Developing an Information Security Program

2011 National BDPA Technology Conference Developing an Information Security Program Shauna Cox August 3 – 6, 2011 Chicago, IL

Presentation Objectives Understand the components of an Information Security Program. Understand the internal & external factors that impact Information Security Program development. Describe the various approaches used to develop an Information Security Program.

Agenda Need for Information Security Program Program Components Methodologies / Standards Information Security Program Development Process A Day In The Life

Reality A Hacker has to be successful once. A Security Professional must be successful every time.

Why is an Information Security Program Needed? Technology & Business Cycle Changes Regulatory Requirements Potential Security Threats Sophistication of Attacks / Attackers Strategic Necessity

Technology & Business Cycle Changes Decentralization of computing resources Accessibility of technology for novices & experts alike Technology dependency Layers of technology architecture

Regulatory Requirements FISMA HIPAA SOX Computer Security Act U.S. Privacy Act

Potential Threats Terrorism / Cyber-Terrorism Uninformed Users (Social Engineering) Disgruntled Users / Employees Intentional Hackers

Sophistication of Attacks Availability of Technology Greater Modes of Organization (i.e., social networking) Enhanced Technical Skills Easier to Maintain Anonymity Potentially Lucrative (e.g., organized criminals)

Strategic Necessity Competitive Survival & Advantage Business / Technology Alignment

Myth Information Security Policy = Information Security Program

Information Security Principles

People, Places & Things Roles & Responsibilities Scope of Authority Tools & Techniques

Roles & Responsibilities Information Security Function Executive Management Organizational (Line) Management Users

Information Security Function Develop, maintain & help enforce information security policies, procedures and controls. Oversee the deployment and integration of security solutions. Serve as an advisor on IT security-related issues.

Executive Management Provide the strategic vision for an information security program. Approve strategic goals and ensure information security is integrated into management processes. Ensure enterprise compliance with applicable regulatory directives.

Management Ensure compliance & help facilitate awareness of organizational information security policies & procedures. Enforce rules for appropriate use and protection of organization’s systems. Ensure proper segregation of duties in operational areas. Follow appropriate procedures and provide first-line authorization for system access.

Users Adhere to organizational policies and procedures. Protect individual user accounts and passwords used to access systems. Report known or suspected IT security breaches to appropriate personnel. Treat all information with the sensitivity necessary in accordance with applicable information classification systems.

Tools & Techniques Standards Security Monitoring Tools Organizational Process Assets (policies, procedures, etc.)

Information Security Program Components Executive Commitment Policies & Procedures Monitoring Processes / Metrics Governance Structure Awareness Training

Executive Commitment Executives must understand the strategic impact of information security. Executive management articulates the priority of information security in word & in deed. The role of the information security function must adhere to a level of independence (i.e., reporting structure should be appropriate).

Policies & Procedures Acceptable Use Incident Handling Security Violations Identity Management Physical Security

Metrics Financial Application-based Incident Management Change Management Vulnerability Management

Governance Structure Governance: “…a set of responsibilities & practices exercised by the Board and executive management with the goal of providing strategic direction, ensuring that objectives are achieved, ascertaining that risks are managed appropriately, and verifying that the enterprise’s resources are used responsibly”. Source: IT Governance Institute (Board Briefing on IT Governance, 2 nd Edition)

Methodologies / Standards ISO 17799 developed by ISO includes 10 domains CobiT developed by ISACA derived from COSO

ISO 17799 Domains Information Security Policy Information Security Infrastructure Asset Classification & Control Personnel Security Physical & Environmental Security Communications & Operations Management Access Control System Development & Maintenance Business Continuity Management Compliance

Program Development Process Plan & Organize Implement Operate & Maintain Monitor & Evaluate Source: All-In-One CISSP Exam Guide, 4 th Edition, by Shon Harris

Plan & Organize Establish commitment & oversight Conduct risk assessment Develop security architecture Identify solutions

Implement Assign roles & responsibilities Develop & implement policies, procedures, etc. Implement security blueprints Implement security solutions Develop audit & monitoring mechanisms Establish SLAs

Operate & Maintain Ensure baselines are met based on blueprints Conduct audits Manage SLAs

Monitor & Evaluate Review logs, audit results, metrics Assess goal accomplishments Evaluate via governance structure

A Day in the Life Conduct Self- Assessments Respond to Audits Train & Educate Provide Expertise Monitor Systems Manage Projects Track Compliance Gauge SLA Adherence

Game Changers Cloud Computing Mobile Computing Social Networking

Resources NIST ISC 2 ISACA SANS Institute

Contact Information Shauna Cox [email_address]

Developing an Information Security Program

Recommended

More Related Content

What's hot (20)

Similar to Developing an Information Security Program (20)

Developing an Information Security Program