1. Information Security Forum to an Information Security Plan
From an ISO17799 Audit
to an Information Security Plan
(the 100 day plans - part 2)
By Jim Reiner
Sacramento County
July 31, 2007

2. The end-goal: a formal information security program
Governance
Security Committee & Professionals
Employee
Training
Security
Controls
Monitoring
&
Auditing
Information
Classification
Policy and Procedures
Business Continuity & Disaster Planning
Information Risk Management

3. My focus as the Information Security Officer:
Articulate the overall strategy
My Approach:
Staging 100 day plans for an immediate focus while achieving longer term objectives.
3rd 100 days
May-August
Select performance metrics
Build a security business plan
Put in place security training
1st 100 days
Oct-Jan
Survey managers & staff
Set a goal and a strategy
Select a security audit checklist
2nd 100 days
Jan-April
ISO info security audit
Update security intranet site
ID who does what relative to security
4th 100 days
Aug-Nov
Publish updated policies
Budget for the Security Program
Manage the security program

4. Packet provided to assist with ideas, approaches
50 ISF Jan
60 CCISDA Mar
80 GTC May
All figured out? No, but as I mingle with security folks and their challenges I wondered…

5. Audit
IS Plan
IS Pgm

6. We used the ISO 17799 Checklist
Information Security Management Audit Check List
Governance
Information Security Professionals
Employee Security
Training
Security
Controls
Monitoring
&
Auditing
Policies, Standards, and Procedures
Business Continuity & Disaster Planning
Information
Classification
Information Risk Management
Audit

7. ISO 17799 Audit Initial Results
10 audit topics – 127 individual items 32 57 38

8. Audit Final Results 77 21
High
Risk 50

9. Organizing the initiatives
Administrative
Physical
Technical

10. IS Plan
1 of 4

11. Value – Risk Mitigation Level of Effort – Impact on OCIT
Low High
IS Pgm
Low High
Level of Effort – Impact on OCIT

12. Value – Risk Mitigation Level of Effort – Impact on OCIT
Ratings of 2007 OCIT Security Plan Initiatives List 1 2
Remote data
access
Laptop
encryption
Security
awareness
Shredding DR
plans
ISM V.4
Emergency
response plan
Hard key
mgmt
Pandemic
flu plan
Value – Risk Mitigation
Low High
encryption
RFP
standards
Test
data
Security
metrics
Loading
dock
Application
security
OCIT compliance
Network
Access Ctl
Incident reporting
MPOE
security
Security architecture 3 4
Bureau
procedures
OCITSC
charter
Login
banners
Vendor
access
Confidentiality
agreements
Panic
button
Offsite
data
Asset
inventory
Parcel
inspection
Clean desks
Backup
encryption
Low High
Level of Effort – Impact on OCIT
Completed
In progress
Not started

14. Network Vulnerability Assessment and Mitigation
A CASE STUDY
This is a case study about Sac county as well as VA
Chas Lesley – 10 yrs service, SPT, enterprise security engineer and architect
Mike Walters -

15. Additional information we think you will find helpful.
Not all covered here.