|
Safe computing
Do
you have an operational plan for information security?
|
By
Ken M. Shaurette
Goliath Networks
It'The
success of information security for an organization is the
result of putting together the right combination of technical,
organizational and security awareness components. Every organization
should have an information security operational plan (ISOP)
and this article describes why.
Organizations must recognize information security as a management
issue, treated like any other item of strategic importance.
Information and information processing assets have become
one of the most critical components in a company's ability
to complete its mission and business goals. The exchange of
information has become as important to a company as the exchange
of money. Today being a profitable company is often the result
of rapid and successful information exchange.
For example, in today's economy seldom does actual cash (remember,
the green stuff) actually change hands. These days a bank
transfer is nothing more than the transmission of a few digits
making up an account number and an amount along with some
form of authorization making the transaction valid. Do you
really think that $1,000 is in your bank sitting physically
in your account?
Let's follow this story; a bank loses all ability to communicate
with the outside world other than its front door. People with
money deposited at the bank decide to close their accounts.
Would the bank have funds to cover the entire cash request?
Companies such as this are assuming the risk that not all
patrons will ask for their cash on the same day; they expect
some customers to accept a check rather than cash. Essentially
they have formulated an operations plan that allows them to
protect their customers' financial assets.
The purpose of an information security program is to protect
vital information assets. The purpose of the information security
operational plan is to organize technical, organizational
and security awareness components into a plan that delivers
the right combination of controls, putting into place a holistic
approach for addressing information security issues. The plan
identifies risk so that a company is not assuming more than
it can afford. The plan maximizes a company's resources and
organizes them so that they can be concentrated where they
are most needed while not forgetting other equally important
aspects of an overall information protection program. The
plan provides a philosophy for Information Security guided
by vision, a mission and quality statements. A tactical plan
establishes an organized way to build on the basic mechanisms
and foundation that make up the information security infrastructure.
What constitutes an information security operational plan?
Information security is made up of eight major categories.
These categories are identified as: the Baseline, Policies,
Standards and Procedures, Architecture and Processes, Awareness
and Training, Technologies and Products, Assessment and Monitoring,
Contingency and Compliance. At the top level an Executive
Summary outlines the foundation of the plan along with assumptions,
any prerequisites or requirements to execution of the plan.
Each year (more frequently if desirable) tactical plans outline
the status, goals and plans for the year in each category.
A brief explanation of each category follows:
Baseline: This is a baseline study performed
annually to establish the base. It provides an understanding
of the current status of company information security efforts.
Policies, Standards and Procedures: Policy
is the roadmap; it lies out the current state of company security
and where a company wants to go. Standards are usually the
technical foundation that the business will work from and
procedures provide the directions on how to meet policy and
comply with standards. All of these together define the business
environment to insure security information handling.
Architecture and Processes: This area is
the infrastructure and processes that provide a secure and
stable operating environment. Included are approval and implementation
methodologies such as change management. It addresses the
need for security to be part of development and design as
well as testing and deployment.
Awareness and Training: Users and customers
must be aware of their personal responsibilities relating
to information security. Technology alone will not eliminate
all vulnerability. Proper education and awareness by information
handlers is critical.
Technologies and Products: Security related
products are necessary to support policy and provide the security
architecture, which protects business processes. The technologies
can range from simple logging of system events to complex
public key encryption systems.
Assessment and Monitoring: The right information
must be collected and distributed to the appropriate personnel
including management reporting. Network connections, overall
system performance and host activity must be monitored for
anomalies or suspicious activity.
Contingency: This is the preparation for
events out of the ordinary or preparing for the unexpected.
(Say, all bank patrons withdrawing their money on the same
day.) This includes minor information or business processing
losses and disasters.
Compliance: This is the health check for
the information security program. It establishes methodologies
for feedback that provide the cornerstone of continuous improvement
for the information security efforts. It establishes ways
for management, technical staff and end users to assess the
impact of implementing components of the security program
on the computing environment and business processes that may
adversely effect the company's ability to serve its customers.
It also measures compliance with industry and governmental
mandates.
WHERE TO START
Establish security responsibilities. Legislation such as HIPAA
(Health Insurance Portability and Accountability Act) for
health entities and G-L-B (Gramm, Leach, Bliley) for financial
institutions are requiring that organization appoint a "Chief
Privacy Officer" or "Chief Security Officer" or the equivalent.
What this means is that someone or a function at an organization
must be to consider the privacy and security requirements
that these Federal Laws create. If a company already has experienced
security staff, they could represent the security and privacy
issues. The ISOP would be a critical component to help them
prioritize security activities, communicate their status to
management and set future expectations. It would be the necessary
documentation to show activities toward complying with the
legislation and status of in process compliance activities.
It will help with budgetary considerations as well as staffing
concerns. Without a plan, would a company know if they are
taking on more than they can reasonably expect to accomplish
or addressing issues that are not as critical as others? Are
they becoming compliant or simply buying lots of technology
with no coordinated method for applying it to the business
problems?
If a company does not already have staff able to deliver an
ISOP, many consulting companies are beginning to staff security
areas with the expertise necessary to deliver information
security solutions. The consulting company may be able to
provide part of the needs for meeting compliance with HIPAA
or G-L-B such as performing periodic assessments of the state
of a company's security.
If an organization is unfamiliar with the security work of
a consulting company, look for a company that has Certified
Information Systems Security Professionals (CISSP) on its
staff to insure you are getting the quality and security expertise
you expect. The consultant must be able to translate business
needs into information security deliverables and provide an
appropriate balance between controls and business process.
Without an ISOP an organization may be spending money to address
the wrong areas.
No matter how the issues are addressed, it is still critical
for a company to assign internal responsibility for following
through with the ISOP and managing the overall success of
the security and compliance program.
Ken M. Shaurette, (CISSP, CISA) is a Senior Information
Security Advisor at Goliath Networks Inc. in Madison. Ken
has provided security/audit advice and vision for companies
building information security programs for more than 17 years.
He currently helps organizations with their security framework
and planning. Ken has written numerous articles in security
industry trade magazines as well as Auerbach''s Handbook of
Information Security Management. He can be reached at [email protected]
|
|
Business
directory
Advertising
Apartments
Auto
dealers
Automotive
parts
Automotive
search
Business
opportunity
Chiropractor
& relaxation
Computers
& repair
Computer
training
Education
Employment
Event
tickets and tours
Gardening
centers
Grocers
Homebuilders
Hospitals
Hotels
Legal
services
Mortgage
banker
Natural
health
Photography
Packer
merchandise
Performances
Realtors
Restaurants
Shopping
Slides
Technology
solutions
Tires
Upcoming
event
|
