OS 3 dis and paper, BD dis 11
winterishere
Week3OS3.pptxSecurity Policies and Implementation Issues
Lesson 3
Information Security Policy Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page ‹#›
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
1
People Are Key
People must understand key concepts of security policies
Makes application of policy easier in unanticipated circumstances
People must be motivated to follow policy
Pride
Self-interest
Success
Page ‹#›
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
8/31/2016
2
People Are Key (Continued)
Page ‹#›
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
8/31/2016
3
Personality Types
People may be more than one personality type
Types blend but one may emerge as dominant
Leverage strengths and weaknesses during implementation
Page ‹#›
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
8/31/2016
4
Commander
Drifter
Attacker
Pleaser
Performer
Avoider
Analytical
Achiever
Demanding, forceful
Laid back, lack discipline
Angry, critical, egotistical
Kind, thoughtful, self-sacrificing
Witty, charming, focal point
Dependable, consistent, avoid
extra work
Disciplined, precise, detail-oriented
Result-oriented
Leadership, Values, and Ethics
Leaders
Demonstrate ethical behavior
Require ethical behavior from employees
Recognizes and works with various personality types
Works with others to achieve goals
Works with others to gain support for and adherence to security policies
Page ‹#›
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Values
Goals
Training
Support
Reward
Organizational Structure
Affects employee behavior
Provides insight into management priorities
Influence and authority of the Information Security Officer based on position in the org chart
Down in the IT department, not much influence and authority
Reporting directly to CFO or CIO, more influence and authority
Page ‹#›
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
8/31/2016
6
Typical Organizational Chart
Page ‹#›
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
8/31/2016
7
CISO Reporting Directly to CFO
Page ‹#›
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
8/31/2016
8
CISO Organizational Chart
Page ‹#›
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
CISO role appears several layers deep.
8/31/2016
9
Flat Organizations: Positive Aspects
Limited number of layers between top and bottom employee ranks
Leaders are close to the workers that deliver products and services
Faster decision making
More confidence to innovate
Security policies are not abstract
Leaders responsible for product and services
Decentralized authorities
Page ‹#›
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
8/31/2016
10
Challenges for Flat Organizations
Span of control can become too wide
No time to bring every problem to management for resolution
Need high caliber teams comfortable with independent decision making
May have problems with conflicting statements to regulators by the subordinate and senior leadership
When defining a security policy, must decide clearly how issues are to be identified, catalogued, debated, and escalated
Page ‹#›
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
8/31/2016
11
Hierarchical Organizations
Page ‹#›
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Who Benefits from Hierarchical Organizations
Large organizations
Senior leaders are more detached from day-to-day operations
Messages from senior leaders have to be reinforced through all management layers
Advantages of a Hierarchical Model
Hierarchy of specializations
Disadvantages
Communication lines are more clearly defined
Depth of knowledge in a subject area tends to be greater
Matrix relationships can be complex
Lack of accountability
Communication breakdowns
Too many touchpoints and personalities must be engaged
Overcoming User Apathy
Engage leadership and adjust implementation strategy to include role-based explanation of policy
Reinforce importance and value of information security through ongoing awareness program
Leadership should set the expectation that policy will be followed and monitor compliance
Increase involvement by introducing redundancy – don’t rely on a single individual whenever possible
Leadership should seek opportunities to recognize and reward compliance
Page ‹#›
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
8/31/2016
13
Relevance of Executive Management Support
Page ‹#›
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Data supporting policy implementation aligned with business objectives
Business objectives identified align with compliance laws or regulations required to conduct business
Security policy implementation can expect executive management support
8/31/2016
14
Data aligns with business objectives
Business objectives align with compliance regulations
Security policy implementation can expect executive management support
Lack of Executive Management Support
Page ‹#›
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Data supporting policy implementation not aligned with business objectives
Business objectives identified do not align with compliance laws or regulations required to conduct business, or are unclear and have insufficient support from leadership
Security policy implementation can expect to fail without executive management support
8/31/2016
15
Data does not align with business objectives
Business objectives do not align with compliance regulations, or are unclear
Security policy implementation can expect to fail without executive management support
Policy Implementation Steps
Adapted from “Kotter’s Eight-Step Change Model.”
Page ‹#›
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
8/31/2016
16
Roles
Page ‹#›
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Information security officer
Accountable for identifying, developing, and implementing security policies.
Accountable to ensure corresponding security controls are designed and implemented.
Executive
A senior business leader accountable for approving security policy implementation.
Responsible for driving the security message within an organization and ensuring the security policy implementation is given appropriate priority.
Compliance officer
Accountable for monitoring adherence to laws and regulations.
Data owner
Approves access rights to information.
Data manager
Individual responsible for establishing procedures on how data should be handled.
Ensures data is properly classified.
Data custodian
Responsible for the day-to-day maintenance of data.
Back up and recover data as needed.
Grant access based on approval from the data owner.
Data user
End user of an application.
Accountable for handling data appropriately.
Auditor
Accountable for assessing the design and effectiveness of security policies.
May be internal or external to the organization.
May offer formal opinions in writing.
8/31/2016
17
Information Security Officer
Executive
Compliance Officer
Data Owner
Data Manager
Auditor
Data Custodian
Data User
Policy Framework Components
Page ‹#›
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
8/31/2016
18
Policy
Standards
Procedures
Guidelines
Defines how an organization performs and conducts business functions and transactions with a desired outcome
An established method implemented organization-wide
Steps required to implement a process
A parameter within which a policy, standard, or procedure is suggested
Common Frameworks
Control Objectives for Information and related Technology (COBIT)
ISO/IEC 27000 series
National Institute of Standards and Technology (NIST) Special Publications
Example: SP 800-53, “Recommended Security Controls for Federal Information Systems and Organizations
Page ‹#›
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
8/31/2016
19
Access Control Policy Branch
Page ‹#›
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Access Control Policy Branch of a Policy and Standards Library
8/31/2016
20
Creating a Security Policy Framework
Page ‹#›
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Set a budget
Assemble a team
Select a commonly accepted framework as a foundation
- COBIT, ISO/ISC 27000 series, NIST SPs
Use a content management system, if possible
Cross-reference your security documents with standards
Coordinate development with other departments in the organization
8/31/2016
21
Set a budget
Assemble a team
Select a basic framework
Creating a Security Policy Framework (Continued)
Page ‹#›
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Set a budget
Assemble a team
Select a commonly accepted framework as a foundation
- COBIT, ISO/ISC 27000 series, NIST SPs
Use a content management system, if possible
Cross-reference your security documents with standards
Coordinate development with other departments in the organization
8/31/2016
22
Use a content management system
Cross-reference standards
Coordinate with other departments
Roles Related to a Policy and Standards Library
Page ‹#›
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
CISO
- Establishes and maintains security and risk management programs for information resources
Information resources manager
- Maintains policies and procedures that provide for security and risk management of information resources
Information resources security officer
- Directs policies and procedures designed to protectinformation resources; identifies vulnerabilities,develops security awareness program
Owners of information resources
- Responsible for carrying out the program that uses the resources. This does not imply personal ownership. These individuals may be regarded as program managers or delegates for the owner.
Custodians of information resources
- Provide technical facilities, data processing, and other support services to owners and users of information resources
Technical managers (network and system administrators)
- Provide technical support for security of information resources
Internal auditors
- Conduct periodic risk-based reviews of information resources security policies and procedures
Users
- Have access to information resources in accordance with the owner-defined controls and access rules
8/31/2016
23
CISO
Information resources manager
Information resources security officer
Owners of information resources
Roles Related to a Policy and Standards Library (Continued)
Page ‹#›
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
CISO
- Establishes and maintains security and risk management programs for information resources
Information resources manager
- Maintains policies and procedures that provide for security and risk management of information resources
Information resources security officer
- Directs policies and procedures designed to protectinformation resources; identifies vulnerabilities,develops security awareness program
Owners of information resources
- Responsible for carrying out the program that uses the resources. This does not imply personal ownership. These individuals may be regarded as program managers or delegates for the owner.
Custodians of information resources
- Provide technical facilities, data processing, and other support services to owners and users of information resources
Technical managers (network and system administrators)
- Provide technical support for security of information resources
Internal auditors
- Conduct periodic risk-based reviews of information resources security policies and procedures
Users
- Have access to information resources in accordance with the owner-defined controls and access rules
8/31/2016
24
Custodians of information resources
Technical managers
Internal auditors
Users
Information Systems Security Considerations
Page ‹#›
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Unauthorized Access to and Use of the System
Unauthorized Disclosure of the Information
Disruption of the System or Services
Modification of Information
Destruction of Information Resources
