All right, define,
implement, manage, and maintain an information security governance program.
This is an ongoing deal.
You don't just set up your security one time and be like, Yeah, roll it out.
It's constantly evolving, it's constantly
being updated, and it's related directly to the change in your environment.
There's certain aspects of information security, disaster
recovery, for example, that is directly related to your environment.
A good way to ensure that your security program is updated or reviewed on a
regular basis is to tie it into change management or change control.
In change control, we ensure orderly change, no security violations and so
forth by implementing a process whenever we're going to make a change to anything.
By making a change to a system, you may
need to review your security policy, your controls, your disaster recovery, your
business continuity, and it triggers a review of all of this documentation.
The whole security policy and governance program is about laying out the specifics
ahead of time and documenting it, period, writing it down.
So you've got the book to follow.
If you're going to go by the book and do everything in our organization by the
book, you have to write the book to begin with.
So a business driver is a condition
process requirement or other concern that influences the way in which an
organization directs or manages activities.
All right, so drivers are reasons for, they denote the need for, etc.
The security professional must understand
why an organization exists and how it conducts business
before the process of developing information security governance can begin.
So wise man once said, organizations are
in business to be in business, not to be secure.
Security is a requirement, but not at the expense of the business entity.
So typically measure all this how dollars and cents.
What does a company do?
I've mentioned this before, it generates revenue, it makes money.
By making money, that's the lifeblood that
drives the organization and allows it to accomplish all of its other objectives.
But first and foremost, you have to have cash flow of driving the whole thing.
Employees have to be paid, vendors have to
be paid, products have to be manufactured, etc.
If that is dying, so is the organization.
Whatever you employ shouldn't impede business processes to a reasonable degree.
We'll talk more about that.
We'll talk about management, ultimately
deciding on what's an acceptable level of security and risk and so forth.
First off, you have to understand what the company does and why they do it.
Then you have to develop the security
program to secure that functionality, not to oppose it.
Ultimately, when you weigh
acceptable risk, ownership, and so forth, that's always, again, senior management.
Form of business organization.
Business organizations can exist in different scopes.
You have a proprietorship, which is one owner, one business.
Myself, got my consulting business, I'm a proprietorship, sole entity.
Partnership, where you've got one or more
partners that control or make decisions about the company's direction.
And a Corporation, where you've got a governing board of directors and
management structure and so forth that drives the direction of the business.
So it's hierarchical structure,
the industry in which it operates, its maturity all work together to influence
the product of corporate governance in the organization.
Each approach is a unique influence on the
scope and complexity of governance within an organization.
Industry.
The industry in which an organization operates affects corporate governance.
Absolutely. We just got done talking about a bunch of
industry specific regulations that you need to comply with.
Limited set of industries is the subject of most discussions about governance,
public, retail, information, and financial services.
However, broad variety of industries
exist, each with their own concerns and industry specific regulations I just
talked about that, that drive their governance decisions.
Organizational maturity.
Maturity models are a measurement of
how optimally your organization runs or software development processes.
The first time I was introduced to a
capability maturity model, it's Carnegie Mellon's software
capability maturity model, and it deals with how software is developed.
So we're going to start off with that as
the example because that's where I started.
I'll start you there as well.
In initial, processes are unpredictable, poorly controlled, and reactive.
So in software development, for example,
I don't really do anything the same way every time.
Just do this, do that.
But there's no consistency.
In Managed, processes are characterized, but it's often reactive.
In Managed, you actually have some
procedures you may perform in different projects.
You may do something the same way multiple times, but it's not guaranteed.
In defined processes are characterized throughout the organization and proactive.
In a defined, you're actually
specifically doing the same types of activities in every project.
The maturity of your process is critical to the expectation of
reliability and consistent results of the process, whatever that may be.
And quantitatively managed processes are measured and controlled and proactive.
Now you're actually measuring the performance of the project and you're
using that data to feed in the process improvement.
Then in optimizing, you're focusing on
process improvement and enhancing existing processes.
Now you're measuring, now you're
optimizing and feeding it in and doing continuous process improvement.
You'll see that referenced, again, in a
couple of different software maturity models.
But overall, we're applying this to organizational maturity.
In my little one man show, there are some things I do the same way every time,
and there's some things I do shoot from the hip.
In my course deliveries, I follow the
same basic premise, the framework building on the first pass, exam preparation, come
back for second and third passes, but each course is a little bit different.
I am constantly updating, I'm constantly
refining based on feedback and success in exams and so forth.
In my consulting side of things, I do have specific reporting templates,
specific procedures, specific packages for vulnerability assessments or pen tests or
whatever that are completed in a specific prescribed order.
That is product development at the same time.
It's always being optimized because
finding new, improved ways to run scans and so forth, examine attack surface.
There's always a degree of optimizing a process improvement that goes into that.
But the whole idea is, once you've developed that process or procedure and
it's giving consistent results, you have a lot of reason to not use it and you have
every reason to then look for enhancements from moving forward.
I'm a big fan of process and measurable performance metrics.
If something is not working, it needs to be adjusted.
Information security drivers.
Information security is again protecting
the information your organization requires to do business.
But if you overprotect, that can cause
actually a flavor of, say, denial of service.
If the authentication is too strong, people are being locked out, or your
encryption algorithms are preventing access to required data.
Denial of service prevention is detecting
a tactical attack that doesn't happen or IDS and you're getting shut down.
So the alignment with the business compliance and privacy are among the most
important information security drivers an organization must address.
We keep using the term alignment because these are actually opposing objectives.
You need to bring them into alignment.
So organizational alignment, one of the
most important drivers for information security governance.
You can achieve harmony and alignment between business and security by mapping
the governance to the foundations provided by corporate governance.
Managing the enterprise information security compliance program.
Here are all the layers that are involved
in an information security management system or framework.
So you got compliance and governance.
Notice it's lining up side by side here.
The security policy, definition of roles and responsibilities,
guidelines, standards and frameworks, which again make the policy happen.
Risk management, huge.
Now, a lot goes into risk management.
Lots of calculations, lots of scenarios, lots of quantitative and qualitative
measurements, lots of reporting, lots of submission to management for approval,
the implementation of the technical security architecture, asset
classification, which we're going to talk about.
Classification is laying out specifically levels of sensitivity or criticality of
data, and then assigning a classification level to every type of data in the
organization, and then assigning security best practices to those classifications.
And then by default,
when a piece of information gets a classification, it automatically inherits
the security mechanisms that are prescribed for that classification.
Security management operations,
business resilience, which deals with business continuity and disaster recovery,
extremely important, often outdated and stale.
Training and awareness, huge.
Training and awareness doesn't happen.
Employees don't know what proper procedure is and they don't follow it.
And again, you can have the best security policy framework, policies, procedures
that's ever been developed, most concise, precise, etc.
But humans still have to follow it.
And if they don't know what to follow, they don't follow it.
Security goes right out the window.
Policy and procedure that's not being carried out is useless.
And then security metrics and reporting.
Now, again, we're going to talk about a
lot of these again a little bit later on, but this is how they all tie together in
an enterprise information security compliance program.