IS4550 Security Policies and Implementation Unit 9 Implementing and Maintaining an IT Security Policy Framework

Class Agenda 8/11/16 Lesson Covers Chapter 13 and 14 11/24/2018 Class Agenda 8/11/16 Lesson Covers Chapter 13 and 14 Learning Objectives Lesson Presentation and Discussions. Discussion on Assignments. Discussion on Lab Activities. Break Times as per School Regulations. Try to read the text book before class. (c) ITT Educational Services, Inc.

Learning Objective Describe different issues related to implementing and enforcing information systems security (ISS) policies.

Key Concepts Organizational implementation issues for ISS policies Hindrances to the dissemination of policies and policy monitoring and enforcement strategy Policy enforcement as it relates to compliance laws Differences between public and private information technology (IT) security policy implementations Legal implications of ISS policy enforcement

EXPLORE: CONCEPTS

Implementation Issues The key point is to realize that implementation is as much about changing attitudes as it is about implementing controls. Overcoming perception and changing culture is one goal of security policies. In other words, it is about implementing in a way that wins hearts and minds.

Implementation Issues (Continued) You achieve this by having a clear and concise plan. Three common messages to define the need for policies through: Personal accountability Directive and enforcement Being a valuable tool

Overcoming Hindrances to Policies Many different learning levels within an organization People learn in different ways Organizational culture plays an important role

Overcoming Hindrances to Policies (Continued) It’s important to remember that success depends on how well the policies are accepted. Executive management support is critical in overcoming hindrances. The lack of support makes implementing security policies impossible.

Public vs. Private Security Policy Implementation Public organizations are often bound by legal requirements such as Health Insurance Portability and Accountability Act (HIPPA). Private organizations implement policies to counter risks affecting them. Public organizations are almost always larger than private.

Public vs. Private Security Policy Implementation (Continued) Private organizations can quickly implement changes as they are more often smaller than larger public organizations

EXPLORE: PROCESS

Policy Implementation Strategies Effective communication is one of the most important best practices to consider. It’s vital that executive support is obtained early, as without management support, the implementation of security policies is impossible. Keep expectations realistic, and credibility is built on delivering real solutions.

Policy Implementation Strategies (Continued) Clearly communicate the expected results of the investment in security policies. Keep the security policies flexible, as security best practice today might be considered obsolete tomorrow.

Monitoring and Enforcement Strategies The information security team should develop a close relationship with the legal team. Teams should communicate their roles and responsibilities to one another. The information security team should review the current legislation that governs their business.

Monitoring and Enforcement Strategies (Continued) The legal department should review all new or major changes to policies. Enforcement of policies is based on a risk assessment, as all policies should be followed.

Monitoring and Enforcement Strategies (Continued) It’s important to ensure that consequence and enforcement is properly socialized throughout organization. Wherever possible, use automated controls to enforce policies.

EXPLORE: ROLES

Roles and Responsibilities Senior Management Responsible for policy support and funding, along with leadership and governance Human Resources (HR) Responsible for policy enforcement regarding employees IT Management Responsible for support and leadership for information security also act as change agents

Roles and Responsibilities (Continued) Security Management Responsible for the overall information security policy creation, implementation, monitoring, and enforcement Users/Employees Responsible for following the information security policies, standards, guidelines, and procedures

Summary In this presentation, the following were covered: Policy implementation issues and overcoming hindrances to implementing policies Policy implementation strategies Policy monitoring and enforcement strategies Difference between public and private security policy implementation Roles and responsibilities associated with implementation and maintenance of an IT security policy framework

Unit 9 Assignment Discussion 9.1 Information Dissemination—How to Educate Employees Assignment 9.3 Policy Monitoring and Enforcement Strategy

Unit 9 Lab Activities Lab is in the lab manual on line Lab 9.2 Assess and Audit an Existing IT Security Policy Framework Definition Reading assignment: Read chapter 13 and 14