1. Start With A Great Information Security Plan!
Tammy L. Clark, CISO, Georgia State University
William Monahan, Lead Information Security Administrator, Georgia State University

2. Why ISO 17799?
The ISO 17799:2005 standard lends itself well to developing and defining information security program initiatives in a higher education environment
ISO/IEC 17799:2005 provides best practice recommendations (133 controls) on information security management for use by those who are responsible for initiating, implementing or maintaining information security management systems. Information security is defined within the standard as the preservation of:
Confidentiality (ensuring that information is accessible only to those authorized to have access)
Integrity (safeguarding the accuracy and completeness of information and processing methods) and
Availability (ensuring that authorized users have access to information and associated assets when required).
ISO/IEC is an information security standard published and most recently revised in 2005 by the International Organization for Standardization and the International Electrotechnical Commission.
It is entitled Information technology - Security techniques - Code of practice for information security management. The current standard is a revision of the version published in 2000, which was itself a word-for-word copy of the British Standard BS :1999.

3. Georgia State University’s Information Security Plan
Two years ago, our CIO was tasked by the Board of Regents in Georgia to submit an information security plan. We elected to provide a plan that was both comprehensive and holistic, and we chose to frame it around the ISO standard, as it advocates a very strategic, risk management based approach
Looking back, this was a very ambitious undertaking that first year, since we only have three dedicated information security staff resources, and examining all of the recommended controls in the ISO was a very time consuming and (at times) difficult process
We then went a few steps further and made an assessment of the current state of security in each domain area and defined prioritized objectives to accomplish each year. Each year, we modify our plan to reflect changing priorities and demands
We are currently in the planning stages of integrating ITIL (IT Infrastructure Library) and COBIT (Control Objectives for Information and related Technology)

4. 12 Domains of ISO 17799:2005 Risk Assessments Security Policies
Information Security Organization
Asset Management
Human Resources
Physical and Environmental Security
Communications and Operations Management
Access Control
Information Systems Acquisition, Development, and Maintenance
Information Security Incident Management
Business Continuity Management
Compliance

5. Benefits of Using the ISO 17799 Framework
It’s comprehensive and requires an in depth analysis of business and IT processes. A great deal of time and effort will go into this initially, but when all is said and done, you will have prioritized action plans you can use to make immediate improvements.
You will have a great opportunity to bridge the communication gap that often exists between information technology and business/academia. You can begin to erase the perception that information security only affects information technology, as you integrate your information security initiatives into business and academic processes and initiatives.
You can use this plan to clarify to upper management what measures need to be taken at your campus to comply with university policies and legislative requirements (HIPAA, GLBA, PCI, etc.) that often require a very complex information security infrastructure.
You can effectively demonstrate to your university leadership constituency that instituting adequate preventative controls and measures is necessary in order to prevent data leakages and compromises of institutional assets.

6. Using ISO 17799:2005 to Develop an Information Security Plan
Overview of domains and objectives
Ideas on assessing the current state of security at your university
Coming up with proposed action plan items
Building out a comprehensive appendix with supporting documentation
Integrating ITIL and COBIT objectives (optional)

7. Executive Summary
State that senior level management support and validation of your information security program is critical to its success
Amplify how accomplishing the roadmap objectives you’re outlining in this plan will directly impact and enable your university’s strategic goals—academic, business, and information technology.
Stress that this plan clearly demonstrates the need to institute an evolving cycle of continuous improvements in areas such as regulatory compliance, preservation of the confidentiality and integrity of university data, and availability of the critical business and information technology infrastructure

8. Opening Sections of Your Plan
Scope:
Applicability (Staff, faculty, students, affiliates, third parties)
Structure (ISO 17799:2005)
Explanation of the format (14 domains)
Annual validation process (continuous cycle of improvement, review, and acceptance/adoption)
Terms and definitions

9. Risk Assessment and Treatment
Two major areas: Assessing Security Risks and Treating Security Risks
Risk assessments should identify, quantify and prioritize risks against criteria for risk acceptance and objectives relevant to the organization
Assess the state of security by addressing competencies or deficiencies
Come up with proposed action items—policies, procedures, initiatives to improve upon current state of security
Provide any references used to determine above
Examples:
State of Security: Adoption of Risk Assessment Policy in November 2005; Information security risk assessments performed using the methodology outlined in National Institute of Science and Technology (NIST) SP Risk Management Guide for Information Technology Systems, and incorporate relevant university policies and procedures.
Proposed Action Items: Develop standard criteria that departments can use in conducting preliminary analysis of potential IT system candidates; Develop supporting documentation and procedures to support the risk assessment policy and for periodic reassessments of systems and data
Impact: The Risk Assessment policy adopted in November 2005 has led to approximately 50 risk assessments being conducted in 2006 so far, that led to mandatory information security controls, policies, procedures and guidelines being put in place to protect the university’s information technology infrastructure.

10. Security Policy Information Security Policies
Information Security policies provide direction and support for information security iaw university requirements and relevants laws and regulations
Assess the state of security by addressing competencies or deficiencies
Come up with proposed action items—policies, procedures, initiatives to improve upon current state of security
Provide any references used to determine above
State of Security: The Statutes of Georgia State University provide for the internal governance of this University
Proposed Action Items: Establish a schedule and process for periodic review; modify security awareness course to include domain on security policies, Adopt a policy mandating all students and staff complete security awareness course; Coordinate with internal audit to focus attention on areas of concern in regards to policy compliance
Impact: Conducting risk assessments of university business and IT initiatives has led to the revision or institution of new information security policies that better define the responsibilities of those who manage information technology assets and information, as well as numerous procedures and guidelines that specify what needs to be done to safeguard it from unauthorized access and usage

11. Organization of Information Security
Two major areas: Internal organization and External parties
A robust information security infrastructure must be developed that includes incident response activities, security awareness education, security policies, third party compliance with university policies and requirements, and the deployment of effective security solutions that deter the activities of unauthorized persons
Assess the state of security by addressing competencies or deficiencies
Come up with proposed action items—policies, procedures, initiatives to improve upon current state of security
Provide any references used to determine above
State of security: 2000—Information Security department created and a number of initiatives developed to provide the campus with enhanced resources, knowledge, and leadership
Proposed Action Plan Items: Reassess current information security needs of university; Investigate training and procedures to allow assumption of routine tasks by other elements of central IT org; Develop procedures for operation of CSIRT; Develop and maintain security architecture; develop and implement criteria and processes for eval of risks associated with third party access
Impact: Management commitment is critical in order to acquire funding and staffing resources. A CISO and dedicated, highly trained information security resources are necessary to manage and maintain a successful information security program.

12. Asset Management
Two major areas: Responsibility for Assets and Classification Guidelines
Inventories and classification of assets helps ensure that effective asset protection takes place, is an important aspect of risk management, and may also be required for other business purposes such as health, safety, and federal regulations.
Assess the state of security by addressing competencies or deficiencies
Come up with proposed action items—policies, procedures, initiatives to improve upon current state of security
Provide any references used to determine above
State of security: Property Control Policy; Data Stewardship and Access Policy
Proposed Action Items: Implement asset tracking for critical information technology equipment that falls outside span of control of Property Control Policy; Review procedures and policies governing control of access to sensitive information and review/approval of continuing access
Impact: In order to get your arms around what needs to be protected, this is a critical step!

13. Human Resources Security
Three major areas: Prior to employment, During employment, and Termination or change of employment
Throughout the employment cycle (hiring, current status, and termination/changes) information security procedures must be implemented to reduce the risks of human error fraud, and misuse of university resources
Assess the state of security by addressing competencies or deficiencies
Come up with proposed action items—policies, procedures, initiatives to improve upon current state of security
Provide any references used to determine above
State of Security: Credit checks, criminal background investigations, defining information security related job duties in position descriptions, security awareness training requirements, identity management initiatives
Proposed Action Plan items: Incorporate information security duties into job descriptions; mandated security awareness training; utilize IDM to assure appropriate access and authorization to university information and IT resources
Impact: Implementing an identity management system to provision and deprovision id’s in a timely manner; online class has made it easy and convenient to administer security awareness training, which is critical for the campus user population

14. Physical and Environmental Security
Three major areas: Secure areas, Equipment security, General controls
Important business information processing facilities should reside in secure areas with appropriate security barriers and entry controls, and the protection applied should be commensurate with risks
Assess the state of security by addressing competencies or deficiencies
Come up with proposed action items—policies, procedures, initiatives to improve upon current state of security
Provide any references used to determine above
State of security: Restrict physical entry into the Data Operations Center; prevent loss, damage or compromise of information technology assets; minimize exposure to flooding unauthorized access, fire, corrosive agents, and potential hazards
Proposed Action items: Approve Network Operation Center Access Policy and Telecomm Room Access and Key Policy; install monitoring and recording equipment for tracking environmental changes; Implement necessary changes to mechanical systems within the NOC
Impact: Part of the process of analyzing this particular domain area is assessing power and A/C in the network operations center—the ISO standard really leads to you taking an indepth view of the controls in each domain area

15. Communications and Operations Management
10 major areas: Operational procedures and responsibilities, Third party service delivery management, System planning and acceptance, Protection against malicious and mobile code, Back-up, Network security management, Media handling, Exchange of information, Electronic commerce services, Monitoring
Policies for the management and operation of all university information processing facilities should be established, codified, and communicated to all employees and third parties doing business with the university in order to ensure correct and secure operation. Capacity planning and back-up strategies are important, as is proper handling of media disposal and storage.
Assess the state of security by addressing competencies or deficiencies
Come up with proposed action items—policies, procedures, initiatives to improve upon current state of security
Provide any references used to determine above
State of security: Knowledgebase in the NOC and HelpCenter; Central database repository for disparate data sources to dynamically record all devices; CSIRT mobilization; performance of risk assessments; devising acceptance criteria for new centrally managed information systems, et al; implement controls to prevent and detect unauthorized or malicious software (defense in depth); Adequate back-up plans and facilities; security management controls—centralized and distributed; Secure Disposal or Re-Use of Information Systems Equipment; System Acceptable Use and Security Policy; Compliance with PCI and CISP; continuous, dynamic network monitoring from a central location
Proposed Action Items: Consolidated knowledge Base; Critical Outage procedures; Standards and procedures for implementing third party service delivery solutions; develop and implement IT Infrastructure Master Plan and IT Project Portfolio review; select and deploy additional security technologies to bolster internal defenses; conduct reviews of back-up strategies on system by system basis; review through data steward structure the procedures for approving and protecting exchange of sensitive university data between systems and to individual end users; develop standard methodology for processing credit card transactions; examine feasibility of single monitoring application or appliance
Impact: Codify all your IT and information security procedures—an area where ITIL and COBIT can be integrated effectively

16. Access Control
Eight major sections: Business requirement for access control; User access management, User responsibilities, Network access control, Operating system access control, Application and information access control, Monitoring system access and use, Mobile computing and telecommuting
Access to university information and business processes should be controlled on the basis of business and security requirements according to university policies and procedures. Users must be made aware of their responsibilities in this process and standard and procedures developed and implemented to assist in mitigation of risks.
Assess the state of security by addressing competencies or deficiencies
Come up with proposed action items—policies, procedures, initiatives to improve upon current state of security
Provide any references used to determine above
State of security: In accordance with existing policy, all university information is used with appropriate access levels and sufficient assurance of integrity, confidentiality, and compliance with laws and statutes; IDM, Minimum Information Security Environment Policy and Information Systems Ethics Policy; Password complexity controls that adhere to Sensitive Information Protection Policy and supporting procedures; Remote Access Policymandating use of VPN and approved methods; procedures for restricting access to production environments based on business requirements of functional customer and control by security administrators; Wireless Access Policy mandating use of VPN
Proposed action items: IDM implementation; mandated password complexity in sensitive areas assured by technical controls; network access authentication requirements assured by technical controls
Impact: Tightening up the controls on accessing information on your network—including third parties doing business with the university and remote users

17. Information Systems Acquisition, Development and Maintenance
Six major sections: Security requirements of information systems, Correct processing in applications, Cryptographic controls, Security of system files, Security in development and support processes, Technical vulnerability management
Security reviews are necessary to ensure that controls and security requirements become a part of the overall design process. Cryptographic controls are necessary to assure confidentiality, authenticity, and integrity of sensitive information at risk. Technical vulnerability management systems should be implemented in an effective, systematic, and repeatable way with measurements taken to confirm effectiveness.
Assess the state of security by addressing competencies or deficiencies
Come up with proposed action items—policies, procedures, initiatives to improve upon current state of security
Provide any references used to determine above
State of security: Information Risk Assessment policy approved in Nov 2005; Data Stewardship and Access Policy; Remote Access policy; institution of standard cryptographic controls; acquisition of multiple vulnerability assessment technologies used to scan devices in support of university policies and information security initiatives
Proposed Action items: Continued research of vulnerability assessment technologies that can be integrated with various security monitoring systems
Impact: Support the risk assessment process in which you analyze information technology projects and business processes in seeking to implement consistent, effective controls

18. Information Security Incident Management
Two major sections: Reporting information security events and weaknesses and Management of information security incidents and improvements
Formal event reporting and escalation procedures should be in place. All employees, contractors, third party users should be made aware of the procedures for reporting different types of events and weaknesses that might have an impact on the security of organizational assets to the designated POC. Responsibilities and procedures should be in place to handle information security events weaknesses effectively once reported. A process of continuous improvement should be instituted to monitor, respond, evaluate and manage information security incidents.
Assess the state of security by addressing competencies or deficiencies
Come up with proposed action items—policies, procedures, initiatives to improve upon current state of security
Provide any references used to determine above
State of security: Incident Response Policy and associated procedures; modification of technical controls routinely to mitigate threats.
Proposed action items: Continued development of CSIRT procedures as needed; Training and simulation of events conducted with CSIRT members
Impact: Face it—criminal activities using computers are on the upswing and the CSIRT, effective policies and procedures, as well as trained staff members with forensics knowledge, are all critical in order to properly handle forensics and evidence seizures from a legal standpoint

19. Business Continuity Management
Information security aspects of business continuity management
In order to prevent disruption to business activities, as well as protect critical business processes from the effects of major failures or disasters, the development of a comprehensive University Disaster Recovery/Business Continuity Plan is necessary. The plan should call for risk analyses to determine the impact of business disruptions, identify priorities for testing, maintenance and activation, as well as outline specific processes to follow in the event of disruptions, including identification of the individuals or departments responsible for execution of each component of the plan.
Assess the state of security by addressing competencies or deficiencies
Come up with proposed action items—policies, procedures, initiatives to improve upon current state of security
Provide any references used to determine above
State of security: Development of a comprehensive Disaster Recovery/Business Continuity plan
State of security: Funded and staffed commitment to Business Continuity plan and associated Disaster Recovery Plan
Impact: Having a business continuity plan is critical

20. Compliance
Three major areas: Compliance with legal requirements, Compliance with security policies and standards, and technical compliance, System audit consideration
Universities are obligated to protect information types defined under FERPA, GLBA, HIPAA, Digital Millennium Act, CC 42CFR Part 73, ECPA and various other state and federal statutes or guidelines. It is also necessary to ensure compliance of information technology systems with university policies and standards. It is desirable to maximize the effectiveness of system audits and to minimize business disruptions due to vulnerability and/or penetration tests performed on university information technology resources.
Assess the state of security by addressing competencies or deficiencies
Come up with proposed action items—policies, procedures, initiatives to improve upon current state of security
Provide any references used to determine above
State of security: Secure Computing Initiative that mandates specified levels of protection to systems and assets that fall under compliance requirements; risk assessments to identify areas of the campus that fall under specific regulations/statutes; vulnerability assessments and limited penetration testing; security reviews and audits; qualified CISA’s in information security and/or internal audit departments
Proposed Action Plan items: Conduct periodic information technology reviews and audits; HIPAA Sanction Policy; provide procedures and training to Internal Audit personnel; Mandate completion of advanced information security awareness course for IT personnel that support/manage areas which are subject to compliance or to be audited
Impact: Assessing what resources, funding and controls are necessary to comply with university policies and federal statutes is a big benefit of the plan. This information can be used to appeal to higher ups at your university in terms they understand.

21. (Sample) Appendices Items
Sensitive Services
Information security documentation
Information security technical control matrix
Credit card merchants
Examples of outsourced contracts to 3rd parties
HIPAA compliance
Sample risk assessment report
servers requiring periodic security reviews
Proposed Action Item Matrix
CSIRT membership

22. ITIL Integration
Information security is an integral part of all business processes and serves as a support structure and success enabler of key business objectives
ITIL and ISO 17799:2005 are compatible in that both seek to establish an effective risk management approach that promotes continuous information security planning, development of policies to support initiatives, risk analyses, controls and operational measures, compliance, metrics, and audits
While ISO 17799:2005 identifies the best practices and elements that should be developed to manage an effective and robust information security program, ITIL devises formal processes that translate to customer requirements, business and IT processes, and thus provide a common ‘language’ between the business customer, the IT provider, and the Information Security program initiatives and controls,

23. ITIL Information Security Model
Key components of the ITIL process-based Information Security approach are:
Understanding of customer requirements and business needs—provide security awareness to customer
Service level agreements--internal and external information security requirements
Planning—Strategic, Tactical and Operational
Controls—information security management framework
Implementations—asset classification & control, security staffing requirements, physical security, secure computer & network management, systems access control and user access management
Evaluations—information security risk analyses, reviews and audits
Maintenance—continuous cycles of modifications and improvements
Reporting—reports and metrics

24. COBIT Integration
COBIT provides a framework for IT governance, providing management tools such as metrics and maturity modeling to complement a control framework
COBIT can be integrated into ISO 17799:2005 to assist with communicating management aims and direction, compliance, refining information classification, access controls, information security program infrastructure, human resources (job definitions and staffing), operational procedures and responsibilities

25. COBIT Information Security Model
Four broad areas that contain specific objectives overlay the processes and domains outlined in ISO 17799:2005 and ITIL:
Plan and Organize
Acquire and Implement
Deliver and Support
Monitor and Evaluate

26. Final Considerations
The reason we chose to develop our campus information security plan under ISO 17799:2005 and are now in the planning stages of integrating ITIL and COBIT is because we believe that an effective information security program integrates business/academic processes and initiatives with IT and information security objectives
The frameworks discussed allow your information security staffs to speak a ‘common’ language with the functional/business executives at your institution, which ultimately promotes a dialogue that leads to increased understanding and better definition of risks and vulnerabilities.
While we advocate that ISO 17799:2005 strongly lends itself for adoption by higher education institutions in its comprehensive approach to designing a robust information security program, we advise “picking and choosing” from the ITIL and COBIT frameworks to enhance your understanding and fine tune specific areas of your plan, especially in developing continuous cycles of measurements and improvements.
Developing a comprehensive plan, with actionable information security objectives that are tied and aligned with both technology and business goals and processes, can assist you in making the case for funding and staffing resources because information security will be seen as a critical success factor to your institution and it also provides a way for you to effectively communicate with your business and academic leaders and really get their attention!

27. Resources
ISO 17799:2005:
ISO/IEC – Wikipedia:
OGC-ITIL website:
ITIL – Wikipedia:
ISACA – COBIT:
COBIT – Wikipedia:
Georgia State University Information Systems Use Policies:

28. Questions?
Copyright Tammy L. Clark, October This work is the intellectual property of the author. Permission is granted for this material to be shared for non-commercial, educational purposes, provided that this copyright statement appears on the reproduced materials and notice is given that the copying is by permission of the author. To disseminate otherwise or to republish requires written permission from the author.