFramework (SAF) The FedRAMP SAF is based on the NISTRisk Management Framework (RMF) The FedRAMP SAF is available onFedRAMP.gov by navigating to theResources - Program Documentswebpage15
Document Check List – FedRAMP Templates FedRAMP templates are available atFedRAMP.gov on the Resources - Templates webpageAgency ATO packages submitted toFedRAMP must include 14FedRAMP templatesThe PMO will check these templatesfor completeness, critical securitycontrol showstoppers, and qualityIt’s recommended that you use theRev 4 Security Assessment TestCases that the FedRAMP PMOreleased in Excel format for 1/FedRAMP-SecurityAssessment-Test-Cases-Rev-4v1 .xlsx FedRAMP Templates Available:System Security Plan (SSP) – FIPS Pub 199– E-Authentication– Control ImplementationSummary (CIS) – CIS Worksheet– IT Contingency Plan (CP)and CP Test – Privacy Threshold Analysis(PTA) / Privacy Impact Assessment (PIA)– Rules of Behavior (ROB)Security Assessment Plan(SAP)– Security AssessmentTest CasesSecurity AssessmentReport (SAR)– Security Test CasesPlan of Action andMilestone (POA&M)Agency ATO Letter16
Submission of Cloud to GSA1.CSP contracts with an accredited 3PAO and submits a 3PAO Designation Form to the FedRAMP PMO.2.FedRAMP ISSO holds a meeting with CSP and 3PAO to discuss expectations and set timeframes fordeliverables.3.3PAO creates and the FedRAMP ISSO approves a testing plan that ensures the assessment will cover thestate authorization boundary and controls.4.3PAO performs and independently tests the CSP's system and generates a Security Assessment Report(SAR) that documents findings and provides and analysis of the test results to determine the risk exposure.5.CSP develops a Plan of Action & Milestones (POA&M) that addresses the specific tasks, resources, andschedule for correcting each of the weaknesses and residual risks identified.6.CSP submits the SAR and POA&M to the FedRAMP ISSO for a completeness and overall risk posturereview.7.The Joint Authorization Board (JAB) makes a risk-based decision on whether to accept the vulnerabilitiesand planned fixes.8.If JAB determines the risk level is too high it recommends remediation steps that the FedRAMP ISSOshares with the CSP.9.CSP corrects control implementations, retests affected controls, and resubmits revised documentation10. If JAB accepts the risks associated with the system, the FedRAMP ISSO notifies the CSP that they are readyto finalize the security assessment.8/2/2017LIMITED OFFICIAL USE ONLYDHHS/OIG17
Is FedRAMP working? Yes! Cloud providers are beginning to understand this is theminimum necessary to compete in the federal space. 82%of all cloud procurements are including FedRAMPrequirements. 73 CSPs have been deemed compliant ( 28) 4 CSPs in process for JAB PATO (-6) 40 CSPs in process for Agency ATO ( 12) 3 CSPs are FedRAMP “ready” Marketplace.fedramp.gov8/2/2017LIMITED OFFICIAL USE ONLYDHHS/OIG18
Continuous Monitoring Continuous Monitoring has always been part of the NISTRisk Management Framework (RMF!) Continuous monitoring has always been part of thecertification and accreditation/authorization process. Why does Certification/Assessment and anding the risk you take when using a systemUnderstanding the limitations and strengths of a systemHaving a level of assurance and due diligence for a systemContinuously monitor a system for vulnerabilities and resulting riskIt’s the Law! FISMA requires we do this and for good reason!LIMITED OFFICIAL USE ONLYDHHS/OIG19
Overall Risk ViewRolling up comprehensive risk information for sound decision making!SARSARRiskContinuous MonitoringAutomated Process AreasDHS/CDM8/2/2017RiskRiskDecisionLIMITED OFFICAL USE ONLYDHHS/OIG/OCIO/IAManual AssessmentProcess Areas800-53A and Test Cases20
Cloud Continuous Monitoring When the vendor controls everything how can weensure risk visibility? Remember:– FedRAMP is going to ensure the CM capability exists forthe cloud provider in three areas: Operational Visibility Change Management Incidence Response8/2/2017LIMITED OFFICAL USE ONLYDHHS/OIG/OCIO/IA21
Cloud Continuous Monitoring8/2/2017LIMITED OFFICAL USE ONLYDHHS/OIG/OCIO/IA22
Cloud Continuous Monitoring Operational Visibility: Operational visibility provides a look-in into the security controlimplementations of the CSP– What contract language or clauses does the organization have for ongoingand as needed (ad hoc) security assessments?– How much visibility through automated or manual assessments does theorganization have into the cloud provider. Change Control and Management: How does the cloud provider control changes andconfigurations? What assurance does the organization andagency have that breaches or downtime will not occur due tounintended changes or poorly tested changes?8/2/2017LIMITED OFFICAL USE ONLYDHHS/OIG/OCIO/IA23
Cloud Continuous Monitoring Incident Response and LawEnforcement– What automated scanning, patching and reporting is available to theagency?– Is the cloud provider using SCAP compliant tools and providing DHScompliant feeds back to the agency?– What contractual provisions are in place for internal investigations,employee monitoring and formal investigations?8/2/2017LIMITED OFFICAL USE ONLYDHHS/OIG/OCIO/IA24
Cloud Continuous Monitoring Recommendations:– Ensure contractual provisions exist which ensure the cloud provider mustprovide SCAP compliant configuration, asset, vulnerability and patch statusfor DHS CDM dashboards and feeds.– Ensure contracts are vetted by law enforcement partners and Legal to ensureall legal actions are routed to the appropriate agency resources and when theagency needs information from the cloud provider there are no surprises.– Ensure you have the ability to send in an independent assessment team toperform ad hoc or after action assessments.– Ensure a full FedRAMP provisional ATO (or FedRAMP Ready) is requiredfor new contracts and re-competing existing contracts which do not containthe FedRAMP requirements.8/2/2017LIMITED OFFICAL USE ONLYDHHS/OIG/OCIO/IA25
Audit and Inspection Clauses A critical item for Agencies and IGs– FedRAMP does NOT cover access for investigations andaudits and reviews Legal Route:– Time consuming, expensive, confrontational Contractual Route is much better!– Include specific terms related to access to facilities, data and metadata– “Yellow-Book” auditing standards» In addition to FedRAMP Controls» Agencies should demand Yellow-Book standards starting with the High Baselineand working back to Moderate» Several CIGIE working groups are working through this but we need to be unifiedin our approach!8/2/2017LIMITED OFFICAL USE ONLYDHHS/OIG/OCIO/IA26
Audit and Inspection Clauses Dept of Ed OIG Class Deviation to Implement Policy Regarding Access toContractor Information Systems The purpose of this alert is to issue a class deviation that allowsContracting Officers to require contractors and subcontractors atall tiers to afford the Department, other Federal agencies, theComptroller General of the United States, and their authorizedthird-party representatives, full and timely access to contractorinformation systems and related resources to perform privacy andinformation security inspections.8/2/2017LIMITED OFFICAL USE ONLYDHHS/OIG/OCIO/IA27
Trusted Internet Connections8/2/2017LIMITED OFFICIAL USE ONLYDHHS/OIG28
Trusted Internet ConnectionsRequired through:8/2/2017LIMITED OFFICIAL USE ONLYDHHS/OIG29
Trusted Internet Connections:8/2/2017LIMITED OFFICIAL USE ONLYDHHS/OIG30
What about Cloud andTrusted Internet Connections?8/2/2017LIMITED OFFICIAL USE ONLYDHHS/OIG31
Trusted Internet Connections8/2/2017LIMITED OFFICIAL USE ONLYDHHS/OIG32
What have welearned from vendors?8/2/2017LIMITED OFFICIAL USE ONLYDHHS/OIG33
Future Resolution(CSP TIC Overlay?)8/2/2017LIMITED OFFICIAL USE ONLYDHHS/OIG34
Future Resolution(CSP TIC Overlay?)8/2/2017LIMITED OFFICIAL USE ONLYDHHS/OIG35
Future Resolution(CSP TIC Overlay?) Not all TIC capabilities are represented in the FedRAMP-TIC overlay as not all TICcapabilities are applicable to CSPs. The TIC capabilities and the FedRAMP security control requirements are not aone-to-one mapping; some are one-to-many, many-to-one, or many-to-many. The TIC Reference Architecture v2.0 defines TIC capabilities as eitherRecommended or Critical. For purposes of this overlay, ALL applicable TICcapabilities are considered Critical (and therefore mandatory) for external cloudservice providers. Achieve a FedRAMP security authorization by an authorizing official (agency orJAB) based on the 3PAO Security Assessment Report; and Be deemed “TIC Ready” by DHS based on DHS’s review of a 3PAO TICCapabilities Assessment Report AWS Amazon completed a pilot in Feb of 2016. Results indicate a substantialamount of collaboration is necessary between agencies, providers and DHS to besuccessful. uidance for Trusted Internet Connection TIC Readiness on AWS.pdf)8/2/2017LIMITED OFFICIAL USE ONLYDHHS/OIG36
Future Resolution(CSP TIC Overlay?) Outlook: Uncertain if CSP can meet equivalent requirements of MTIPS Questions as to the level of integration with US-CERT and Agencymonitoring capabilities Costs are still uncertain as the CSP may have to significantly re-engineer theirnetworking to accommodate this model. If successful could mean more providers of MTIPS services Drive down costs Increase competition Increase performance8/2/2017LIMITED OFFICIAL USE ONLYDHHS/OIG37
Future Resolution(Direct Connect, ExpressRoute etc.)8/2/2017LIMITED OFFICIAL USE ONLYDHHS/OIG38
Future Resolution(Direct Connect, ExpressRoute etc.)8/2/2017LIMITED OFFICIAL USE ONLYDHHS/OIG39
Legal Hold, Records Retention,FOIA, eDiscovery and all this fun!Sounds complex and our lawyer friends make a solidliving around these terms:Basically two functions:1. Can you preserve information based on a criteriaand a timeline?2. Can you search your collections in a forensicallysound manner?8/2/2017LIMITED OFFICIAL USE ONLYDHHS/OIG40
Litigation Hold Example (O365)8/2/2017LIMITED OFFICIAL USE ONLYDHHS/OIG41
Example (O365)Hey Bob, Didn’t we tell thelawyers we can only store 6months worth of email?You’re living wayin the past!With our newcloud providerour legal hold isindefinat .Uhh ohh .8/2/2017LIMITED OFFICIAL USE ONLYDHHS/OIG42
E-Discovery Example (O365)8/2/2017LIMITED OFFICIAL USE ONLYDHHS/OIG43
E-DiscoveryRemember: Separation of duties E-Discovery is a powerful tool Admins snooping Mangers going on fishing trips Contract up-front for capability Storage Tools Capabilities SaaS most likely8/2/2017LIMITED OFFICIAL USE ONLYDHHS/OIG44
Forensic ExamplesThe Good: Logging: AWS Cloudtrail8/2/2017LIMITED OFFICIAL USE ONLYDHHS/OIG45
Forensic ExamplesThe Good: Least Privilege: Microsoft Lockbox8/2/2017LIMITED OFFICIAL USE ONLYDHHS/OIG46
Critical concerns contractingofficers:Pity the CO (at least at DoD for now ):Appropriate requirements to support applicable inspection, audit, investigation, orother similar authorized activities specific to the relevant types of Government dataand Government-related data, or specific to the type of cloud computing servicesbeing acquired;Appropriate requirements to support and cooperate with applicable system-widesearch and access capabilities for inspections, audits, investigations, litigation,eDiscovery, records management associated with the agency's retention schedules,and similar authorized activities; and WE CAN HELP!8/2/2017LIMITED OFFICIAL USE ONLYDHHS/OIG47
Questions8/2/2017LIMITED OFFICIAL USE ONLYDHHS/OIG48
Thanks!!Contact Me:Steven ED OFFICIAL USE ONLYDHHS/OIG49
Enterprise Cloud Oversight:The What and WhenDemetrias RodgersEnterprise Services DirectorISOAGAUG 02, 2017www.vita.virginia.govwww.vita.virginia.gPage 5050
ECOS – The What Enterprise cloud oversight service– Standardized service-based approach to security assessment,authorization and ongoing monitoring for cloud based servicesconsumption Framework widely used across various levelsof government as published in NIST 800-37– FedRamp simplified NIST RiskManagement Framework by creatingfour process that encompass the sixsteps within 800-37 age 51
ECOS – Security Assessment Lack of transparency into cloud providers securityposture is and remains a primary inhibitor tocloud adoption. The Cloud Security Assessment- VITA’s assessment questionnaire consists of(currently)121 questions covering various controlgroups.- The format is largely based the Cloud Security Alliance’sConsensus Assessments Initiative Questionnaire- Assists the suppliers in understanding the securityrequirements of the commonwealth as well as allows foragencies to understand areas of concern.www.vita.virginia.gPage 52
ECOS – The What (Process and Policy)www.vita.virginia.gPage 53
ECOS – For Which Cloud Services ECOS is a service specifically created for thirdparty suppliers offering SaaS applications What is SaaS?– Capability provided to the consumer is to use the provider’sapplications running on a cloud infrastructure– Applications are accessible from various client devices througheither a thin client interface, such as a web browser (e.g., webbased email), or a program interface.– Consumer does not manage or control the underlying cloudinfrastructure including network, servers, operating systems,storage or even individual application capabilities, with thepossible exception of limited user specific applicationconfiguration settingswww.vita.virginia.gPage 54
ECOS – For Which Cloud Services SaaS characteristics– Network-based access to and management of commerciallyavailable software– Supplier-provided services accessed through an internet connectionto a third-party hosted facility– Service delivery typically a one-to-many model (single instance,multi-tenant architecture); generally includes common architecturefor all tenants, usage based pricing and scalable management– Third party supplies management of the service, including functionssuch as patching, upgrades, platform management, etc.– Multi-tenant architecture, all users and applications share a single,common infrastructure and code base that is centrally maintained– Subscriber/user manages access controls for the application– Provider is data custodian and server administratorwww.vita.virginia.gPage 55
ECOS – The When ECOS applies– Services being procured meet the above definition and/orcharacteristics of a software as a service (SaaS) provider– ECOS does not cover PaaS requests as part of the currentservice. PaaS solutions are available through the eGovcontracts or through a hosting exception request.– When an agency is requesting the provider act on behalf of aCommonwealth entity and/or is accepting commonwealth data,serving as the data custodian and/or system administrator ofthat data for purposes of making it available back to theCommonwealth via an interface for fee.www.vita.virginia.gPage 56
QuestionsContact: Demetrias .virginia.gPage 57
Backup Slideswww.vita.virginia.gPage 58
Platform as a Service Definition What is PaaS?–Capability provided to the consumer is to deploy onto the cloudinfrastructure consumer-created or acquired applications createdusing programming languages, libraries, services, and toolssupported by the provider– The consumer does not manage or control the underlying cloudinfrastructure including network, servers, operating systems, orstorage, but has control over the deployed applications andpossibly configuration settings for the application-hostingenvironment.– Services to develop, test, deploy, host and maintain applications in thesame integrated development environment; varying services needed tofulfill the application development process– Web-based user interface creation tools help to create, modify, test andPage 59deploy different user interface scenarioswww.vita.virginia.g
PaaS Use Cases & Characteristics PaaS characteristics– Services to develop, test, deploy, host and maintain applications in thesame integrated development environment.– All the varying services needed to fulfil the application developmentprocess– Web based user interface creation tools help to create, modify, testand deploy different UI scenarios– Multi-tenant architecture where multiple concurrent users utilize thesame development application– Built in scalability of deployed software including load balancing andfailover– Integration with web services and databases via common standards– Support for development team collaboration – some PaaS solutionsinclude project planning and communication tools– Tools to handle billing and subscription managementwww.vita.virginia.gPage 60
Presented @Aug 2017 ISOAGGrayson Walters ISO @ TaxAndy Hallberg ISO @ ABC
You can just go hackyourself!
Level settingexpectationsA compilation of two talks What this talk isn’t What this talk is What you should take away How this will help in your day job
What are you trying toaccomplish?PENTEST VULNERABILITY SCANSpecific goal- Get a copy of thecustomerdatabase Exhaustive catalog ofpossible issues Ranked by criticalityFind a way to meet thatgoal within yourparameters Manually reviewed if youare luckyYou know what, just go read @DanielMiessler“The Difference Between a Vulnerability Assessmentand a Penetration Test”
Get your prioritiesstraight! Do you know what software is installed on your systems? Do you know what versions of software they are? Are those software installations patched?If you are answering no, you probably need to do aVulnerability Scan.Does that Mean I shouldn’t be talking abouta pentest?
ProbablyI mean seriously, youhave way too muchwork to be doing.
But let’s do it anyway, andhere’s why NOTHING SAYS YOU NEED TO LET ME UPGRADE THAT DEVICELIKE THE PHRASE:“We got to your SSNfrom the Internetbecause ”
So why this DIY pentest?Shouldn’t we just get a firmto come do this for us?
So external tests are bad?
Let the battle begin!Pushback It’s just too expensive tohire a firm to do apentest. It’s still going to costmoney, and time wedon’t have We’ve got all of theseprojects that we neverget to work on, and thisis just one more.Response I agree, we can do itourselves much cheaper. Not as much as you think,I saw a presentationwhere we can do it byrepurposing a couple ofold laptops and under aweek of effort. This is a small one, thatgets us the data we needto know which othersshould be priorities.
Gather your team!
Pirates Vs NinjasBoth havebenefits, todaywe are talkingpirates.Check out Kirk Hayes’“Penetration Test vs. Red TeamAssessment: The Age Old Debate ofPirates vs. Ninjas Continues’Image Attribution: Sarah Thomas
Yeah, yeah, I get it. Pentestsare good.GetOnWithIt!One quick thing There are several standards for pentests available online. The Penetration Testing Execution Standard, ISECOM’s Open Source Security Testing Methodology Manual, Even NIST has a version, but most of these are a little dated.Review them, have a look and decide if they are right for you. Do somehomework online.
Basic Assumptions You have permission to work on this “In your spare time” Minimal Hardware Purchase No Software Purchase You can download the stuff you need to do this on yournormal work computer
You have permission to work on this in your sparetime Is that in ion form
Scoping and GoalsWhat are we goingto test, and how dowe know if it wassuccessful?
Golden TicketsThese are your “Game Over” items.Some examples are: Key personnel login credentialswith successful login. Laying hands on the contents ofa key sensitive database. Root / Local Admin / DomainAdmin access Credit Card Data Stolen Laptop with dataextraction Health Records
Shopping list Hak5 – Hakshop 1 – BashBunny - 99 1 – Rubber Ducky - 45Other source 2 – Raspberry Pi with sd card /cases / power – 50 1 - High gain wifi USB adapter - 30All in, should be under 300
Building out your scheduleWeek 1 Approximately one week worth of time spent across themonth before the test Build scope, write plan, GET PERMISSION, setup toolsWeek 2 Pentest week – Stake out a conference room and hide for theweek Actively TestingWeek 3 You will forget what you learned if you don’t immediatelywrite it down Take a full day or two to properly document the test results
Getting afoothold Physical Ducky Dropboxes Assumed compromise Others
ResponderSilently collect creds
Crack Hashes Responder will gethashed credentials,need to crack them
Passwordspraying Works AMAZING, canbe done anywhereonce you have thefirst creds
Command andControl setup Dropbox with PentestPi over Kali Or C&C usingCobaltStrike/CoreImpact/Metasploit
Become Administrator Shared User/Admin Passwords Privilege Escalation Attacks PowerUp
Exploitation and LateralMovement At this point we root aroundshared drives as legit user Login to internal apps andservers Steal more Passwords withMimikatz This has worked for ZZaccounts as well
Surprises Physical is easy Password incrementing Password reuse Mimikatz patch installed butnot enabled
Rule 31After the test, choose 3findings that can be fixed. The most critical issue The easiest non-trivialissue to fix The most visible issue
Conclusion It’s way easier than you think it is Just do one to see for yourself and your agency Annually if you can swing it Gets some great buy-in because execs can see results Implement your pentester’s recommendations to make itharder for them next year Simplest controls make the most impact
Mitigations Disable LLMNR, NetBIOS over TCP, WPAD Remove Local Admin Rights from users Different local admin passwords or disable network use of localaccounts Two factor for server access Mitigate mimikatz with mikatz-wdigestcleartext-credential-theft Private VLANS
Questions@andrew hallberg@grandomthoughts
Upcoming Eventswww.vita.virginia.gov9292
Security Audits of IT Systems According to SEC 502, all IT security audits mustfollow either:– GGAS (Generally Accepted Government Auditing Standard)Yellow Book– IIAS (Institute of Internal Auditors Standards) Red Book– AICPA (American Institute of Certified Public Accountants) This includes all internal audits and all contractedauditswww.vita.virginia.gov93
Reporting IT Security Audit Results to VITA The official audit report must include anattestation as to the audit standard used. This includes internal audits and auditsperformed by external organizations. Reports without this statement ofassurance to meet the SEC-502 standardmay be rejected.www.vita.virginia.gov94
Future ISOAGAugust 30 ,2017 1:00 - 4:00 pm @ CESCSpeakers: Eddie McAndrew, Impact MakersBarry Davis,DSSBenjamin Sady Dixon Hughes GoodmanISOAG meets the 1st Wednesday of each month in 201795
Announcement: VASCAN Conference 2017IOT: The S Stands for SecurityDate: September 28-29Location: Virginia Tech, Blacksburg VAKeynote Speaker:Doug WylieDirector Industrials &Infrastructure PortfolioSANS InstituteTo Register: http://www.cpe.vt.edu/vascan/96
OSIG TrainingPlanning and Assessing Access Controls in Today’s IT EnvironmentInstructor: David Cole – SysAudits.comDate:October 31, 2017Location:Virginia Credit Union Operations Center / 1st Floor TrainingConference RoomAddress:7500 Boulder View Dr.North Chesterfield, VA 23225Pricing Terms: 175.00 REGISTRATION LINK:https://osig.virginiainteractive.orgCPE: 8 hoursGeneral Overview:This course will provide an overview of access controls that are commonlybeing used in today’s complex environments. Walk through of two-factordeployments, application web-proxies, DMZ environments and designs; andcloud application hosting. In addition, an overview of vulnerability97www.vita.virginia.gov
ADJOURNTHANK YOU FOR ATTENDINGPicture courtesy of www.v3.co.uk98
The TIC Reference Architecture v2.0 defines TIC capabilities as either Recommended or Critical. For purposes of this overlay, ALL applicable TIC capabilities are considered Critical (and therefore mandatory) for external cloud service providers. Achieve a FedRAMP sec
August 2, 2021 15 August 2, 2021 16 August 2, 2021 17 August 3, 2021 18 August 4, 2021 19 August 5, 2021 20 August 6, 2021 21 August 9, 2021 22 August 9, 2021 23 August 9, 2021 24 August 10, 2021 25 August 11, 2021 26 August 12, 2021 27 August 13, 2021 28 August 16, 2021 29 August 16, 2021 30 August 16, 2021 31
Oct 30, 2020 · August 2019 2017 CHEVROLET BOLT Used 18 279,794 August 2019 2017 CHEVROLET VOLT Used 12 191,083 August 2019 2017 FIAT 500E Used 1 12,588 August 2019 2017 FORD FOCUS BEV Used 2 31,703 August 2019 2017 KIA SOUL EV Used 1 15,900 August 2019 2017 NISSAN LEAF Used 101 1,304,259 August 2019
Aug 04, 2020 · Ranch August 1-4. One honor not offered was how to meet Upcoming Events Hispanic Pastor's Meeting Glenwood Springs August 7-9 Hispanic INTEL Class August 10-11 Pastors Meeting August 12-15 RMC Property and Trust Committee August 16, 9:30 a.m. Staff Meeting August 21 GVR Board August 21, 9:
August 2nd—Shamble "Queen of the Green" August 9th—President's Club (Eclectic Week 1) August 16th—President's Club (Eclectic Week 2) August 23rd—Criss-Cross (1/2 Handicap) August 30th—Stroke Play (HSTP Qualifying) August Play Schedule August Theme — Queen of the Green! P utting prodigies, our next General Meeting and theme day is August
Amazon Machine . Learning. AWS Device Farm. AWS WAF. Elasticsearch Service. QuickSight. Import/Export Snowball . Operating System, Network & Firewall Configuration. Customer content . Such as Amazon S3 and Amazon DynamoDB . Managed by. Managed by. Optional – Opaque Data: 1’s
Scan network for hosts running web services Import data into PowerShell Break list into batches and open web pages in browser In practice: Reviewed over 150 websites Better way: Use PowerShell to download web page and use PowerShell to extract details to identify the web appli
Nov 26, 2017 · Chemtrails, HAARP and The Full Spectrum Dominance of Planet Earth – Hosted By Bye Bye Blue Sky and Conspiracy Culture Bookstore Archives November 2017 October 2017 September 2017 August 2017 July 2017 June 2017 May 2017 April 2017 March 2017 February 2017 January 2017 December 2
American Revolution Lapbook Cut out as one piece. You will first fold in the When Where side flap and then fold like an accordion. You will attach the back of the Turnaround square to the lapbook and the Valley Forge square will be the cover. Write in when the troops were at Valley Forge and where Valley Forge is located. Write in what hardships the Continental army faced and how things got .
