Presentation on theme: "Start With A Great Information Security Plan!"— Presentation transcript:
1 Start With A Great Information Security Plan! Tammy L. Clark, CISO, Georgia State UniversityWilliam Monahan, Lead Information Security Administrator, Georgia State University
2 Why ISO 17799?The ISO 17799:2005 standard lends itself well to developing and defining information security program initiatives in a higher education environmentISO/IEC 17799:2005 provides best practice recommendations (133 controls) on information security management for use by those who are responsible for initiating, implementing or maintaining information security management systems. Information security is defined within the standard as the preservation of:Confidentiality (ensuring that information is accessible only to those authorized to have access)Integrity (safeguarding the accuracy and completeness of information and processing methods) andAvailability (ensuring that authorized users have access to information and associated assets when required).ISO/IEC is an information security standard published and most recently revised in 2005 by the International Organization for Standardization and the International Electrotechnical Commission.It is entitled Information technology - Security techniques - Code of practice for information security management. The current standard is a revision of the version published in 2000, which was itself a word-for-word copy of the British Standard BS :1999.
3 Georgia State University’s Information Security Plan Two years ago, our CIO was tasked by the Board of Regents in Georgia to submit an information security plan. We elected to provide a plan that was both comprehensive and holistic, and we chose to frame it around the ISO standard, as it advocates a very strategic, risk management based approachLooking back, this was a very ambitious undertaking that first year, since we only have three dedicated information security staff resources, and examining all of the recommended controls in the ISO was a very time consuming and (at times) difficult processWe then went a few steps further and made an assessment of the current state of security in each domain area and defined prioritized objectives to accomplish each year. Each year, we modify our plan to reflect changing priorities and demandsWe are currently in the planning stages of integrating ITIL (IT Infrastructure Library) and COBIT (Control Objectives for Information and related Technology)
4 12 Domains of ISO 17799:2005 Risk Assessments Security Policies Information Security OrganizationAsset ManagementHuman ResourcesPhysical and Environmental SecurityCommunications and Operations ManagementAccess ControlInformation Systems Acquisition, Development, and MaintenanceInformation Security Incident ManagementBusiness Continuity ManagementCompliance
5 Benefits of Using the ISO 17799 Framework It’s comprehensive and requires an in depth analysis of business and IT processes. A great deal of time and effort will go into this initially, but when all is said and done, you will have prioritized action plans you can use to make immediate improvements.You will have a great opportunity to bridge the communication gap that often exists between information technology and business/academia. You can begin to erase the perception that information security only affects information technology, as you integrate your information security initiatives into business and academic processes and initiatives.You can use this plan to clarify to upper management what measures need to be taken at your campus to comply with university policies and legislative requirements (HIPAA, GLBA, PCI, etc.) that often require a very complex information security infrastructure.You can effectively demonstrate to your university leadership constituency that instituting adequate preventative controls and measures is necessary in order to prevent data leakages and compromises of institutional assets.
6 Using ISO 17799:2005 to Develop an Information Security Plan Overview of domains and objectivesIdeas on assessing the current state of security at your universityComing up with proposed action plan itemsBuilding out a comprehensive appendix with supporting documentationIntegrating ITIL and COBIT objectives (optional)
7 Executive SummaryState that senior level management support and validation of your information security program is critical to its successAmplify how accomplishing the roadmap objectives you’re outlining in this plan will directly impact and enable your university’s strategic goals—academic, business, and information technology.Stress that this plan clearly demonstrates the need to institute an evolving cycle of continuous improvements in areas such as regulatory compliance, preservation of the confidentiality and integrity of university data, and availability of the critical business and information technology infrastructure
8 Opening Sections of Your Plan Scope:Applicability (Staff, faculty, students, affiliates, third parties)Structure (ISO 17799:2005)Explanation of the format (14 domains)Annual validation process (continuous cycle of improvement, review, and acceptance/adoption)Terms and definitions
9 Risk Assessment and Treatment Two major areas: Assessing Security Risks and Treating Security RisksRisk assessments should identify, quantify and prioritize risks against criteria for risk acceptance and objectives relevant to the organizationAssess the state of security by addressing competencies or deficienciesCome up with proposed action items—policies, procedures, initiatives to improve upon current state of securityProvide any references used to determine aboveExamples:State of Security: Adoption of Risk Assessment Policy in November 2005; Information security risk assessments performed using the methodology outlined in National Institute of Science and Technology (NIST) SP Risk Management Guide for Information Technology Systems, and incorporate relevant university policies and procedures.Proposed Action Items: Develop standard criteria that departments can use in conducting preliminary analysis of potential IT system candidates; Develop supporting documentation and procedures to support the risk assessment policy and for periodic reassessments of systems and dataImpact: The Risk Assessment policy adopted in November 2005 has led to approximately 50 risk assessments being conducted in 2006 so far, that led to mandatory information security controls, policies, procedures and guidelines being put in place to protect the university’s information technology infrastructure.
10 Security Policy Information Security Policies Information Security policies provide direction and support for information security iaw university requirements and relevants laws and regulationsAssess the state of security by addressing competencies or deficienciesCome up with proposed action items—policies, procedures, initiatives to improve upon current state of securityProvide any references used to determine aboveState of Security: The Statutes of Georgia State University provide for the internal governance of this UniversityProposed Action Items: Establish a schedule and process for periodic review; modify security awareness course to include domain on security policies, Adopt a policy mandating all students and staff complete security awareness course; Coordinate with internal audit to focus attention on areas of concern in regards to policy complianceImpact: Conducting risk assessments of university business and IT initiatives has led to the revision or institution of new information security policies that better define the responsibilities of those who manage information technology assets and information, as well as numerous procedures and guidelines that specify what needs to be done to safeguard it from unauthorized access and usage
11 Organization of Information Security Two major areas: Internal organization and External partiesA robust information security infrastructure must be developed that includes incident response activities, security awareness education, security policies, third party compliance with university policies and requirements, and the deployment of effective security solutions that deter the activities of unauthorized personsAssess the state of security by addressing competencies or deficienciesCome up with proposed action items—policies, procedures, initiatives to improve upon current state of securityProvide any references used to determine aboveState of security: 2000—Information Security department created and a number of initiatives developed to provide the campus with enhanced resources, knowledge, and leadershipProposed Action Plan Items: Reassess current information security needs of university; Investigate training and procedures to allow assumption of routine tasks by other elements of central IT org; Develop procedures for operation of CSIRT; Develop and maintain security architecture; develop and implement criteria and processes for eval of risks associated with third party accessImpact: Management commitment is critical in order to acquire funding and staffing resources. A CISO and dedicated, highly trained information security resources are necessary to manage and maintain a successful information security program.
12 Asset ManagementTwo major areas: Responsibility for Assets and Classification GuidelinesInventories and classification of assets helps ensure that effective asset protection takes place, is an important aspect of risk management, and may also be required for other business purposes such as health, safety, and federal regulations.Assess the state of security by addressing competencies or deficienciesCome up with proposed action items—policies, procedures, initiatives to improve upon current state of securityProvide any references used to determine aboveState of security: Property Control Policy; Data Stewardship and Access PolicyProposed Action Items: Implement asset tracking for critical information technology equipment that falls outside span of control of Property Control Policy; Review procedures and policies governing control of access to sensitive information and review/approval of continuing accessImpact: In order to get your arms around what needs to be protected, this is a critical step!
13 Human Resources Security Three major areas: Prior to employment, During employment, and Termination or change of employmentThroughout the employment cycle (hiring, current status, and termination/changes) information security procedures must be implemented to reduce the risks of human error fraud, and misuse of university resourcesAssess the state of security by addressing competencies or deficienciesCome up with proposed action items—policies, procedures, initiatives to improve upon current state of securityProvide any references used to determine aboveState of Security: Credit checks, criminal background investigations, defining information security related job duties in position descriptions, security awareness training requirements, identity management initiativesProposed Action Plan items: Incorporate information security duties into job descriptions; mandated security awareness training; utilize IDM to assure appropriate access and authorization to university information and IT resourcesImpact: Implementing an identity management system to provision and deprovision id’s in a timely manner; online class has made it easy and convenient to administer security awareness training, which is critical for the campus user population
14 Physical and Environmental Security Three major areas: Secure areas, Equipment security, General controlsImportant business information processing facilities should reside in secure areas with appropriate security barriers and entry controls, and the protection applied should be commensurate with risksAssess the state of security by addressing competencies or deficienciesCome up with proposed action items—policies, procedures, initiatives to improve upon current state of securityProvide any references used to determine aboveState of security: Restrict physical entry into the Data Operations Center; prevent loss, damage or compromise of information technology assets; minimize exposure to flooding unauthorized access, fire, corrosive agents, and potential hazardsProposed Action items: Approve Network Operation Center Access Policy and Telecomm Room Access and Key Policy; install monitoring and recording equipment for tracking environmental changes; Implement necessary changes to mechanical systems within the NOCImpact: Part of the process of analyzing this particular domain area is assessing power and A/C in the network operations center—the ISO standard really leads to you taking an indepth view of the controls in each domain area
15 Communications and Operations Management 10 major areas: Operational procedures and responsibilities, Third party service delivery management, System planning and acceptance, Protection against malicious and mobile code, Back-up, Network security management, Media handling, Exchange of information, Electronic commerce services, MonitoringPolicies for the management and operation of all university information processing facilities should be established, codified, and communicated to all employees and third parties doing business with the university in order to ensure correct and secure operation. Capacity planning and back-up strategies are important, as is proper handling of media disposal and storage.Assess the state of security by addressing competencies or deficienciesCome up with proposed action items—policies, procedures, initiatives to improve upon current state of securityProvide any references used to determine aboveState of security: Knowledgebase in the NOC and HelpCenter; Central database repository for disparate data sources to dynamically record all devices; CSIRT mobilization; performance of risk assessments; devising acceptance criteria for new centrally managed information systems, et al; implement controls to prevent and detect unauthorized or malicious software (defense in depth); Adequate back-up plans and facilities; security management controls—centralized and distributed; Secure Disposal or Re-Use of Information Systems Equipment; System Acceptable Use and Security Policy; Compliance with PCI and CISP; continuous, dynamic network monitoring from a central locationProposed Action Items: Consolidated knowledge Base; Critical Outage procedures; Standards and procedures for implementing third party service delivery solutions; develop and implement IT Infrastructure Master Plan and IT Project Portfolio review; select and deploy additional security technologies to bolster internal defenses; conduct reviews of back-up strategies on system by system basis; review through data steward structure the procedures for approving and protecting exchange of sensitive university data between systems and to individual end users; develop standard methodology for processing credit card transactions; examine feasibility of single monitoring application or applianceImpact: Codify all your IT and information security procedures—an area where ITIL and COBIT can be integrated effectively
16 Access ControlEight major sections: Business requirement for access control; User access management, User responsibilities, Network access control, Operating system access control, Application and information access control, Monitoring system access and use, Mobile computing and telecommutingAccess to university information and business processes should be controlled on the basis of business and security requirements according to university policies and procedures. Users must be made aware of their responsibilities in this process and standard and procedures developed and implemented to assist in mitigation of risks.Assess the state of security by addressing competencies or deficienciesCome up with proposed action items—policies, procedures, initiatives to improve upon current state of securityProvide any references used to determine aboveState of security: In accordance with existing policy, all university information is used with appropriate access levels and sufficient assurance of integrity, confidentiality, and compliance with laws and statutes; IDM, Minimum Information Security Environment Policy and Information Systems Ethics Policy; Password complexity controls that adhere to Sensitive Information Protection Policy and supporting procedures; Remote Access Policymandating use of VPN and approved methods; procedures for restricting access to production environments based on business requirements of functional customer and control by security administrators; Wireless Access Policy mandating use of VPNProposed action items: IDM implementation; mandated password complexity in sensitive areas assured by technical controls; network access authentication requirements assured by technical controlsImpact: Tightening up the controls on accessing information on your network—including third parties doing business with the university and remote users
17 Information Systems Acquisition, Development and Maintenance Six major sections: Security requirements of information systems, Correct processing in applications, Cryptographic controls, Security of system files, Security in development and support processes, Technical vulnerability managementSecurity reviews are necessary to ensure that controls and security requirements become a part of the overall design process. Cryptographic controls are necessary to assure confidentiality, authenticity, and integrity of sensitive information at risk. Technical vulnerability management systems should be implemented in an effective, systematic, and repeatable way with measurements taken to confirm effectiveness.Assess the state of security by addressing competencies or deficienciesCome up with proposed action items—policies, procedures, initiatives to improve upon current state of securityProvide any references used to determine aboveState of security: Information Risk Assessment policy approved in Nov 2005; Data Stewardship and Access Policy; Remote Access policy; institution of standard cryptographic controls; acquisition of multiple vulnerability assessment technologies used to scan devices in support of university policies and information security initiativesProposed Action items: Continued research of vulnerability assessment technologies that can be integrated with various security monitoring systemsImpact: Support the risk assessment process in which you analyze information technology projects and business processes in seeking to implement consistent, effective controls
18 Information Security Incident Management Two major sections: Reporting information security events and weaknesses and Management of information security incidents and improvementsFormal event reporting and escalation procedures should be in place. All employees, contractors, third party users should be made aware of the procedures for reporting different types of events and weaknesses that might have an impact on the security of organizational assets to the designated POC. Responsibilities and procedures should be in place to handle information security events weaknesses effectively once reported. A process of continuous improvement should be instituted to monitor, respond, evaluate and manage information security incidents.Assess the state of security by addressing competencies or deficienciesCome up with proposed action items—policies, procedures, initiatives to improve upon current state of securityProvide any references used to determine aboveState of security: Incident Response Policy and associated procedures; modification of technical controls routinely to mitigate threats.Proposed action items: Continued development of CSIRT procedures as needed; Training and simulation of events conducted with CSIRT membersImpact: Face it—criminal activities using computers are on the upswing and the CSIRT, effective policies and procedures, as well as trained staff members with forensics knowledge, are all critical in order to properly handle forensics and evidence seizures from a legal standpoint
19 Business Continuity Management Information security aspects of business continuity managementIn order to prevent disruption to business activities, as well as protect critical business processes from the effects of major failures or disasters, the development of a comprehensive University Disaster Recovery/Business Continuity Plan is necessary. The plan should call for risk analyses to determine the impact of business disruptions, identify priorities for testing, maintenance and activation, as well as outline specific processes to follow in the event of disruptions, including identification of the individuals or departments responsible for execution of each component of the plan.Assess the state of security by addressing competencies or deficienciesCome up with proposed action items—policies, procedures, initiatives to improve upon current state of securityProvide any references used to determine aboveState of security: Development of a comprehensive Disaster Recovery/Business Continuity planState of security: Funded and staffed commitment to Business Continuity plan and associated Disaster Recovery PlanImpact: Having a business continuity plan is critical
20 ComplianceThree major areas: Compliance with legal requirements, Compliance with security policies and standards, and technical compliance, System audit considerationUniversities are obligated to protect information types defined under FERPA, GLBA, HIPAA, Digital Millennium Act, CC 42CFR Part 73, ECPA and various other state and federal statutes or guidelines. It is also necessary to ensure compliance of information technology systems with university policies and standards. It is desirable to maximize the effectiveness of system audits and to minimize business disruptions due to vulnerability and/or penetration tests performed on university information technology resources.Assess the state of security by addressing competencies or deficienciesCome up with proposed action items—policies, procedures, initiatives to improve upon current state of securityProvide any references used to determine aboveState of security: Secure Computing Initiative that mandates specified levels of protection to systems and assets that fall under compliance requirements; risk assessments to identify areas of the campus that fall under specific regulations/statutes; vulnerability assessments and limited penetration testing; security reviews and audits; qualified CISA’s in information security and/or internal audit departmentsProposed Action Plan items: Conduct periodic information technology reviews and audits; HIPAA Sanction Policy; provide procedures and training to Internal Audit personnel; Mandate completion of advanced information security awareness course for IT personnel that support/manage areas which are subject to compliance or to be auditedImpact: Assessing what resources, funding and controls are necessary to comply with university policies and federal statutes is a big benefit of the plan. This information can be used to appeal to higher ups at your university in terms they understand.
22 ITIL IntegrationInformation security is an integral part of all business processes and serves as a support structure and success enabler of key business objectivesITIL and ISO 17799:2005 are compatible in that both seek to establish an effective risk management approach that promotes continuous information security planning, development of policies to support initiatives, risk analyses, controls and operational measures, compliance, metrics, and auditsWhile ISO 17799:2005 identifies the best practices and elements that should be developed to manage an effective and robust information security program, ITIL devises formal processes that translate to customer requirements, business and IT processes, and thus provide a common ‘language’ between the business customer, the IT provider, and the Information Security program initiatives and controls,
23 ITIL Information Security Model Key components of the ITIL process-based Information Security approach are:Understanding of customer requirements and business needs—provide security awareness to customerService level agreements--internal and external information security requirementsPlanning—Strategic, Tactical and OperationalControls—information security management frameworkImplementations—asset classification & control, security staffing requirements, physical security, secure computer & network management, systems access control and user access managementEvaluations—information security risk analyses, reviews and auditsMaintenance—continuous cycles of modifications and improvementsReporting—reports and metrics
24 COBIT IntegrationCOBIT provides a framework for IT governance, providing management tools such as metrics and maturity modeling to complement a control frameworkCOBIT can be integrated into ISO 17799:2005 to assist with communicating management aims and direction, compliance, refining information classification, access controls, information security program infrastructure, human resources (job definitions and staffing), operational procedures and responsibilities
25 COBIT Information Security Model Four broad areas that contain specific objectives overlay the processes and domains outlined in ISO 17799:2005 and ITIL:Plan and OrganizeAcquire and ImplementDeliver and SupportMonitor and Evaluate
26 Final ConsiderationsThe reason we chose to develop our campus information security plan under ISO 17799:2005 and are now in the planning stages of integrating ITIL and COBIT is because we believe that an effective information security program integrates business/academic processes and initiatives with IT and information security objectivesThe frameworks discussed allow your information security staffs to speak a ‘common’ language with the functional/business executives at your institution, which ultimately promotes a dialogue that leads to increased understanding and better definition of risks and vulnerabilities.While we advocate that ISO 17799:2005 strongly lends itself for adoption by higher education institutions in its comprehensive approach to designing a robust information security program, we advise “picking and choosing” from the ITIL and COBIT frameworks to enhance your understanding and fine tune specific areas of your plan, especially in developing continuous cycles of measurements and improvements.Developing a comprehensive plan, with actionable information security objectives that are tied and aligned with both technology and business goals and processes, can assist you in making the case for funding and staffing resources because information security will be seen as a critical success factor to your institution and it also provides a way for you to effectively communicate with your business and academic leaders and really get their attention!
27 ResourcesISO 17799:2005:ISO/IEC – Wikipedia:OGC-ITIL website:ITIL – Wikipedia:ISACA – COBIT:COBIT – Wikipedia:Georgia State University Information Systems Use Policies:
28 Questions?Copyright Tammy L. Clark, October This work is the intellectual property of the author. Permission is granted for this material to be shared for non-commercial, educational purposes, provided that this copyright statement appears on the reproduced materials and notice is given that the copying is by permission of the author. To disseminate otherwise or to republish requires written permission from the author.