Information Security Management

J/618/7447
10203300

1
Topic 3: INFORMATION SECURITY FRAMWORKS

Eman Alzyoud
School of Computing and Informatics
[email protected]

2
Learning Objectives:

• Information security policy, standards and procedures

• including privacy policy, acceptable use , separation of duties , least privilege and the role of a
company’s internal policies, including service level agreements (SLAs) with providers.

• Organisations and responsibilities

• Managing compliance and stakeholders.

• Information security frameworks

• IT governance

• Information assurance programme implementation

3
 Introduction

• Information security program begins with policies, standards, and practices, which are the
foundation for information security architecture and blueprint.

• Coordinated planning is required to create and maintain these elements.

• Strategic planning for the management of allocation of resources.

• Contingency planning for the preparation of uncertain business environment

4
 Security Management Plan

• SMP should use a top-down approach

• Senior management is responsible for initiating and defining policies;

• Middle management is responsible for releasing standards, baselines,
guidelines in relation to the policy
• Operations management/IT teams implement the controls defined above
• End-users must comply with all the functions of the organization

5
 Security Management Plan Types
SMP Type Description
Strategic Plan Long term plan
Defines the organization’s security posture Useful for at
least 5 years.
Reviewed annually
Helps understand security function and align it with business
Should include Risk Assessment
Tactical Plan Mid-term plan
developed to provide more detailed goal Usually for an year or two
More technology oriented
Eg: Project plans, acquisition plan, budget plan, hiring plan

Operational Plan Short-term plan

Highly-detailed plan
Must be updated often (monthly, quarterly)
Spell-out how to accomplish various goals
Eg: resource allotment, budgetary allocation, training plans

6
Strategic, tactical, and operational plan timeline comparison

7
 Security Roles and Responsibility
• Ultimately responsible for security
• Must signoff all policy issues
• All activities must be approved
Senior Management • Will be held responsible for overall security success/failure
• Responsible for due care and due diligence

• Responsible for following the directives mandated by SM

Security Professional • Has the functional responsibility for security
• They are not decision makers

• Responsible for classifying information

Data Owner • Ultimately responsible for the data they own
• Typically high level management representative

• Responsible for tasks of implementing the prescribed protection defined by Data owner
Data Custodian • Responsibilities include, preforming/testing backups, validating data integrity, deploying
security solutions and managing data storage based on classification

• Has access to the secure system

User • Responsible for understanding and upholding the security policy

• Responsible for reviewing and verifying the security policy implementation

Auditor • Produces compliance and effectiveness reports

8
 Due Care and Due Diligence

Showing due diligence and due care is the only way to disprove negligence in an occurrence of loss.
Senior management must show due care and due diligence to reduce their culpability and liability when a
loss occurs.

Due Care
• Is practicing the individual activities that maintain the due diligence effort
• Is doing the right action at the right time.
• Taking reasonable care in protecting the organization

Due Diligence

• Is establishing a plan, policy, and process to protect the interests of an organization

• Is knowing what should be done and planning for it .

For example, due diligence is developing a formalized security structure containing a security policy,
standards, baselines, guidelines, and procedures. Due care is the continued application of this security
structure onto the IT infrastructure of an organization.

9
 Information Security Policy, Standards,
and Practices

• Management from communities of interest must make policies the basis for all information
security planning, design, and deployment.

• Policies direct how issues should be addressed and technologies used.

• Policies should never contradict law, must be able to stand up in court, and must be properly
administered.

• Security policies are the least expensive controls to execute but most difficult to implement
properly.

10
 Security Policy

- Strategic plan for implementing Enterprise Security policy –

security
focuses on issues relevant to every
- Defines the scope of security needed
aspect of the organization
for the organization

Types
- Defines the main security objectives
and outlines the security framework Issue-specific policy –
- Identifies major functional areas of focuses on specific service, department, function that
data processing is distinct from the organization as a whole
- Broadly outlines the security goals and
practices that should be employed System-specific policy –
- Its is used to assign responsibilities, Focuses on individual systems
define roles, specify audit
requirements, outline enforcement
process, indicate compliance
requirements, and define acceptable
risk levels It’s a compulsory document
11
 Security Categories

Regulatory Advisory Informative

• Required • Discusses • Designed to

whenever behaviors and provide
industry or activities are information or
legal acceptable knowledge
standards are and defines about a
applicable to consequences specific
your of violation subject
organization • Not
enforceable

12
 Standard/Baseline/Guideline/Procedure

Standard Baseline Guideline Procedure

• Define compulsory • Defines minimum • Offers • Final element of

requirements level of security recommendations the formalized
• Provides a course that every system on security policy
of action for must meet implementation structure
uniform • System-specific • Servers as an • Detailed step-by-
deployment of • Establishes operating guide step document
technology common secure • Flexible – can be describes actions
• Tactical documents state customized for necessary to
each unique implement
system security mandates
• System and
software specific
• Purpose is to
ensure integrity of
business process

13
 Acceptable Use Policy

An acceptable use policy (AUP) is a commonly produced document that exists as part of the
overall security documentation infrastructure . This policy defines a level of acceptable
performance and expectation of behavior and activity. Failure to comply with the policy may
result in job action warnings, penalties, or termination.

14
 The Information Security Framework

• Basis for design, selection, and implementation of all security policies, education and
training programs, and technological controls.

• Detailed version of security framework (outline of overall information security

strategy for organization).

• Specifies tasks and order in which they are to be accomplished.

• Should also serve as a scalable, upgradeable, and comprehensive plan for the current
and future information security needs

15
 Definitions

Framework

Provide guidance on how to build Individual architectures that will be useful to a diverse set of individuals

Architecture

• Tool to help individuals understand complex items

• Conceptual Construct
• It expresses enterprise structure (form) and behaviour (function)

Security Program

• It is a framework made of many entities working together to provide a protection level for an environment
• A security program should work in layers
• Security via obscurity is not a healthy protective mechanism

16
 Enterprise Architecture

• Two important key aspects of an Enterprise Architecture

Ø Identifying the stakeholders

• people who will be looking at it and using it

Ø Developing Views

• How the information that is most important to different stakeholders will be illustrated
in the most useful manner
• Architecture allows not only to understand the business from different views, but also
understand how a change takes place at one level will affect items at all other levels

17
 Zachman Architecture Framework

• First architecture Framework

• This is not a security oriented framework
• The Zachman framework is not a methodology, but it is a
structure.
• It is a two-dimensional framework that combines six
basic interrogatives (What, How, Where, Who, When, and
Why).
• The framework intersects with different perspectives:
Executives, Business Managers, System Architects,
Engineers, and Technicians.
• It enables holistic understanding of the enterprise by
looking at the organization from various viewpoints.

18
 The Open Group Architecture (TOGAF)
• Has its origins from US DoD

• Provides an approach to design, implement, and govern an

enterprise Information architecture

• Used to develop the following architecture types:

• Business Architecture
• Data Architecture
• Applications Architecture
• Technology Architecture

• Uses Architecture Development Method to create Individual

architectures

• ADM is an iterative and cyclic process that allows

requirements to be continuously reviewed and updated

19
 Enterprise Security Architecture

• Subset of Enterprise Architecture

• Defines information security strategy that consists of layers of solutions, process,

and procedures

• It ensures that security efforts align with business practices in a standardized and
cost-effective manner

• For a successful ESA the following must be understood and followed

o Strategic alignment
o Business enablement
o Process enhancement
o Security effectiveness
20
 Strategic Business Process Security
Alignment Enablement Enhancement Effectiveness
• Business drivers • Core business • Security • Metrics,
and processes are enterprise meeting SLA,
legal/regulatory integrated into components achieving ROI,
requirements the security must be meeting set
must be met by operating integrated into baselines,
the Security model the business providing
architecture processes to be management
effective dashboards

We can do new stuff We can do stuff better

21
 ISO27000 Security Program

• Outlines how an information security management system should be built and

maintained
• A lengthy list of standards for developing and maintaining an Information Security
Management System (ISMS)

• Provides guidance to design, implement and maintain policies, procedures,

and technologies to manage risks to the sensitive information assets of an
organization

• International Organization for Standardization (ISO)/ International Electrotechnical

Commission (IEC) 27000 family group (www.itgovernanceusa.com/iso27000- family)
is an international standard that can be the basis of implementing organizational
security and related management practices.

• Some key ISO27000 standards

• ISO27001 – ISMS requirements
• ISO27002 – Code of practice for ISMS
• ISO27005 – Risk Management
• ISO27031 – Business continuity
22
• ISO/IEC 27001:2022/Amd 1:2024 .Information security, cybersecurity and privacy protection ISMS

23
 COBIT 2019

• Control Objectives for Information and Related Technology (COBIT).

• COBIT is a documented set of best IT security practices crafted by the Information

Systems Audit and Control Association (ISACA).

• It prescribes goals and requirements for security controls and encourages the mapping of
IT security ideals to business objectives.

• COBIT is based on six key principles for governance and management of enterprise IT:
o Provide Stakeholder Value
o Holistic Approach
o Dynamic Governance System
o Governance Distinct from Management
o Tailored to Enterprise Needs
o End-to-End Governance System

24
 NIST

• NIST 800-53 Rev. 5, “Security and Privacy Controls for Information Systems and
Organizations”
contains U.S. government–sourced general recommendations for organizational
security.

• NIST Risk Management Framework (RMF)

establishes mandatory requirements for federal agencies. The RMF has six phases:
Categorize, Select, Implement, Assess, Authorize, and Monitor.

• NIST Cybersecurity Framework (CSF) is designed for critical infrastructure and

commercial organizations, and consists of five functions: Identify, Protect, Detect,
Respond, and Recover. It is a prescription of operational activities that are to be
performed on an ongoing basis for the support and improvement of security over
time.

25
 ITIL
• Information Technology Infrastructure Library (ITIL),initially crafted by the British
government, is a set of recommended best practices for optimization of IT services to
support business growth, transformation, and change.

• ITIL focuses on understanding how IT and security need to be integrated with and
aligned to the objectives of an organization.

• Customizable framework.

• It provides the goals, the general activities necessary to achieve the goals, and the
input/output values for each process required to meet the goals.

• It focuses more towards internal SLA between the IT department and the customer it
serves (predominantly Internal functions)

26
 Reference

• Alexander, D., Finch, A., Sutton, D. and Taylor, A. (2020) Information Security
Management Principles BCS. 3rd edn. BCS The Chartered Institute for IT.

• Calder, A. and Watkins, S. (2019) IT Governance: An International Guide to Data

Security and ISO27001/ISO27002. 7th edn. Kogan Page.

• Chapple, Mike - CISSP Official Study Guide (2021, Sybex). 9th edn.

27