Security Policies and Implementation Issues: Week 6 - Chapter 8 IT Security Policy Framework Approaches

Security Policies and
Implementation Issues
Week 6 - Chapter 8
IT Security Policy Framework Approaches
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company

www.jblearning.com
All rights reserved.
Key Concepts
 Different methods and best practices for
approaching a security policy framework
 Importance of defining roles,
responsibilities, and accountability for
personnel
 Separation of duties (SoD)
 Importance of governance and compliance

Security Policies and Implementation Issues www.jblearning.com Page 2
Information Systems Security
Policy Frameworks
Choosing the right framework is not easy
Use a simplified security policy framework domain

model
Flexible frameworks fit governance and compliance

planning requirements

IT Security Policy Framework
Domain Model

Risk IT
Framework
Process Model

Roles
Head of information
management
Data stewards
Data custodians
Data administrators
Data security administrators

Roles and Responsibilities
 Executive Management
• Responsible for governance and compliance
requirements, funding, and policy support
 Chief Information Officer (CIO)/Chief Security
Officer (CSO)
• Responsible for policy creation, reporting,
funding, and support
 Chief Financial Officer (CFO)/Chief Operating
Officer (COO)
• Responsible for data stewardship, owners of the
data
Roles and Responsibilities
(Continued)
 System Administrators/Application
Administrators
• Responsible for custodianship of the data,
maintaining the quality of the data, and
executing the policies and procedures pertaining
to the data, like backup, versioning, updating,
downloading, and database administration
 Security Administrator
• Responsible for granting access and assess
threats to the data, IA program
Committees

Separation of Duties (SoD)
 Layered security approach
 SoD duties fall within each IT domain
 Applying SoD can and will reduce both
fraud and human errors

Information Technology (IT)
Security Controls
 IT security controls are a function of IT
infrastructure that an organization has in its
control and the regulatory and business
objectives that need to be controlled
• You can have too many IT security controls,
impeding the organization from operating at
optimal capacity, thus reducing its revenue
potential

Security Controls (Continued)
 Generic IT security controls as a function of
a business model
• Deploy a layered security approach
• Use SoD approach
- This applies to transactions within the domain of
responsibility
• Conduct security awareness training annually

Security Controls (Continued)
 Apply the three lines of defense model
• First line: The business unit
• Second line: The risk management team
• Third line: Use independent auditors

Importance of Governance and
Compliance
 Implementing a governance framework can
allow organization to identify and mitigate
risks in orderly fashion
• Can be a cost reduction move for organizations
as they can easily respond to audit requests
 A well-defined governance and compliance
framework provides a structured approach
 Can provide a common language

Importance of Governance and
Compliance (Continued)
 Is also a best-practice model for organizations
of all shapes and sizes
 Controls and risks become measurable with a
framework
• Organizations with a governance and compliance
framework can operate more efficiently
 If you can measure the organization against a
fixed set of standards and controls, you have
won

Security Policy Framework: Six
Business Risks
Strategic Compliance Financial
Operational Reputational Other

Similarities Between GRC and
ERM
Defines risk in terms of
business threats
Applies flexible frameworks
Eliminates redundant
controls, policies, and efforts

Similarities Between GRC and
ERM (Continued)
Proactively enforces
policy
Seeks line of sight into the

entire population of risks

Differences Between GRC and
ERM
• Focuses on technology, a series
of tools and centralized policies
GRC
• Focuses on value delivery

ERM • Takes a broad look at risk based
on adoption driven by leadership

Summary
 Information systems security policy
frameworks and IT security controls
 Difference between GRC and ERM
 Business risks associated with security
policy framework
 Roles and responsibilities associated with
information systems security policy
framework and SoD

Security Policies and
Implementation Issues
Week 6 – Chapter 9
User Domain Policies

www.jblearning.com
Key Concepts
 Reasons for governing users with policies
 Regular and privileged users
 Acceptable use policy (AUP) and
privileged-level access agreement (PAA)
 Security awareness policy (SAP)
 Differences between public and private
User Domain policies

The User as the Weakest Link in the
Security Chain
People that use computers have different skill levels, thus

have different perceptions on information security
Social engineering can occur at any time within any

organization
Human mistakes often occur and can lead to security

breaches

The User as the Weakest Link in the
Security Chain
One of the most significant threats come from within an

organization from an “Insider”
Applications have weaknesses that are not known and

these weaknesses can be exploited by users either
knowingly or unknowingly
Security awareness training can remove this weakest link

in the security chain

Different Types of Users Within an
Organization
System Security
Employees
admins personnel
Guests and
Contractors Vendors general
public
Control
partners

Contingent and System Accounts
Contingent Need unlimited rights to install, configure, repair, and
Accounts recover networks and applications, and to restore data
Credentials are prime targets for hackers
IDs are not assigned to individuals until a disaster

recovery event is declared
System Need elevated privileges to start, stop, and manage

Accounts system services
Accounts can be interactive or non-interactive
System accounts are also referred to as “service

accounts”

User Access Requirements
Users require different access
Users require information from

different systems
Data has different security

controls

Differences and Similarities in User
Domain Policies
Similarities
• Private organizations may follow public-
compliance laws depending on their governance
requirements
• Public organizations may be small is size and
thus have similar control over their user
populations

Differences and Similarities in User
Domain Policies
Differences
• Public organizations must follow Sarbanes Oxley
Compliance (SOX), Health Insurance Portability
and Accountability Act (HIPAA), and other
compliance laws
• Private organizations are often smaller and
easier to control from a user standpoint
• Private organizations may not follow public-
compliance laws
Acceptable Use Policy (AUP)
 Attempts to protect an organization’s
computers and network
 Addresses password management
 Addresses software licenses
 Addresses intellectual property management
 Describes e-mail etiquette
 Describes the level of privacy an individual
should expect when using an organization’s
computer or network
 Describes noncompliance consequences
Privileged-Level Access Agreement
(PAA)
 Acknowledges the risk associated with
elevated access in the event the credentials
are breached or abused
 Asks user to promise to use access only for
approved organization business
 Asks user to promise not to attempt to “hack”
or breach security
 Asks user to promise to protect any output from
these credentials such as reports, logs, files,
and downloads
Security Awareness Policy (SAP)
 Addresses:
• Basic principles of information security
• Awareness of risk and threats
• Dealing with unexpected risk
• Reporting suspicious activity, incidents, and
breaches
• Building a culture that is security and risk
aware

Roles and Responsibilities: Who
Needs Training?
All Users
Executive Managers
Program and Functional Managers
IT Security Program Managers
Auditors
IT Function Management and Operations Personnel

Best Practices for User Domain
Policies
Attachments—Never
Encryption—Always Layered defense—Use
open an e-mail
encrypt sensitive data an approach that
attachment from a
that leaves the confines establishes overlapping
source that is not trusted
of a secure server layers of security
or known
Least privilege—
Patch management—All
Individuals should only Unique identity—All
network devices should
have the access users must use unique
have the latest security
necessary to perform credentials
patches
their responsibilities
Virus protection—Virus
and malware prevention
must be installed on
every desktop and laptop
computer

Lease Access Privilege and Best Fit
Access Privilege
Least Access
Best Fit Privileges
Privileges
Customizes access to the Customizes access to the

individual group or class of users

Who Develops User Policies
 Chief financial officer (CFO)
 Chief operations officer (COO)
 Information security manager
 IT manager
 Marketing and sales manager
 Unit manager
 Materials manager
 Purchasing manager
 Inventory manager

Summary
 Different user types and user access
requirements in an organization
 SAP, AUP, and PAA
 Roles and responsibilities associated with
user policies
 User policies in public and private
organizations


Security Policies and Implementation Issues: Week 6 - Chapter 8 IT Security Policy Framework Approaches

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Security Policies and Implementation Issues: Week 6 - Chapter 8 IT Security Policy Framework Approaches

Uploaded by

Copyright:

Available Formats

Security Policies and

© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company

Choosing the right framework is not easy

Use a simplified security policy framework domain

Flexible frameworks fit governance and compliance

© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company

Data security administrators

© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company

Strategic Compliance Financial

Operational Reputational Other

© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company

Applies flexible frameworks

© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company

Seeks line of sight into the

© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company

• Focuses on value delivery

© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company

People that use computers have different skill levels, thus

Social engineering can occur at any time within any

Human mistakes often occur and can lead to security

© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company

One of the most significant threats come from within an

Applications have weaknesses that are not known and

Security awareness training can remove this weakest link

© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company

IDs are not assigned to individuals until a disaster

System Need elevated privileges to start, stop, and manage

System accounts are also referred to as “service

© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company

Users require different access

Users require information from

Data has different security

© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company

Program and Functional Managers

IT Security Program Managers

IT Function Management and Operations Personnel

© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company

Customizes access to the Customizes access to the

© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company

You might also like