© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Security Policies and Implementation Issues Lesson 4 IT Security Policy Framework Approaches

Page 2 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Learning Objective  Describe the different methods, roles, responsibilities, and accountabilities of personnel, along with the governance and compliance of a security policy framework.

Page 3 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Key Concepts  Different methods and best practices for approaching a security policy framework  Importance of defining roles, responsibilities, and accountability for personnel  Separation of duties (SoD)  Importance of governance and compliance

Page 4 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. DISCOVER: CONCEPTS

Page 5 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Information Systems Security Policy Frameworks Choosing the right framework is not easy Use a simplified security policy framework domain model Flexible frameworks fit governance and compliance planning requirements

Page 6 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Select an Industry Framework

Page 7 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. IT Security Policy Frameworks

Page 8 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. IT Security Policy Frameworks

Page 9 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. IT Security Policy Frameworks Organizations often combine frameworks to draw upon individual strengths.

Page 10 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. IT Security Policy Framework Domain Model

Page 11 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Information Technology (IT) Security Controls  IT security controls are a function of IT infrastructure that an organization has in its control and the regulatory and business objectives that need to be controlled You can have too many IT security controls, impeding the organization from operating at optimal capacity, thus reducing its revenue potential

Page 12 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Information Technology (IT) Security Controls (Continued)  Generic IT security controls as a function of a business model Deploy a layered security approach Use SoD approach -This applies to transactions within the domain of responsibility Conduct security awareness training annually

Page 13 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Information Technology (IT) Security Controls (Continued)  Apply the three lines of defense model First line: The business unit Second line: The risk management team Third line: Use independent auditors

Page 14 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. GRC and ERM Governance, Risk management, and Compliance (GRC) A discipline formally bringing together risk and compliance GRC best practices ISO series COBIT COSO Enterprise Risk Management (ERM) Follows common risk methodologies

Page 15 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Similarities Between GRC and ERM Defines risk in terms of business threats Applies flexible frameworks Eliminates redundant controls, policies, and efforts

Page 16 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Similarities Between GRC and ERM (Continued) Proactively enforces policy Seeks line of sight into the entire population of risks

Page 17 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Differences Between GRC and ERM Focuses on technology, a series of tools and centralized policies GRC Focuses on value delivery Takes a broad look at risk based on adoption driven by leadership ERM

Page 18 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Risk IT Framework Process Model

Page 19 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. DISCOVER: PROCESS

Page 20 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Best Practices: Security Policy Framework  Using a risk management approach to framework implementation reduces the highest risk to the organization ISACA COBIT framework for SOX 404 requirements for publically traded organizations  Aligning the organization’s security policy with business objectives and regulatory requirements

Page 21 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Best Practices: Security Policy Framework (Continued)  The use of a best practice methodology will best be answered based on organizational requirements and governmental regulations

Page 22 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. DISCOVER: ROLES

Page 23 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Roles Head of information management Data stewardsData custodiansData administratorsData security administrators

Page 24 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Roles and Responsibilities  Executive Management Responsible for governance and compliance requirements, funding, and policy support  Chief Information Officer (CIO)/Chief Security Officer (CSO) Responsible for policy creation, reporting, funding, and support  Chief Financial Officer (CFO)/Chief Operating Officer (COO) Responsible for data stewardship, owners of the data

Page 25 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Roles and Responsibilities (Continued)  System Administrators/Application Administrators Responsible for custodianship of the data, maintaining the quality of the data, and executing the policies and procedures pertaining to the data, like backup, versioning, updating, downloading, and database administration  Security Administrator Responsible for granting access and assess threats to the data, IA program

Page 26 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Committees

Page 27 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. DISCOVER: CONTEXTS

Page 28 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Importance of Governance and Compliance  Implementing a governance framework can allow organization to identify and mitigate risks in orderly fashion Can be a cost reduction move for organizations as they can easily respond to audit requests  A well-defined governance and compliance framework provides a structured approach  Can provide a common language

Page 29 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Importance of Governance and Compliance (Continued)  Is also a best-practice model for organizations of all shapes and sizes  Controls and risks become measurable with a framework Organizations with a governance and compliance framework can operate more efficiently  If you can measure the organization against a fixed set of standards and controls, you have won

Page 30 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Security Policy Framework: Six Business Risks StrategicComplianceFinancial OperationalReputationalOther

Page 31 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Business Risks

Page 32 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. DISCOVER: RATIONALE

Page 33 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Separation of Duties (SoD)  Layered security approach  SoD duties fall within each IT domain  Applying SoD can and will reduce both fraud and human errors

Page 34 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Layered Security Approach A Layered Security Approach mean having two or more layers of independent controls to reduce risk. Layered security leverages the redundancy of the layers so if one layer fails to catch the risk or threat, the next layer should.

Page 35 Security Policies and Implementation Issues © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company All rights reserved. Summary Different methods and best practices for approaching a security policy framework Importance of defining roles, responsibilities, and accountability for personnel Separation of duties (SoD) Importance of governance and compliance