SECURITY MANAGEMENT PRACTICES

SECURITY MANAGEMENT PRACTICES

1. Introduction to security practices

   • Organizations strive to deliver the most value with a given level of investment—this is known as the “value proposition
     • The development and use of sound and repeatable information security (InfoSec) management practices brings organizations closer to meeting this objective
       • Executives and supervisory groups want assurance that organizations are working toward the value proposition and measuring the quality of management practices, either by comparing their programs to those of other organizations or by measuring compliance according to established standards
   • Security employment practices
     • Hiring
       • From an information security perspective, the hiring of employees is laden with potential security pitfalls The CISO, in cooperation with the CIO and relevant information security managers, should establish a dialogue with HR personnel so that InfoSec considerations become part of the hiring process
       • Job description
         • Integrating InfoSec into the hiring process begins with reviewing and updating job descriptions to include InfoSec responsibilities and screen for unwanted disclosures Organizations that provide complete job descriptions when advertising open positions should omit the elements of the job description that describe access privileges or the type and sensitivity of information to which the position would have access
       • Interviews
         • In general, information security should advise human resources to limit the information provided to the candidates on the access rights of the position When an interview includes a site visit, the tour should avoid secure and restricted sites, because the visitor could observe enough information about the operations or information security functions to represent a potential threat to the organization
       • Background check
         • A background check should be conducted before the organization extends an offer to any candidate, regardless of job level
     • Contract and employment
       • New hire orientation
         • New employees should receive an extensive InfoSec briefing.
       • On-thhe-job security training
         • Organizations should conduct the periodic SETA activities to keep security at the forefront of employees minds and minimize employees mistakes
     • Security expectation in the performance evaluation
       • To heighten information security awareness and change workplace behavior, organizations should incorporate information security components into employee performance evaluations
     • Termination issues
       • In addition to performing these tasks, many organizations conduct an exit interview to remind the employee of any contractual obligations, such as nondisclosure agreements, and to obtain feedback on the employee’s tenure in the organization
     • Personnel security practices
       • There are various ways of monitoring and controlling employees to minimize their opportunities to misuse information Separation of duties is used to make it difficult for an individual to violate information security and breach the confidentiality, integrity, or availability of information
       • Security of personnel and personnel data
         • Organizations are required by law to protect sensitive or personal employee information, including personally identifying facts such as employee addresses, phone numbers, Social Security numbers, medical conditions, and even names and addresses of family members
         • Security Considerations for Temporary Employees, Consultants, and Other Workers
           • Temporary Workers
             • Because temporary workers are not employed by the organization for which they’re working, they may not be subject to the contractual obligations or general policies that govern other employees
           • Contract Employees
             • While professional contractors may require access to virtually all areas of the organization to do their jobs, service contractors usually need access only to specific facilities, and they should not be allowed to wander freely in and out of buildings
           • Consultants
             • Consultants have their own security requirements and contractual obligations They should be handled like contract employees, with special requirements, such as information or facility access requirements, being integrated into the contract before they are given free access to the facility
           • Business partner
             • Businesses sometimes engage in strategic alliances with other organizations to exchange information, integrate systems, or enjoy some other mutual advantage A prior business agreement must specify the levels of exposure that both organizations are willing to tolerate

2. Information Security Performance Measurement

   • InfoSec Performance Management
     • Organizations use three types of measurements: Those that determine the effectiveness of the execution of InfoSec policy, most commonly issue-specific security policies Those that determine the effectiveness and/or efficiency of the delivery of InfoSec services, whether they be managerial services, such as security training, or technical services, such as the installation of anti-virus software Those that assess the impact of an incident or other security event on the organization or its mission
   • Building the Performance Measurement Program
     • Even with strong management support, an information security measures program as part of a security performance management program must be able to demonstrate value to the organization One of the most popular among the many references that support the development of a process improvement and performance measures is the Capability Maturity Model Integrated (CMMI) from the CMMI Institute at Carnegie Mellon
   • Specifying InfoSec Measurements
     • One of the critical tasks in the measurement process is to assess and quantify what will be measured While InfoSec planning and organizing activities may only require time estimates, you must obtain more detailed measurements when assessing the effort spent to complete production tasks and the time spent completing project tasks
   • Collecting InfoSec Measurements
     • Measurements Development Approach
       • One of the priorities in building an information security measurement program is determining whether these measures will be macro-focus or micro-focus, or some combination thereof Macro-focus measurements examine the performance of the overall security program Micro-focus measurements examine the performance of an individual controller or group of controls within the information security program
     • Measurement Prioritization and Selection
       • Because organizations seem to manage what they measure, it is important to ensure that individual metrics are prioritized in the same manner as the processes they measure This can be achieved with a simple low-, medium-, or high-priority ranking system, or a weighted scale approach
     • Establishing Performance Targets
       • Performance targets make it possible to define success in the security program; many InfoSec performance measurements targets are represented by a 100% target goal Other types of performance measures, such as those used to determine relative effectiveness or efficiency or impact of information security on the organization’s goals, tend to be more subjective and require solid native and subjective reasoning
     • InfoSec Performance Measurement Implementation
       • Once developed, information security performance measurements must be implemented and integrated into ongoing information security management operations For the most part, it is insufficient to simply collect these measures once Performance measurement is an ongoing, continuous improvement operation
     • Reporting InfoSec Performance Measurements
       • In most cases, simply listing the measurements collected does not adequately convey their meaning In addition, you must make decisions about how to present correlated metrics The CISO must also consider to whom the results of the performance measures program should be disseminated, and how they should be delivered

3. Benchmarking

   • Organizations usually generate a security blueprint by drawing from established security models and frameworks
     • Using this method, which is called benchmarking (or external benchmarking), you compare your organization’s efforts to those of other organizations you feel are similar in size, structure, or industry
       • Benchmarking can also be used as an internal tool to compare current performance against past performance and to look for trends of improvement or areas that need additional work
   • Standards of Due Care/Due Diligence
     • For legal reasons, certain organizations may be compelled to adopt a stipulated minimum level of security, as to establish a future legal defense they may need to verify that they have done what any prudent organization would do in similar circumstances; this is known as a standard of due care Due diligence requires that an organization ensure that the implemented standards continue to provide the required level of protection
   • Recommended Security Practices
     • Security efforts that seek to provide a superior level of performance in the protection of information are called recommended practices, whereas security efforts that are considered among the best in the industry are termed best security practices (BSPs), although the terms are used interchangeably
   • Selecting Recommended Practices
     • Industries that are regulated by laws and standards and are subject to government or industry oversight are required to meet the regulatory or industry guidelines in their security practices For other organizations, government and industry guidelines can serve as excellent sources of information about what is required to control InfoSec risks
   • Limitations to Benchmarking and Recommended Practices
     • The biggest barrier to benchmarking in information security is that many organizations don’t share results; a successful attack is often perceived as an organizational failure, and is kept secret, if possible An increasing number of security administrators are joining professional associations and societies like ISSA and ISACA, and sharing their stories and lessons learned
   • Baselining
     • A specific subset of benchmarking is baselining, also known as internal benchmarking, in which the organization conducts an initial assessment of current performance (known as a baseline) In InfoSec, baseline measurements of security activities and events are used to provide a basis for comparison of the organization’s current security performance against future performance
   • Support for Benchmarks and Baselines
     • People
       • Do you perform background checks on all employees with access to sensitive data, areas, or access points? Would the average employee recognize a security issue? Would they choose to report it? Would they know how to report it to the right people?
     • Processes
       • Are enterprise security policies updated on at least an annual basis, employees educated on changes, and consistently enforced? Does your enterprise follow a patch/update management and evaluation process to prioritize and mediate new security vulnerabilities? Are the user accounts of former employees immediately removed on termination?
     • Technology
       • Is every possible route to the Internet protected by a properly configured firewall? Is sensitive data on laptops and remote systems encrypted? Are your information assets and the systems they use regularly assessed for security exposures using a vulnerability analysis methodology?
   • ISO Certification
     • Organizations that do not do business with the federal government and would not be concerned with NIST certification and accreditation (C&A) procedures may still desire to seek a recognized level of certification of their security management systems
       • While ISO does not directly conduct certification assessments or issue certificates, it does authorize third parties to perform these tasks