RMIT Classification: Trusted

Lecture 9
Security Program
Management

1
 RMIT Classification: Trusted

Session Objectives

After reading completing the week contents, you should be able to :

• Define security program 

• Analyse the mechanism of establishing security program 

• Explain security program components

• Understand the methods of security program review

22
 RMIT Classification: Trusted

Security Program Management (1)

• Results alone are not enough; process leading to the

implementation of controls must be understood and accepted by all

the stakeholders.

• Security controls have traditionally been set up to address threats,

reduce the risk of an incident, or ensure compliance with

regulations.

33
 RMIT Classification: Trusted

Security Program Management (2)

• Such an approach, which can be described as opportunistic or

bottom-up, is no longer sustainable, since managers do not have

control over costs or longer-term planning.

• Setting up a security program management process  is therefore of

paramount importance to any decision maker.

44
 RMIT Classification: Trusted

Security Program Management (3)

• Introducing a management system based on an iterative process

involving the governing body and business units ensures the

quality of the decisions and especially the support of all the

stakeholders.

55
 RMIT Classification: Trusted

8.1. Security Program (1)

• consists of all the measures deployed by a company to protect its

assets: strategic, tactical, and operational controls

• all the activities, regulatory framework, and processes related

to security

• meets the requirements of the strategy and the internal and

external regulatory framework. 

66
 RMIT Classification: Trusted

8.1. Security Program (2)

• It is carried out according to a defined organization and includes

risk treatments and projects aimed at improving maturity as

decided by the governing body.

• Running a security program is the main responsibility of a CISO. 

77
 RMIT Classification: Trusted

8.1. Security Program (3)

• They must first ensure the proper working operations of all the

controls and then carry out the strategic security initiatives as

defined earlier.

• Security program management includes steering and supervising

the controls in place, operational activities, change projects,

planning, and coordination.

88
 RMIT Classification: Trusted

Security program (1)

• Program management according to a formalized process is of

utmost importance.

• Demonstrating that security reduces risk is important, but building

trust in the process itself is even more important.

• Confidence in the results, indeed, depends on trust in the process.

99
 RMIT Classification: Trusted

Security program (2)

• So, treating one risk is fine, but demonstrating that all the risks

have been identified, and their treatment is planned, is even better.

• Therefore, managing the program in the form of an iterative

process of continuous improvement and involving decision-making

bodies is essential for effective governance.

10
10
 RMIT Classification: Trusted

Security program (3)

• This ability to ensure that nothing has been left to chance instills

confidence in senior officials.

• This also reassures auditors, regulators, and all the stakeholders.

11
11
 RMIT Classification: Trusted

Security program (4)

• The design of a security program establishes a virtuous circle of

problem-solving, risk reduction, and prioritization leading to

continuous improvement and preventing the recurrence of the

same irregularities.

12
12
 RMIT Classification: Trusted

Security program (5)

• Senior managers and board members expect the ISMS or security

program in place to protect the company according to the strategy

and policies.

• Security program activities are guided by a documented process.

13
13
 RMIT Classification: Trusted

Security program (6)

• Security program must be based on the recommendations of the

standards or audit findings and must also include improvement

points decided within a process integrating the objectives: risk

mitigation, alignment with business needs, integration of new

technologies, response to audit findings, improvement of maturity,

etc.

14
14
 RMIT Classification: Trusted

Security program (7)

• Controls, often technical solutions, are installed in response to

visible threats outside of defined planning or architecture.

• This is where a security project roadmap gains importance as a

supervision and management tool.

15
15
 RMIT Classification: Trusted

8.2a. Program Review Cycle

• DECIDE: comprises all of the decision-making steps regarding

program objectives for a given period.

• DO: carries out the ISMS plan based on the objectives

established in the Decide process.

•  MONITOR:process includes oversight, evaluating program

results, and compiling reports that will be used in the Decide
process.

16
16
 RMIT Classification: Trusted

8.2b. Program Review Cycle

17
17
 RMIT Classification: Trusted

Decide (1)

• Comprises all of the decision-making steps regarding program

objectives for a given period.

• The purpose is to establish or validate a roadmap of initiatives or

improvement projects based on the elements provided by the

Monitor process.

18
18
 RMIT Classification: Trusted

Decide (2)

• The main actors are the governing body and the CISO.

• They must have the authority to decide, prioritize initiatives, and

allocate resources.

• The result of the Decide process is an ISMS business plan for the

next period.

19
19
 RMIT Classification: Trusted

Decide (3)

• The Plan consists mainly of two types of projects:

• projects that maintain or strengthen controls and risk treatment

(Maintain)

• projects that offer new services (Change) such as those

required by the strategy

20
20
 RMIT Classification: Trusted

DO (1)

• The Do process carries out the ISMS plan based on the objectives

established in the Decide process.

• This includes not only projects or initiatives as set out in the

strategy, for example, but also objectives to improve current

processes and controls, financial objectives, or any other objective

related to the security program.

21
21
 RMIT Classification: Trusted

DO (2)

• The results of this process will be evaluated using metrics and key

performance indicators (KPIs) and will facilitate the observations

made in the Monitor process.

• Metrics are used for reporting purposes.

22
22
 RMIT Classification: Trusted

Monitor (1)

• This process includes oversight, evaluating program results, and

compiling reports that will be used in the Decide process.

• It groups together all the elements necessary for decision-making.

• Using metrics to evaluate and report to the decision-makers is

primarily the responsibility of the CISO and their team.

23
23
 RMIT Classification: Trusted

Monitor (2)

• Feedback : Consists of reports used for decision-making:

• Report on the achievement of strategic initiatives

• Risk report (and treatment plan)

• Maturity report (and improvement plan)

• Report on the progress of the roadmap or projects

24
24
 RMIT Classification: Trusted

Example (1)

The governing body has decided to transfer some security

responsibilities to the business units. A plan was elaborated under

the aegis of the CISO; then, implementation began, resulting in the

modification of certain controls, in particular those related to

managing identities and access rights, and the authorizations of

certain exceptions.

25
25
 RMIT Classification: Trusted

Example (2)

The metrics used to measure the degree of achievement will be

those typically used to monitor project progress. It will also be

possible to measure the operational efficiency in such a change, in

particular the reduction of the load on teams responsible for

managing access rights. These KPIs will be part of the reports

produced as part of the Monitor process.

26
26
 RMIT Classification: Trusted

Example (3)

At the next review of the program, the governing body will thus be

able to decide whether to continue with this strategy.

27
27
 RMIT Classification: Trusted

Principles to consider when

developing and reviewing security
program ( ISO 27001) (1)

• Security organization context (strategy and strategic alignment)

• Management support and organization within the framework of the

ISMS

• Importance of the policies and regulatory framework

• Risk management: identification, assessment, and treatment

28
28
 RMIT Classification: Trusted

Principles to consider when

developing and reviewing security
program ( ISO 27001) (2)

• Planning and goal setting based on risk analysis

• Provision of resources

• Awareness and communication

29
29
 RMIT Classification: Trusted

Principles to consider when

developing and reviewing security
program ( ISO 27001) (3)

• Establishment and management of controls

• Performance evaluation

• Continuous improvement and management of nonconformities

30
30
 RMIT Classification: Trusted

Program management use input from

other building blocks (1)
• Strategic objectives and
initiatives are fundamental
components of decision-
making in the
Decide process.​

• The regulatory framework

sets the requirements for
a security program.​

31
31
 RMIT Classification: Trusted

Program management use input from

other building blocks (2)

• Defining the roles and responsibilities of the governing

body, committees, the CISO and their team, IT, and all the other

stakeholders are included in program management. 

• Risk management makes it possible to plan the reinforcement of

controls within the program

32
32
 RMIT Classification: Trusted

Program management use input from

other building blocks (3)

• Reporting enbales to produce all the reports required in the

Decide process through monitor process

• Asset management controls take part indirectly in the

management of the program through their contribution to the risk

management process.

33
33
 RMIT Classification: Trusted

Program management use input from

other building blocks (4)

• The Compliance block provides all the gap analyses and

recommendations for remediation to fill the gaps.

• Metrics and KPI provides all the metrics needed for reporting as

part of the Monitor process.

34
34
 RMIT Classification: Trusted

8.3a. Essential Tools of a Security

Program

• Companies should consult the standards to ensure that their

requirements have been taken into account one way or another in

developing security program

• The ISO 27001/2 standard is probably the best source to verify the

completeness of a program.

35
35
 RMIT Classification: Trusted

8.3b. Essential Tools of a Security

Program

• Essential Components/tools of program review cycle as

recommended by standards

• Planning improvements

• Identifying controls

• Indicators or metrics to evaluate results

• Reporting for planning purposes

36
36
 RMIT Classification: Trusted

8.3c. Essential Tools of a Security

Program

• Plan (1) and Catalog ( inventory ) of controls (2) are studied here

but metrics (3) and report (4) will be studied in other weeks

37
37
 RMIT Classification: Trusted

Plan (1)

• The plan is embodied in a project roadmap.

• Projects that are part of the plan can be categorized by the type of

improvement they bring to the controls:

• Projects aimed at maintaining existing controls and their level

of effectiveness (“maintain” projects)

38
38
 RMIT Classification: Trusted

Plan (2)

• Projects aimed at introducing new controls (“change” projects)

• The roadmap for security projects is an important element of

communication

• Origin of the request/need : The origin of the project makes it

possible to contextualize the need and facilitate prioritization.

39
39
 RMIT Classification: Trusted

Plan (3)

•  Description : A short description facilitates an understanding of

the project’s objectives. 

• Planning and dependence : Graphical representation makes it

easy to understand dependence on other projects and deadlines. 

• Outcome : The results or deliverables of the project should be

summarized as a reminder.

40
40
 RMIT Classification: Trusted

Example (1.)

Examples of maintain projects : Change of the encryption system,

extending data leak prevention to scan “private” messages,

upgrade of the baseline protection of Windows servers,

cybersecurity policy review, etc.

41
41
 RMIT Classification: Trusted

Example (2.)

Examples of change projects : Develop strategy and policy for

external cloud computing, introduction of a new smart card system,

setting up security organization to support the outsourcing of IT

developments, developing a new service within the Security

Operation Center, etc.

42
42
 RMIT Classification: Trusted

Plan ... (1)

Types of Security Projects and their Drivers

43
43
 RMIT Classification: Trusted

Plan ... (2)

Roadmap of projects as part of a security program plan

44
44
 RMIT Classification: Trusted

EXAMPLE: roadmap of security

projects ( previous figure) (1)

• Origin : Strategic initiative. 

• Description : Introduction of smart cards for internal physical and

logical access. 

• Dependence : Adaptation of the authentication system at the

application level. Adapting controls to physical access points.

45
45
 RMIT Classification: Trusted

EXAMPLE: roadmap of security

projects ( previous figure) (2)

• Outcome : Easy employee access to applications and premises.

Saves time for employees and saves 10 percent of help desk time

used for password resets. Reduces the risk of internal and external

fraud by introducing strong authentication. Alignment with best

practices and regulations regarding the protection of confidential

data.

46
46
 RMIT Classification: Trusted

Control Catalog (1)

• Good governance requires knowledge of the security protections in

place, the activities and daily concerns of security specialists, as

well as the objectives and plans for improvement.

47
47
 RMIT Classification: Trusted

Control Catalog (2)

• The question is how to present all the controls established in the

context of an ISMS so that they can be used for governance and

by all those involved in elaborating or revising the security

program.

• Catalog or inventory of controls- a tool providing information about

all the security controls deployed.

48
48
 RMIT Classification: Trusted

Purposes of Control Catalog (1)

• Program management

• Security program management primarily involves adapting the

established controls (maintain) or the evolution or introduction

of new controls (change).

49
49
 RMIT Classification: Trusted

Purposes of Control Catalog (2)

• The knowledge of the impact and especially on which controls

the projects of the Plan will act and for what purpose, ensures

better management, planning, and implementation of the right

resources.

• The characteristics of each control are noted with its maturity or

level of effectiveness, leading to better management of priorities.

50
50
 RMIT Classification: Trusted

Purposes of Control Catalog (3)

• Governance and management oversight

• To know the impact of its decisions, the governing body must

have an overview of existing controls.

• Decisions on the treatment of risks will involve the controls

associated with them.

51
51
 RMIT Classification: Trusted

Purposes of Control Catalog (4)

• Governance and management oversight

• However, if the security officer cannot make a concise

presentation of the controls associated with risks and desired

improvements, knowledgeable decisions cannot be made.

52
52
 RMIT Classification: Trusted

Purposes of Control Catalog (5)

Audit

• Recurring audits come not only from regulators or internal auditors

but also from customers or suppliers wanting better visibility of their

partners’ security postures.

• These time-consuming audits involving employees in the various

areas of security and IT can be simplified using a catalog of security

controls.
53
53
 RMIT Classification: Trusted

Purposes of Control Catalog (6)

• Indeed, the first task of the auditors is to discover existing

controls, who is responsible for them, especially whether they

have been tested, and their level of maturity or effectiveness.

• Different auditors make similar requests to the same internal

employees, which is very time consuming.

54
54
 RMIT Classification: Trusted

Purposes of Control Catalog (7)

• A catalog containing key information on controls would facilitate

the auditors’ work and help reduce the indirect costs of each

audit.

55
55
 RMIT Classification: Trusted

Purposes of Control Catalog (8)

• Internal organization

• Establishing a catalog of controls contributes to a better

understanding of roles and responsibilities in the field of

operational security management.

• Responsibility is defined for each control, resulting in more clarity

in the security organization and management process.

56
56
 RMIT Classification: Trusted

Example: ISO 27002 Control catalog

57
57
 RMIT Classification: Trusted

Example: Control catalog based on

responsibility (1)

• A pragmatic approach to developing a control catalog might be to

present only one level of controls but to group them together in

organizational security domains.

• This approach tries to present all the controls by area of

responsibility, which could facilitate an understanding of the ISMS.

58
58
 RMIT Classification: Trusted

Example: Control catalog based on

responsibility (2)

59
59
 RMIT Classification: Trusted

8.4. Review Cycle of ISMS

The program review cycle is used primarily when annual plans or IS

business Aplans are developed.

60
60
 RMIT Classification: Trusted

Report on security program (1)

• Items in report of state of security ( monitor and feedback phase)

• Report on risks and, above all, a specification of the

treatments required as a result of risk analysis. 

• Report on the maturity of controls. This report presents the

gaps between desired and current maturities and highlights

necessary and urgent improvements. 

61
61
 RMIT Classification: Trusted

Report on security program (2)

• Report on the status of projects and especially the degree

of completion planned for the period.

• CISO and team produce report using metrics or KPIs resulting from

the DO process, in particular:

• Incidents and trends

• Evaluation of control maturities 

62
62
 RMIT Classification: Trusted

Report on security program (3)

• Audit findings 

• Compliance gap from the legal and regulatory framework ◾

• Project (part of the plan) progress indicators

63
63