Strategies for Implementing Security · Auditing and Testing Metrics Definition and Collectio n Reporting (management, regulatory, 3rd party) Program Quality ... Operating Systems

E

February 2003

Strategies for Implementing Security

Ernst & Young Confidential and Proprietary- 2 -

#!@

Security Architecture Framework

Security Program Compliance and Reporting Security Program Compliance and Reporting Auditing and Testing Metrics Definition and Collection Reporting (management, regulatory, 3rd party) Program Quality

Governance StructurePolicies

Technology-Independent Standards

Governance,Governance,Policies and StandardsPolicies and Standards

Technology Physical InformationAsset ProfileAsset Profile

Inventory, Ownership, Risk Profile, Classification

TechnologyTechnologySpecificationsSpecifications

Minimum Security Baselines

Operating Systems

DatabasesApplicationsNetworks

BusinessBusinessDriversDrivers

Business StrategiesIndustry Regulations

Acceptable Risk

People & People & OrganizationalOrganizationalManagementManagement

Organizational StructureFunctional DefinitionRoles and ResponsibilitiesSkills/Resource Plan

Technical Security ArchitectureTechnical Security Architecture

Processes andProcesses andOperational PracticesOperational Practices

BCP/DR/Crisis ManagementIncident ResponseIdentity & Access MgmtSecurity Development/DeploymentCertification & AccreditationSecurity Awareness/EducationSLA Definition / Management

Security MonitoringPhysical SecurityVulnerability MgmtRisk Management3rd Party SecurityAsset Management


#!@

Confidentiality, Integrity and Availability

§ Confidentiality – Ensuring that only authorized personnel have access to information

§ Integrity – Ensuring that information is unchanged and accurate

§ Availability – Ensuring that information is available to the user when it is needed









Operating Systems




Acceptable Risk








#!@

Business Drivers

§ Regulations

§ Guidelines

§ Business Requirements

§ Customer Requirements

§ Business Partner Requirements

Security Program Compliance and Reporting Security Program Compliance and Reporting Auditing and Testing Metrics Definition and Collectio n Reporting (management, regulatory, 3rd party) Program Quality








Operating Systems




Acceptable Risk








#!@

Policies§ Demonstrate support for, and

commitment to, information security

§ States policy across the entire enterprise

§ Broad statement of principle

§ Long term; changed infrequently

§ Few in overall number

§ Provide overall direction for the organization

§ Mandatory; require formal exception process

§ Process and technology independent

§ Require a high level of authority to create, change or eliminate









Operating Systems




Acceptable Risk








#!@

Standards

§ Suitable for complying with policies

§ Specify a course of action

§ Mandatory; require formal exception process

§ Process and technology independent

§ Mid-level authority required to create, change or eliminate









Operating Systems




Acceptable Risk








#!@

Procedures / Guidelines

§ Process and/or technology dependent

§ Require a low level of authority to create, change or eliminate

§ May have a high level of complexity

§ Generally apply enterprise-wide, with some exceptions locally

§ May be situation-specific

§ May require formal exception process









Operating Systems




Acceptable Risk








#!@

Policy Management / Administration

§ Development: Planning and creation of the policy

§ Review: Assessment of the policy by an independent party

§ Approval: Authorizing implementation of the policy

§ Communication: Dissemination of policy to enterprise

§ Implementation: Initial execution of the policy

§ Compliance Monitoring: Tracking and reporting on the effectiveness

§ Exception Approval: Evaluation, documentation and tracking of exceptions

§ Maintenance: Ensuring currency









Operating Systems




Acceptable Risk








#!@

Asset Management - Process and Guidelines

– Provide simple, consistent and timely classification and authorization processes

– Balance between protection of and access to an organization’s business information

– Provide clear guidelines for employees and contractors for the classification and handling of information









Operating Systems




Acceptable Risk








#!@

Asset Management - Asset Inventory

– Maintain an inventory of assets, link those assets to owners, and identify technologies supporting key applications or groups of applications

– Enable organizations to track security controls implemented to protect assets

– Monitor support of ongoing threats that may be introduced to the asset environment









Operating Systems




Acceptable Risk








#!@

Technical Security Architecture

§ Multi-tiered centrally managed approach to Internet access

§ All access to the Internet is controlled via password protected proxy devices that filter inappropriate content

§ Third party connectivity is controlled via connections to distinct network segments

§ Connections to the enterprise network are only made after a review of controls at connecting organization









Operating Systems




Acceptable Risk








#!@


§ Network-based intrusion detection in place for all external network connections

§ Host-based intrusion detection in place for all business critical servers

§ Production data is strictly segmented from development data









Operating Systems




Acceptable Risk








#!@


§ Multiple tiers of virus protection exist

§ All email is filtered through a virus scanner

§ All file servers and workstations are protected via a managed (push-technology) virus protection solution

§ Encryption Standards are employed consistently across enterprise

§ Only Standards Based Encryption is used

§ Centralized Directory (LDAP) in useSecurity Program Compliance and Reporting Security Program Compliance and Reporting

Auditing and Testing Metrics Definition and Collection Reporting (management, regulatory, 3rd party) Program Quality








Operating Systems




Acceptable Risk








#!@

Processes and Operational Practices

§ Business Continuity Management– Critical Business Process are

identified and linked to Applications

– Business Applications are linked to IT Disaster Recovery Plans

§ Incident Response– Documented Incident Response

Plans define roles and actions

– Ensure proper control of information released to public

§ Identity and Access Management– Users are centrally managed

– Tools may assist in user provisioning









Operating Systems




Acceptable Risk








#!@


– Security Development / Deployment

• A formal security requirements analysis of new applications and releases of existing applications

• Security is involved from the beginning

• Appropriate security controls including activity logs, strong authentication methods, secure data storage techniques, and data validation is included

• Certification and Accreditation

– Security Awareness and Education

• Regular Awareness conducted

– SLA Definition









Operating Systems




Acceptable Risk








#!@


§ Security Monitoring– Monitoring all critical systems to

ensure compliance with Corporate configuration policies and standards

– Intrusion Detection linked to Incident Response

§ Physical Security– All Critical Servers located in Data

Center– Segmented from regular office

location– Adequate controls exist for access– Environmental Controls in place

§ Vulnerability Management– Process in place to obtain and review

vulnerabilities and ensure timely remediation









Operating Systems




Acceptable Risk








#!@


§ Risk Management

– Formal process for conducting risk assessments

– Ongoing process

§ 3rd Part Security– Parameters for connecting 3rd parties

well documented

§ Asset Management – All business critical platforms have

security standards that are applied before deployment

– There are clearly documented and communicated exception policies for individual machines that may not meet corporate security standards









Operating Systems




Acceptable Risk








#!@


§ Change Management

– Review all components: computer software, data transfers, database fields and structures, and hardware that could be impacted

– Database is maintained which contains the relationships between all applications, hardware, and data

– Change control review boards exist that have significant interaction with business leaders

– All program changes including infrastructure changes are reviewed

– Mirror images of production systems exist for comprehensive testing of programs









Operating Systems




Acceptable Risk








#!@

Technical Specifications

§ All Major Platforms are identified

§ Minimum Security Baselines for Specific platforms in use

§ Technical Specifications for technologies created before implementation









Operating Systems




Acceptable Risk








#!@

Security Organization - Executive Sponsorship

§ Security concerns are issues of corporate governance

§ Identify and communicate high level executive sponsorship to manage information security risks

§ Recognize information security as a business issue that requires people, technology, policy, and process to implement









Operating Systems




Acceptable Risk








#!@

Security Organization - Reporting Relationships

§ Industry trend is for Chief Information Security Officers (CISO) to report independent of the IT organization and directly to executive management

§ Leading practice is a direct reporting relationship to the CIO, with dotted line or committee interface to other business and operations executives

§ Some organizations have established dotted line interfaces to the audit committee









Operating Systems




Acceptable Risk








#!@

Security Organization - Structure

§ Structure is clearly defined and communicated in leading organizations

§ Reporting levels are appropriately aligned and have appropriate authority

§ Blends of both centralized and de-centralized security structure

§ Decentralized business unit or functional security units are aligned with centralized corporate security function









Operating Systems




Acceptable Risk








#!@

Security Program Compliance and Reporting

§ Measures effectiveness of Security Program

§ Conducts Compliance reviews across all domains of influence

§ Reports across the Enterprise

§ Security Audits performed on Risk Based

§ Clear Goals have been defined for projects









Operating Systems




Acceptable Risk







Documents

Strategies for Implementing Security · Auditing and Testing Metrics Definition and Collectio n Reporting (management, regulatory, 3rd party) Program Quality ... Operating Systems