DATASHEET (TRIPWIRE)

The Egypt Financial
Cybersecurity Framework

Achieving Compliance Using Tripwire Solutions
Central Bank of Egypt (CBE) identified key areas of focus to tailor a cybersecurity framework to the unique requirementsof the Egyptian financial sector. This framework will serve as the foundational guidance for cybersecurity capability
development within this critical sector. This is the kick-off of a larger-scale effort by the CBE to build a robust andsustainable cybersecurity ecosystem within the financial sector.
The CBE has established this framework as a starting point to bolster the cybersecurity posture and cybersecurity resilience forthe financial sector of Egypt. This framework incorporates a number of cybersecurity best practices and controls to be incorporated into financial sector’s cybersecurity programs.
Security controls are specified throughout the framework and serve as the primary measure of compliance. Baselining andhardening involve completing prudent and specific tasks to reduce attack surface which is mentioned in the framework.
Fortra’s Tripwire® Enterprise proactively hardens systems by assessing configurations against internal and external security
standards, benchmarks, and industry regulations, then continuously assesses changes against security, policy and compliancerequirements for “good” vs. “bad” change and “policy drift”.
Tripwire Enterprise provides the broadest range of policies and platforms in the industry, including PCI, CIS, Egypt Financial
Cybersecurity Framework (CBE), UAE NESA, Qatar NIA, Saudi ECC, HIPAA, NERC CIP, SOX, COBIT, DISA STIGs and many others.
The following explanations show how Tripwire Enterprise is mapped to Egypt Financial Cybersecurity Framework (CBE) requirements and controls.

Identity and Access
Management

CBE Compliance Results - Identity and Access Management

Identity and Access Management aims
to provision or revoke access for usersand systems to operate on the organization’s enterprise. A secondary purposeof IAM is to ensure that users are only
granted the minimal level of accessneeded to perform core job functions.
The report displayed shows high levelcompliance with Identity and Access
Management requirements.

4.1 Identity and Access Management
4.1.5 Technology Capabilities

Fortra Datasheet

Data Protection andPrivacy

The Egypt Financial Cybersecurity Framework

CBE Compliance Results - Data Protection and Privacy

Data Protection and Privacy aims toprotect the availability, integrity, andprivacy of data. Data protection measures focus on safeguarding client andbusiness data, intellectual property,
and personally identifiable information
belonging to employees and clients.
High level compliance with Data
Protection and Privacy is displayed in
the sample report.

Application Security

Application Security aims to reduce
systemic risk exposure inherited fromthe use of software applications
required to support business operations.
Application Security focuses on safeguarding applications from exploitation
by adversaries throughout an application’s life. The report displayed showshigh level compliance with Application
Security requirements.

Endpoint Security

Endpoint Security aims to protect
servers, desktops, and workstations
that employees, third parties, andcontractors use to connect to theorganization’s network. Implementing
Endpoint Security using comprehensive
standards and technical controls canprevent:» Malware infections» Command and Control activity» Data exfiltration» Ransomware/Data destruction» Privilege escalation» Lateral movement
The report displayed shows high levelcompliance with Endpoint Security
requirements.

4.2 Data Protection and Privacy
4.2.5 Technology Capabilities

CBE Compliance Results - Application Security
NodePassedTests

FailedTests

Percent Compliant

Empire.galaxy.ffa

5456%

StarDestroyer-10185

3633%

StarDestroyer-10551

3633%

StarDestroyer-10774

3633%

StarDestroyer-114

3633%

StarDestroyer-1256

3633%

StarDestroyer-13261

3633%

StarDestroyer-13411.galaxy.ffa

3633%

StarDestroyer-14146

3633%

StarDestroyer-14288

3633%

StarDestroyer-14519

3633%

StarDestroyer-15199

3633%

StarDestroyer-15267

3633%

FailedTests

Percent Compliant

4.5 Application Security
4.5.6 Technology Capabilities

CBE Compliance Results - Endpoint Security
NodePassed
Tests

Empire.galaxy.ffa

030%

StarDestroyer-10185

030%

StarDestroyer-10551

030%

StarDestroyer-10774

030%

StarDestroyer-114

030%

StarDestroyer-1256

030%

StarDestroyer-13261

030%

StarDestroyer-13411.galaxy.ffa

030%

StarDestroyer-14146

030%

StarDestroyer-14288

030%

StarDestroyer-14519

030%

StarDestroyer-15199

030%

StarDestroyer-15267

030%

PassedTests

FailedTests

Percent Compliant

4.6 Endpoint Security
4.6.4 Process
NodeEmpire.galaxy.ffa

121939%

StarDestroyer-10185

112035%

StarDestroyer-10551

112035%

StarDestroyer-10774

112035%Fortra Datasheet

Network Security

Network Security aims to protect dataand information in transit, ensure proper
network visibility, limit network accessto only authorized endpoints, and takecorrective actions on malicious activity
discovered. Implementing comprehensive network security standards andtechnical controls can prevent the following threats:» Unauthorized access» Network reconnaissance» Malware infections» Command and Control activity» Data exfiltration» Ransomware/Data destruction
High level compliance with Network
Security requirements is displayed in thesample report.

Digital Channels

Digital Channels supports security controls needed to protect against threats,
including those listed below, to today’s
technology and those on the horizon
as society shifts towards a digital andlargely cashless economy.

» Abuse» Fraud» Financial theft» Identity theft» Money laundering and financing ofThe Egypt Financial Cybersecurity Framework

CBE Compliance Results - Data Protection and Privacy

4.2 Data Protection and Privacy
4.2.5 Technology Capabilities
Node

PassedTests

FailedTests

Percent Compliant

Empire.galaxy.ffa

5456%

StarDestroyer-10185

3633%

CBE Compliance
Results - Digital Channels
StarDestroyer-10551
3
StarDestroyer-10774

3633%

633%

StarDestroyer-114

3633%

StarDestroyer-1256

3633%

StarDestroyer-13261

3633%

StarDestroyer-13411.galaxy.ffa

3633%

StarDestroyer-14146

3633%

StarDestroyer-14288

3633%

StarDestroyer-14519

3633%

StarDestroyer-15199

3633%

StarDestroyer-15267

3633%

PassedTests

FailedTests

Percent Compliant

terrorism» Terror financing» Legal compliance
The report displayed shows high levelcompliance with Digital Channels
requirements.

4.8 Digital Channels
4.8.5 Technology Capabilities
NodeEmpire.galaxy.ffa

16867%StarDestroyer-10185

18675%StarDestroyer-10551

18675%StarDestroyer-10774

18675%StarDestroyer-114

18675%StarDestroyer-1256

18675%StarDestroyer-13261

18675%StarDestroyer-13411.galaxy.ffa

18675%StarDestroyer-14146

18675%StarDestroyer-14288

18675%StarDestroyer-14519

18675%StarDestroyer-15199

18675%StarDestroyer-15267

18675%

Fortra Datasheet

Cloud Security

Cloud Security aims to address uniquerisks posed by using Infrastructure-asa-Service (IaaS), Platform-as-a-Service(PaaS), or Software-as-a-Service (SaaS)
cloud computing offerings. CloudSecurity addresses the following threats:

The Egypt Financial Cybersecurity Framework

CBE Compliance Results - Cloud Security» Unauthorized access» Data privacy» Lateral movement between andwithin cloud tenants» Virtualization vulnerabilities» Expansive attack surface
High level compliance with Cloud
Security requirements is displayed in thesample report.

5.2 Cloud Security
5.2.5 Technology Capabilities
NodePassed
Tests

FailedTests

Percent Compliant

Empire.galaxy.ffa

6460%

StarDestroyer-10185

4640%

StarDestroyer-10551

4640%

StarDestroyer-10774

4640%

StarDestroyer-114

4640%

StarDestroyer-1256

4640%

StarDestroyer-13261

4640%

StarDestroyer-13411.galaxy.ffa

4640%

StarDestroyer-14146

4640%

StarDestroyer-14288

4640%

StarDestroyer-14519

4640%

StarDestroyer-15199

4640%

StarDestroyer-15267

4640%

Tripwire Enterprise Executive dashboard showing compliance overview with the Egypt Financial Cybersecurity Framework.

Fortra Datasheet

Tripwire

Data Integrity Monitoring

In addition, Egypt Financial Cybersecurity Framework requires integrity monitoring to be deployed to detect changes across theassets to regularly review the changes and alert and report to the security operations for unauthorized changes.
Tripwire is the inventor of file integrity monitoring that has the unique, built-in capability to reduce noise by providing multiple
ways of determining low-risk change from high-risk change as part of assessing, prioritizing and reconciling detected change.
Auto-promoting countless business-as-usual changes reduces noise so IT has more time to investigate changes that may truly
impact security and introduce risk.
Tripwire has taken its original host-based intrusion detection tool to detect changes to files and folders, and expanded it into arobust file integrity monitoring (FIM) solution, able to monitor detailed system integrity: files, directories, registries, configuration
parameters, DLLs, ports, services, protocols, etc. Additional enterprise integrations including SIEM provide granular endpoint
intelligence that supports threat detection, generate rich event data with business context to determine what requires immediate investigation, enable better correlations and alerting workflows, etc.

Tripwire Enterprise Executive Integrity Monitoring dashboard.

Ready To Dig Deeper?

To learn more about Tripwire Enterprisecapabilities, reports, available policies,
and platform support, visit tripwire.com.

About Fortra
Fortra is a cybersecurity company like no other. We’re creating a simpler, stronger future for ourcustomers. Our trusted experts and portfolio of integrated, scalable solutions bring balance andFortra.com

control to organizations around the world. We’re the positive changemakers and your relentless ally toprovide peace of mind through every step of your cybersecurity journey. Learn more at fortra.com.

© Fortra, LLC and its group of companies. All trademarks and registered trademarks are the property of their respective owners.

fta-tw-ds-1122-r1-hm