Creating queries and dashboard for NYDFS compliance

View as Markdown

Who is this playbook for and why?

  • Security teams
  • Compliance teams

How will runZero help?

runZero can gather the data needed for a large portion of NYDFS compliance, especially the 500.09 section. Queries and widgets in a custom dashboard let you track and display that information.

What will I need to do?

  1. Identify and save queries for the different NYDFS requirements.
  2. Create a new custom dashboard that puts information on those requirements in one place.
  3. Configure the dashboard with the queries you saved in step 1.

Prerequisites

Steps to implement

1. Identify queries of interest

Run each query in the Asset Inventory first, then click the three-dot button in the top right and click “Save Query”. The dashboard widgets reference these saved queries later.

These are some of the categories NYDFS requires, with the queries that apply:

  1. Owner

  • To track the number of assets missing an owner, use this query:

    has_owner:f

  • The Asset Ownership pre-built widget, covered later in this playbook, is another option.

  1. Location
  • A few queries fit, depending on how you track locations and their assets:

    • If your assets are tagged with their location and you want to count the assets in each location, use this query for each tag you want to monitor:

      tag:="Name_of_tag"

    • If your assets are split by Site instead of tags, use this query for each site:

      site:="Site_Name"
  1. Classification or sensitivity
  • Several pre-built widgets display criticality and risk, so you shouldn’t need additional queries for this.
  1. Support expiration date
  • If you only need the number of end-of-life assets, you won’t need any additional queries.
  • (Optional) To track EoL assets by operating system, start from these examples.

    • These are “contains” queries, so each should catch every version of its OS.

    • Change the OS in the query to track a different one.

      finding_name:="End-of-Life: Operating System" and os:ubuntu

      finding_name:="End-of-Life: Operating System" and os:windows

      finding_name:="End-of-Life: Operating System" and os:apple
  1. The frequency required to update and validate the covered entity’s asset inventory
  • Your scan task schedule and history generally track this. Use this query to count the assets scanned within the last 30 days. The “Asset Trends” pre-built widget should also be enough. 
     last_seen:<30days

2. Create a new custom dashboard

  1. Go to Dashboards to create a new personal dashboard.
  2. Click the Create Dashboard button in the top right.
  3. Give it a name and an optional description, for example NYDFS Compliance.

3. Configure the dashboard

runZero recommends recalculating the metrics now so that every query you added shows an updated metric.

  • To recalculate, open a dashboard, click the hamburger button in the top right, and choose “Recalculate Metrics”.

Now add widgets for the queries you saved earlier, plus a few pre-built widgets, to show the information NYDFS requires.

  1. Owner
  • You have two options:
    • Asset Ownership, a pre-built widget you can select from the available widgets.
    • A “Single Match Count” or “Single Match Trend” widget built on the missing-owner query you saved earlier.
  1. Location
  • Create a “Single Match Count” widget for each tag-based or site-based query you saved earlier.
    • The “Multi-Query match count” widget can also hold all of those queries in a more condensed format.
  • Optional: use the “Asset Tags” pre-built widget. It displays the 10 most used tags in your inventory.
  1. Classification or sensitivity
  • Use the “Criticality” and “Risk” pre-built widgets.
  1. Support expiration date
  • Choose from these pre-built widgets:
    • End-of-life findings by name
    • End-of-life findings by risk
  • If you created any custom queries earlier, you can instead build a “Multi-Query match count” widget or a “Single Match Count” widget for each one.
  1. The frequency required to update and validate the covered entity’s asset inventory
  • Organization overview
    • This widget shows the number of recent assets, active scans, recurring scans, Explorers online and offline, and users. It’s a useful synopsis of your organization.
  1. (Optional) Finding Gaps
  • If you saved any of the gap-finding queries for your security tools mentioned earlier, you can build custom widgets for those too. Pick the widget type based on whether you want the queries separated or combined, and whether you want a number or a trend line.

When you have added the widgets you want, move and resize them as you like.

Additional resources

Updated