Security Management Practices

Slides:



Advertisements
Similar presentations
Module N° 4 – ICAO SSP framework
Advertisements

Information Security Policy
Software Quality Assurance Plan
HIPAA: FEDERAL REGULATIONS REGARDING PATIENT SECURITY.
Information Security Policy
Management of Information Security, 4th Edition
Data Ownership Responsibilities & Procedures
Smart Grid - Cyber Security Small Rural Electric George Gamble Black & Veatch
Security Controls – What Works
Information Security Policies and Standards
TEL2813/IS2820 Security Management
Management of Information Security Chapter 06 Security Management Models And Practices Security can only be achieved through constant change, through.
Lecture 2: Planning for Security INFORMATION SECURITY MANAGEMENT
Security Management Practices
Computer Security: Principles and Practice
Session 3 – Information Security Policies
Complying With The Federal Information Security Act (FISMA)
Internal Auditing and Outsourcing
MANAGEMENT of INFORMATION SECURITY Second Edition.
SEC835 Database and Web application security Information Security Architecture.
Lesson 8-Information Security Process. Overview Introducing information security process. Conducting an assessment. Developing a policy. Implementing.
CHAPTER 5 Infrastructure Components PART I. 2 ESGD5125 SEM II 2009/2010 Dr. Samy Abu Naser 2 Learning Objectives: To discuss: The need for SQA procedures.
Continual Service Improvement Process
Information Systems Security Computer System Life Cycle Security.
N By: Md Rezaul Huda Reza n
NIST Special Publication Revision 1
IAEA International Atomic Energy Agency Reviewing Management System and the Interface with Nuclear Security (IRRS Modules 4 and 12) BASIC IRRS TRAINING.
MANAGEMENT of INFORMATION SECURITY Second Edition.
CDS Operational Risk Management - October 28, 2005 Existing Methodologies for Operational Risk Mitigation - CDS’s ERM Program ACSDA Seminar - October 26.
Important acronyms AO = authorizing official ISO = information system owner CA = certification agent.
Module N° 8 – SSP implementation plan. SSP – A structured approach Module 2 Basic safety management concepts Module 2 Basic safety management concepts.
TEL2813/IS2820 Security Management Security Management Models And Practices Feb 5, 2008.
CERTIFICATION In the Electronics Recycling Industry © 2007 IAER Web Site - -
Service Transition & Planning Service Validation & Testing
Certification and Accreditation CS Phase-1: Definition Atif Sultanuddin Raja Chawat Raja Chawat.
Sample Security Model. Security Model Secure: Identity management & Authentication Filtering and Stateful Inspection Encryption and VPN’s Monitor: Intrusion.
Disaster Recover Planning & Federal Information Systems Management Act Requirements December 2007 Central Maryland ISACA Chapter.
INFORMATION SECURITY MANAGEMENT L ECTURE 2: P LANNING FOR S ECURITY You got to be careful if you don’t know where you’re going, because you might not get.
1 © Material United States Department of the Interior Federal Information Security Management Act (FISMA) April 2008 Larry Ruffin & Joe Seger.
Copyright © 2007 Pearson Education Canada 1 Chapter 1: The Demand for Auditing and Assurance Services.
5-1 Lesson 5 | Common Issues & Challenges. Describe how RSAs address project schedule (time), project cost, and agency liability concerns. Explain the.
IT Risks and Controls Revised on Content Internal Control  What is internal control?  Objectives of internal controls  Types of internal controls.
Chapter 6: THE EIGHT STEP PROCESS FOCUS: This chapter provides a description of the application of customer-driven project management.
Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond,
Information Security IBK3IBV01 College 2 Paul J. Cornelisse.
Chap 8: Administering Security.  Security is a combination Technical – covered in chap 1 Administrative Physical controls SE571 Security in Computing.
Evaluate Phase Pertemuan Matakuliah: A0774/Information Technology Capital Budgeting Tahun: 2009.
INFORMATION SECURITY MANAGEMENT L ECTURE 8: R ISK M ANAGEMENT C ONTROLLING R ISK You got to be careful if you don’t know where you’re going, because you.
Company LOGO. Company LOGO PE, PMP, PgMP, PME, MCT, PRINCE2 Practitioner.
Dr. Mark Gaynor, Dr. Feliciano Yu, Bryan Duepner.
The NIST Special Publications for Security Management By: Waylon Coulter.
INFORMATION SECURITY MANAGEMENT L ECTURE 2: P LANNING FOR S ECURITY You got to be careful if you don’t know where you’re going, because you might not get.
The Health Insurance Portability and Accountability Act of 1996 “HIPAA” Public Law
MANAGEMENT of INFORMATION SECURITY Third Edition C HAPTER 7 S ECURITY M ANAGEMENT P RACTICES In theory there is no difference between theory and practice,
Important acronyms AO = authorizing official ISO = information system owner CA = certification agent.
Principles of Information Security, Fourth Edition Risk Management Ch4 Part II.
INFORMATION SECURITY MANAGEMENT L ECTURE 8: R ISK M ANAGEMENT C ONTROLLING R ISK You got to be careful if you don’t know where you’re going, because you.
INFORMATION ASSURANCE POLICY. Information Assurance Information operations that protect and defend information and information systems by ensuring their.
Risk Controls in IA Zachary Rensko COSC 481. Outline Definition Risk Control Strategies Risk Control Categories The Human Firewall Project OCTAVE.
Security Methods and Practice Principles of Information Security, Fourth Edition CET4884 Planning for Security Ch5 Part I.
Computer Security: Principles and Practice First Edition by William Stallings and Lawrie Brown Lecture slides by Lawrie Brown Chapter 17 – IT Security.
MANAGEMENT of INFORMATION SECURITY, Fifth Edition.
Information Security Policy
Software Project Configuration Management
Leverage What’s Out There
Introduction to the Federal Defense Acquisition Regulation
Cybersecurity Special Public Meeting/Commission Workshop for Natural Gas Utilities September 27, 2018.
Cyber security Policy development and implementation
The value of the metrics standards within our compliance frameworks
MANAGEMENT of INFORMATION SECURITY, Fifth Edition
Presentation transcript:

Security Management Practices MANAGEMENT of INFORMATION SECURITY Third Edition Chapter 7 Security Management Practices In theory there is no difference between theory and practice, but in practice there is… (Attributed to multiple sources, including Yogi Berra and Jan L.A. Van de Snepscheut)

Objectives Upon completion of this chapter you should be able to: List the elements of key information security management practices Describe the key components of a security metrics program Identify suitable strategies for the implementation of a security metric program Discuss emerging trends in the certification and accreditation of U.S. federal IT systems Management of Information Security, 3rd ed

Introduction Value Proposition Organizations strive to deliver the most value with a given level of investment Developing and using sound and repeatable information security management practices makes accomplishing this more likely Management of Information Security, 3rd ed

Benchmarking To generate a security blueprint Benchmarking Organizations usually draw from established security models and practices Another way is to look at the paths taken by organizations similar to the one for which you are developing the plan Benchmarking Following the existing practices of a similar organization, or industry-developed standards Management of Information Security, 3rd ed

Benchmarking (cont’d.) Can help to determine which controls should be considered Cannot determine how those controls should be implemented in your organization Management of Information Security, 3rd ed

Standards of Due Care/Due Diligence Categories of benchmarks Standards of due care/due diligence Best practices Best practices include a sub-category of practices, called the gold standard, that are generally regarded as “the best of the best” Management of Information Security, 3rd ed

Standards of Due Care/Due Diligence (cont’d.) Standard of due care When organizations adopt minimum levels of security for legal defense, they may need to show that they have done what any prudent organization would do in similar circumstances Due diligence Implementing controls at this minimum standard Requires that an organization ensure that the implemented standards continue to provide the required level of protection Management of Information Security, 3rd ed

Standards of Due Care/Due Diligence (cont’d.) Failure to demonstrate due care or due diligence can expose an organization to legal liability If it can be shown that the organization was negligent in its information protection methods Management of Information Security, 3rd ed

Recommended Security Practices Best Practices Security efforts that seek to provide a superior level of performance in the protection of information Considered among the best in the industry Balance the need for information access with the need for adequate protection Demonstrate fiscal responsibility Companies with best practices may not be the best in every area Management of Information Security, 3rd ed

The Gold Standard Some organizations prefer to implement the most protective, supportive, and yet fiscally responsible standards they can Gold standard A model level of performance that demonstrates industrial leadership, quality, and concern for the protection of information Implementation requires a great deal of financial and personnel support Management of Information Security, 3rd ed

Selecting Recommended Practices Choosing which recommended practices to implement can pose a challenge for some organizations In industries that are regulated by governmental agencies, government guidelines are often requirements For other organizations, government guidelines are excellent sources of information and can inform their selection of best practices Management of Information Security, 3rd ed

Selecting Recommended Practices (cont’d.) Considerations for selecting best practices Does your organization resemble the identified target organization of the best practice? Are you in a similar industry as the target? Do you face similar challenges as the target? Is your organizational structure similar to the target? Are the resources you can expend similar to those called for by the best practice? Are you in a similar threat environment as the one assumed by the best practice? Management of Information Security, 3rd ed

Limitations to Benchmarking and Recommended Practices The biggest barrier to benchmarking Organizations don’t talk to each other A successful attack is viewed as an organizational failure, and is kept secret, insofar as possible More and more security administrators are joining professional associations and societies like ISSA and sharing their stories and lessons learned An alternative to this direct dialogue is the publication of lessons learned Management of Information Security, 3rd ed

Baselining A value or profile of a performance metric against which changes in the performance metric can be usefully compared Process of measuring against established standards Baseline measurements of security activities and events are used to evaluate the organization’s future security performance Management of Information Security, 3rd ed

Baselining (cont’d.) Can provide the foundation for internal benchmarking Information gathered for an organization’s first risk assessment becomes the baseline for future comparisons Management of Information Security, 3rd ed

Support for Baselining and Recommended Practices Self-assessment for best security practices People: Do you perform background checks on all employees with access to sensitive data, areas, or access points? Would the average employee recognize a security issue? Would they choose to report it? Would they know how to report it to the right people? Management of Information Security, 3rd ed

Support for Baselining and Recommended Practices (cont’d.) Self-assessment for best security practices (cont’d.) Processes Are enterprise security policies updated on at least an annual basis, employees educated on changes, and consistently enforced? Does your enterprise follow a patch/update management and evaluation process to prioritize and mediate new security vulnerabilities? Are the user accounts of former employees immediately removed on termination? Management of Information Security, 3rd ed

Support for Baselining and Recommended Practices (cont’d.) Self-assessment for best security practices (cont’d.) Processes (cont’d.) Are security group representatives involved in all stages of the project life cycle for new projects? Technology Is every possible route to the Internet protected by a properly configured firewall? Is sensitive data on laptops and remote systems encrypted? Management of Information Security, 3rd ed

Support for Baselining and Recommended Practices (cont’d.) Self-assessment for best security practices (cont’d.) Technology (cont’d.) Do you regularly scan your systems and networks, using a vulnerability analysis tool, for security exposures? Are malicious software scanning tools deployed on all workstations and servers? Management of Information Security, 3rd ed

Performance Measures in Information Security Management Costs, benefits and performance of InfoSec Are measurable, despite the claim of some CISOs that they are not Measurement requires the design and ongoing use of an InfoSec performance management program based on effective performance metrics Management of Information Security, 3rd ed

InfoSec Performance Management Information security performance management The process of designing, implementing and managing the use of collected data elements called measures To determine the effectiveness of the overall security program Measures are data points or computed trends that indicate the effectiveness of security countermeasures or controls Management of Information Security, 3rd ed

InfoSec Performance Management (cont’d.) Organizations use three types of measures Those that determine the effectiveness of the execution of information security policy (ISSPs) Those that determine the effectiveness and/or efficiency of the delivery of information security services Those that assess the impact of an incident or other security event on the organization or its mission Management of Information Security, 3rd ed

InfoSec Performance Management (cont’d.) NIST SP 800-55 R1, Performance Measures in Information Security suggests Consider the following factors Measures must yield quantifiable information (percentages, averages, and numbers) Data that supports the measures needs to be readily obtainable Only repeatable information security processes should be considered for measurement Measures must be useful for tracking performance and directing resources Management of Information Security, 3rd ed

InfoSec Performance Management (cont’d.) Critical factors for the success of an information security performance program Strong upper level management support Practical information security policies and procedures Quantifiable performance measures Results oriented measures analysis Management of Information Security, 3rd ed

InfoSec Metrics InfoSec metrics Metrics means detailed measurements Applying statistical and quantitative approaches of mathematical analysis to the process of measuring the activities and outcomes of the InfoSec program Metrics means detailed measurements Measures refers to aggregate, higher-level results The two terms are used interchangeably in some organizations Management of Information Security, 3rd ed

InfoSec Metrics (cont’d.) Questions to answer before collecting, designing, and using measures Why should these statistics be collected? What specific statistics will be collected? How will these statistics be collected? When will these statistics be collected? Who will collect these statistics? Where (at what point in the function’s process) will these statistics be collected? Management of Information Security, 3rd ed

Building the Performance Measures Program An information security measures program Must be able to demonstrate value to the organization Necessary even with strong management support Capability Maturity Model Integrated (CMMI) One of the most popular references that support the development of process improvement and performance measures Developed by The Software Engineering Institute at Carnegie Mellon Management of Information Security, 3rd ed

Building the Performance Measures Program (cont’d.) Another popular approach NIST SP 800 - 55 R1: Performance Measurement for Information Security Major activities The identification and definition of the current information security program Development and selection of specific measures to gauge the implementation, effectiveness, efficiency, and impact of the security controls Management of Information Security, 3rd ed

Building the Performance Measures Program (cont’d.) Figure 7-1 Information security measures development process Source: Course Technology/Cengage Learning (Based on NIST SP 800-55 Rev. 1) Management of Information Security, 3rd ed

Specifying InfoSec Measures Assess and quantify what will be measured One of the critical tasks While InfoSec planning and organizing activities may only require time estimates You must obtain more detailed measurements when assessing the effort spent to complete production tasks and the time spent completing project tasks Management of Information Security, 3rd ed

Collecting InfoSec Measures Some thought must go into the processes used for data collection and record keeping Once the question of what to measure is answered The how, when, where, and who questions of metrics collection must be addressed Designing the collection process requires consideration of the metric’s intent Along with a thorough knowledge of how production services are delivered Management of Information Security, 3rd ed

Collecting InfoSec Measures (cont’d.) Determine whether the measures used will be macro-focus or micro-focus Macro-focus measures examine the performance of the overall security program Micro-focus measures examine the performance of an individual controller or group of controls within the information security program Or use both macro- and micro-focus measures in a limited assessment Management of Information Security, 3rd ed

Collecting InfoSec Measures (cont’d.) Organizations manage what they measure It is important to prioritize individual metrics in the same manner as the performance they measure Use a simple low-, medium-, or high-priority ranking system Or a weighted scale approach Involves assigning values to each measure based on its importance in the overall information security program, and on the overall risk mitigation goals and the criticality of the systems Management of Information Security, 3rd ed

Collecting InfoSec Measures (cont’d.) Performance targets Make it possible to define success in the security program Many measures have a 100% target goal Other types of performance measures Those that determine relative effectiveness, efficiency, or impact of information security on the organization’s goals Are more subjective and require solid native and subjective reasoning Management of Information Security, 3rd ed

Collecting InfoSec Measures (cont’d.) Table 7-2a Example performance measures documentation Management of Information Security, 3rd ed Source: NIST SP 800-55, Rev 1

Collecting InfoSec Measures (cont’d.) Table 7-2b Example performance measures documentation Management of Information Security, 3rd ed Source: NIST SP 800-55, Rev 1

Collecting InfoSec Measures (cont’d.) Table 7-3a Measures template and instructions Management of Information Security, 3rd ed Source: NIST SP 800-55, Rev 1

Table 7-3b Measures template and instructions Management of Information Security, 3rd ed Source: NIST SP 800-55, Rev 1

Collecting InfoSec Measures (cont’d.) Candidate Measures Percentage of the organization's information systems budget devoted to information security Percentage of high vulnerabilities mitigated within organizationally defined time periods after discovery Percentage space of remote access points used to gain unauthorized access Percentage of information systems personnel that have received security training Management of Information Security, 3rd ed

Collecting InfoSec Measures (cont’d.) Candidate Measures (cont’d.) Average frequency of audit records review and analysis for inappropriate activity Percentage of new systems that have completed certification and accreditation (C&A) prior to their implementation Percentage approved and implemented configuration changes identified in the latest automated baseline configuration Management of Information Security, 3rd ed

Collecting InfoSec Measures (cont’d.) Candidate Measures (cont’d.) Percentage of information systems that have conducted annual contingency plan testing Percentage of users with access to shared accounts Percentage of incidents reported within required time frame per applicable incident category Percentage of system components that undergo maintenance in accordance with formal maintenance schedules Management of Information Security, 3rd ed

Collecting InfoSec Measures (cont’d.) Candidate Measures (cont’d.) Percentage of media that passes sanitization procedures testing Percentage of physical security incidents allowing unauthorized entry into facilities containing information assets Percentage of employees who are authorized access to information systems only after they sign an acknowledgment that they have read and understood the appropriate policies Management of Information Security, 3rd ed

Collecting InfoSec Measures (cont’d.) Candidate Measures (cont’d.) Percentage of individuals screened before being granted access to organizational information and information systems Percentage of vulnerabilities remediated within organization-specified time frames Percentage of system and service acquisition contracts that include security requirements and/or specifications Management of Information Security, 3rd ed

Collecting InfoSec Measures (cont’d.) Candidate Measures (cont’d.) Percentage of mobile computers and devices that perform all cryptographic operations using organizationally specified cryptographic modules operating in approved modes of operations Percentage of operating system vulnerabilities for which patches have been applied or that have been otherwise mitigated Management of Information Security, 3rd ed

InfoSec Performance Measurement Implementation Information security performance measures must be implemented and integrated into ongoing information security management operations It is insufficient to simply collect these measures once Performance measurement is an ongoing, continuous improvement operation Management of Information Security, 3rd ed

Collecting InfoSec Measures (cont’d.) Figure 7-2 Information security measurement program implementation process Management of Information Security, 3rd ed Source: Course Technology/Cengage Learning

Reporting InfoSec Performance Measures Listing the measurements collected does not adequately convey their meaning Decisions must be made about how to present correlated metrics Consider to whom the results of the performance measures program should be disseminated, and how they should be delivered Management of Information Security, 3rd ed

Emerging Trends In Certification And Accreditation The authorization of an IT system to process, store, or transmit information. It is issued by a management official and serves as a means of assuring that systems are of adequate quality Challenges managers and technical staff to find the best methods to assure security, given technical constraints, operational constraints, and mission requirements Management of Information Security, 3rd ed

Emerging Trends In Certification And Accreditation (cont’d.) The comprehensive evaluation of the technical and nontechnical security controls of an IT system Supports the accreditation process that establishes the extent to which a particular design and implementation meets a set of specified security requirements Organizations pursue accreditation or certification to gain a competitive advantage Also provides assurance to customers Management of Information Security, 3rd ed

SP 800-37: Guidelines for Security Certification and Accreditation of Federal Information Technology Systems Develops standard guidelines and procedures for certifying and accrediting Federal IT systems Including the critical infrastructure of the U.S. Defines essential minimum security controls for Federal IT systems Management of Information Security, 3rd ed

SP 800-37: Guidelines for Security Certification and Accreditation of Federal Information Technology Systems (cont’d.) Promotes the development of public and private sector assessment organizations And certification of individuals capable of providing cost effective, high quality, security certifications based on standard guidelines and procedures Management of Information Security, 3rd ed

SP 800-37: Guidelines for Security Certification and Accreditation of Federal Information Technology Systems (cont’d.) Benefits of the security certification and accreditation (C&A) initiative More consistent, comparable, and repeatable certifications of IT systems Management of Information Security, 3rd ed

SP 800-37: Guidelines for Security Certification and Accreditation of Federal Information Technology Systems (cont’d.) Benefits of the security certification and accreditation (C&A) initiative (cont’d.) More complete, reliable, information for authorizing officials Leads to better understanding of complex IT systems and associated risks and vulnerabilities, and informed decisions by management officials Management of Information Security, 3rd ed

SP 800-37: Guidelines for Security Certification and Accreditation of Federal Information Technology Systems (cont’d.) Benefits of the security certification and accreditation (C&A) initiative (cont’d.) Greater availability of competent security evaluation and assessment services More secure IT systems within the Federal government Management of Information Security, 3rd ed

Figure 7-3 Special publications supporting SP 800-37 Source: Course Technology/Cengage Learning (Based on NIST SP 800-37) Management of Information Security, 3rd ed

SP 800-37: Guidelines for Security Certification and Accreditation of Federal Information Technology Systems (cont’d.) Three-step security controls selection process Step 1: Characterize the system Step 2: Select the appropriate minimum security controls for the system Step 3: Adjust security controls based on system exposure and risk decision Management of Information Security, 3rd ed

SP 800-37: Guidelines for Security Certification and Accreditation of Federal Information Technology Systems (cont’d.) Systems certified to one of three levels Security Certification Level 1 The entry-level certification appropriate for low priority (concern) systems Security Certification Level 2 The mid-level certification appropriate for moderate priority (concern) systems Management of Information Security, 3rd ed

SP 800-37: Guidelines for Security Certification and Accreditation of Federal Information Technology Systems (cont’d.) Systems certified to one of three levels (cont’d.) Security Certification Level 3 The top-level certification appropriate for high priority (concern) systems Management of Information Security, 3rd ed

SP 800-53 Rev 3: Recommended Security Controls for Federal Information Systems and Organizations SP 800-53 is part two of the C&A project Its purpose is to establish a set of standardized, minimum security controls for IT systems addressing low, moderate, and high levels of concern for confidentiality, integrity, and availability Management of Information Security, 3rd ed

SP 800-53 Rev 3: Recommended Security Controls for Federal Information Systems and Organizations (cont’d.) SP 800-53 (cont’d.) Controls are broken into the three familiar general classes of security controls: management, operational, and technical Critical elements represent important security-related focus areas for the system Each critical element addressed by one or more security controls Management of Information Security, 3rd ed

SP 800-53 Rev 3: Recommended Security Controls for Federal Information Systems and Organizations (cont’d.) SP 800-53 (cont’d.) As technology evolves, so will the set of security controls, requiring additional control mechanisms Management of Information Security, 3rd ed

Figure 7-4 Participants in the certification and accreditation process Management of Information Security, 3rd ed

The Future of Certification and Accreditation Newer NIST documents focus less upon certification and accreditation strategy And more on a holistic risk management strategy incorporating an authorization strategy rather than accreditation Certification is being replaced by the term “security control assessment” Management of Information Security, 3rd ed

Figure 7-5 Risk management framework Source: Course Technology/Cengage Learning (Based on content from NIST Risk Management Framework, SP 800-53 Rev. 1) Management of Information Security, 3rd ed

Summary Introduction Security management practices Emerging trends in certification and accreditation Management of Information Security, 3rd ed