Essential strategies for policy development b b b

Essential strategies for policy development b b b By Charles Cresson Wood, CISA, CISSP Independent Information Security Consultant Info. Security Infrastructure, Inc. Sausalito, California USA www. infosecurityinfrastructure. com +415 -289 -0800 © Copyright, All Rights Reserved 2004 Info. Security Infrastructure, Inc.

Policies are now front page news b b b Misunderstandings about document destruction policy were critical part of Andersen's downfall with Enron. Conscientious employee shreds documents at Cooper Tire -- documents about tread separation -and causes stock to plunge 25%. Mistaken placement of e-mail addresses in "to" field rather than "bcc" field violated privacy policy of Eli Lilly, garnered bad press and triggered FTC investigation (Prozac users). © Copyright, All Rights Reserved 2004 Info. Security Infrastructure, Inc.

What do we mean by “policies”? b b b b Management instructions (a. k. a. directives) Formal ways to say "this is how we do it here" Tech talk: generalized requirements statements Not systems settings for firewalls & other system components More general than procedures & standards Unlike guidelines, policies are mandatory Unlike architectures, policies are product and vendor independent © Copyright, All Rights Reserved 2004 Info. Security Infrastructure, Inc.

Typical parts of policy document b b b Written endorsement of Chief Executive Officer Discussion of new and critical role of information Review security risks in high-level way Overview of those responsible & contact points Instructions about what to do & what not to do (vast majority of document) Cross references to more specific documents (intranet recommended) © Copyright, All Rights Reserved 2004 Info. Security Infrastructure, Inc.

Policies at top of document pyramid b b b Information Security Department issues requirements Group does not have resources to handle all implementations Generating templates that can be replicated by members of team (factory analogy) Templates that can be enforced & audited Templates that engender process of continuous refinement Integration across policies, standards, procedures, architectures, contingency plans, etc. © Copyright, All Rights Reserved 2004 Info. Security Infrastructure, Inc.

Policies as logical expression of business rules (1) b b Consistency reduces loss and costs Programmed attacks require programmed defensive maneuvers Allows automation of processes that could not previously be automated P 3 P (Privacy Preferences Criteria) negotiates policies between untrusting Web parties © Copyright, All Rights Reserved 2004 Info. Security Infrastructure, Inc.

Policies as logical expression of business rules (2) b b b SAML (Security Assertions Markup Language) establishes XML framework for secure sign-on across multiple Web-based applications from different organizations. Firewalls from various vendors automatically respond to attacks by taking immediate action. Policy clarification and specification required before sophisticated controls are established. © Copyright, All Rights Reserved 2004 Info. Security Infrastructure, Inc.

Policies considered part of Standard of Due Care b b b Required by laws such as SOX, HIPAA and GLB Required by regulations such as those from OMB Required by case law such as University of CA San Diego and False Claims Act Required by management standards such as ISO 17799 Required by business partners for proprietary information exchange Required by customers for personal information disclosure © Copyright, All Rights Reserved 2004 Info. Security Infrastructure, Inc.

Not sufficient to simply adopt Standard of Due Care controls b b Distinguish between legal requirements to meet the SODC and unique additional requirements. Unique additional requirements cannot be discovered through purchased products/services, nor through compliance with external requirements. Unique additional requirements are still required if there is significant and clear need, and they are costeffective. Case law behind the Hooper Doctrine © Copyright, All Rights Reserved 2004 Info. Security Infrastructure, Inc.

Rushing to handle information security (1) b b b Management too often believes security can be handled completely via purchased products & services. Management cannot delegate responsibility for determining (a) which risks to accept, (b) which to transfer to others and (c) which to mitigate through additional controls. Information is critical organizational asset -management has fiduciary duty to protect and preserve it. © Copyright, All Rights Reserved 2004 Info. Security Infrastructure, Inc.

Rushing to handle information security (2) b b Management must take the time to consider unique circumstances and appropriate responses. Risk management process not yet clearly defined in many organizations. © Copyright, All Rights Reserved 2004 Info. Security Infrastructure, Inc.

Need for broader scope risk assessment (1) b b b Running vulnerability identification & compliance checking software, or even doing penetration attacks, is not enough. Examine all the places where critical, valuable and sensitive information is stored, moved and processed. Ground information security activities in actual business needs (such as protect intellectual property). © Copyright, All Rights Reserved 2004 Info. Security Infrastructure, Inc.

Need for broader scope risk assessment (2) b b b Examine management issues such as organizational design, systems development process, system privilege request/approval process and loss history record keeping. Examine training & awareness issues like telecommuting, social engineering and use of personal machines for organizational business. Examine technical issues such as integration of security systems such as through network management system. © Copyright, All Rights Reserved 2004 Info. Security Infrastructure, Inc.

Reasons to perform a risk assessment (1) b b b Prioritize risks so that important matters are sure to be addressed (use for budgeting and action plan preparation). Set ballpark value of information and systems at risk. Identify management processes that are lacking or broken. Get an independent perspective to determine whether internal information security efforts are effective. Determine whether security has improved over time and whether it needs more resources. © Copyright, All Rights Reserved 2004 Info. Security Infrastructure, Inc.

Reasons to perform a risk assessment (2) b b b Confront overly optimistic management with reality. Put management on notice and compel corrective action. Discharge management's responsibility to protect assets. Generate due diligence evidence to defend against lawsuits. Show compliance with relevant laws & regulations, and perhaps contractual stipulations. © Copyright, All Rights Reserved 2004 Info. Security Infrastructure, Inc.

Reasons to perform a risk assessment (3) b b b Obtain private status report, without publicity or damage to reputation. Gather information that allows control enhancements to be justified. Correct vulnerabilities and problems before losses take place. Obtain special insurance coverage and perhaps premium rating. Indirectly sell need for information security to management. © Copyright, All Rights Reserved 2004 Info. Security Infrastructure, Inc.

How risk assessment empowers policy writing (1) b b b Establishes reference point along spectrum of possible policies. Example - personal use of organizational computing resources Example - type of extended user authentication for remote access Example - number of levels found in data classification system Example - when to automatically declassify highly sensitive information © Copyright, All Rights Reserved 2004 Info. Security Infrastructure, Inc.

How risk assessment empowers policy writing (2) b b b Accurately identifies unique attributes of issuing organization. Example - technology employed like Web-based purchasing exchange Example - organizational culture including information sharing views Example - reliance on end-user independent decision -making Example - centralization/decentralization regarding systems management © Copyright, All Rights Reserved 2004 Info. Security Infrastructure, Inc.

Vision of integrated automated policy environment (1) b b b Centralized dashboards indicate current status of information security. Vulnerability identification and auditing systems check compliance. Management tools facilitate real-time risk assessment. Alerting tools like IDS trigger automated response chains. Response chains include automated patch management, fix testing, fix reporting. Response chains include automatic report preparation and forensic analysis. © Copyright, All Rights Reserved 2004 Info. Security Infrastructure, Inc.

Vision of integrated automated policy environment (2) b b b Events trigger security changes, like termination reflected in HR database deletes system privileges. Security systems from various vendors tied together to reflect internal policy requirements. Centralized dashboards allow management to change policies on-the-fly and have these translated automatically into deployed controls. © Copyright, All Rights Reserved 2004 Info. Security Infrastructure, Inc.

Vision of integrated automated policy environment (3) b b b Example - increase characters required in fixed passwords done centrally once, then configurations changed automatically on multiple platforms and machines Flexibility and malleability to respond rapidly to changing technological and business requirements. Consistency and integration across the board where management requirements are automatically translated into system configurations and business rules. © Copyright, All Rights Reserved 2004 Info. Security Infrastructure, Inc.

Questions? Submit your questions to Charles now by entering your question in the field on the lower right hand corner of your screen. © Copyright, All Rights Reserved 2004 Info. Security Infrastructure, Inc.

Thank you for participating in this webcast. For more information on developing policies, visit our Featured Topic at the link below. A copy of this presentation with and without audio will be available via our Featured Topic within the next 24 hours. searchsecurity. com/Featured. Topic/policies © Copyright, All Rights Reserved 2004 Info. Security Infrastructure, Inc.