What is information security governance? who in the organization should plan for it?

Security Governance

Security governance is the set of responsibilities and practices exercised by executive management with the goal of providing strategic direction, ensuring that objectives are achieved, ascertaining that risks are managed appropriately, and verifying that the enterprise’s resources are used responsibly. Our research has shown that through their emerging capabilities in the area of security governance and risk management, many organizations are taking proactive steps to ensure that their investments in security controls directly support their objectives for the business. A consistent, organization-wide view of security risks integrating both physical security and IT security is an essential element of this strategy. By combining superior security governance and risk management with an integrated approach to logical and physical security, organizations gain an advantage for competing in the global economy with a distinct advantage through an optimized IT infrastructure and better protection for their digital, physical, and human assets.

Summary of exam objectives

Information security governance ensures that an organization has the correct information structure, leadership, and guidance. Risk Analysis (RA) helps ensure that an organization properly identifies, analyzes, and mitigates risk. All three of these qualities—information security governance, ethics, and Risk Analysis—are crucial for the success of an organization.

Finally, accurately assessing risk and understanding terms such as Annualized Loss Expectancy, Total Cost of Ownership, and Return on Investment will not only help you on the exam but also help advance your information security career.

Abstract

Security governance is the combined set of tools, personnel, and processes that provide for formalized risk management. It includes organizational structure, roles and responsibilities, metrics, processes, and oversight, as it specifically impacts the security program. While governance is embodied in a set of documents, specifically standards, guidelines, policies, and procedures, to have an effective security program, the appropriate resources need to be allocated, as defined within the governance.

Without the formalization, and especially the implementation of governance, a security program is an accident. It would otherwise rely upon having the appropriately skilled people running the program, who are allocated the appropriate resources. If the people leave, or the level of support varies, the security program could disintegrate.

Summary of exam objectives

Information security governance assures that an organization has the correct information structure, leadership, and guidance. Ethics helps ensure that we act morally and reasonably. Risk Analysis (RA) helps ensure that an organization properly identifies, analyzes, and mitigates risk. All three of these qualities: information security governance, ethics, and Risk Analysis, are crucial for the success of an organization.

Ethics is required not only to become a CISSP® (you must agree and adhere to the (ISC)2 © code of ethics), but is also required to have an information security career. If you lack ethics, you will likely lack an information security career. Finally, accurately assessing risk, and understanding terms such as Annualized Loss Expectancy, Total Cost of Ownership, and Return on Investment will not only help you in the exam, but also help advance your information security career.

Processes for IT Security Governance Planning

IT security governance planning includes prioritization as its major function. This helps in utilizing the limited sources of the organization. Determining priorities among the potential conflicting interests is the main focus of these processes. This includes budget setting, resource allocation, and, most important, the political process needed to prioritize in an organization.

Summary of Exam Objectives

Information security governance ensures that an organization has the correct information structure, leadership, and guidance. Governance helps ensure that a company has the proper administrative controls to mitigate risk. Risk analysis helps ensure that an organization properly identifies, analyzes, and mitigates risk. Accurately assessing risk and understanding terms such as ALE, TCO, and ROI will not only help you on the exam, but also to advance your information security career.

An understanding and appreciation of legal systems, concepts, and terms are required of an information security practitioner working in the information-centric world today. The impact of the ubiquity of information systems on legal systems cannot be overstated. Whether the major legal system is civil, common, religious, or a hybrid, information systems have made a lasting impact on legal systems throughout the world, causing the creation of new laws and reinterpretation of existing laws, as well as a new appreciation for the unique aspects that computers bring to the courts.

Finally, the nature of information security and the inherent sensitivity therein makes ethical frameworks an additional point requiring attention. This chapter presented the IAB’s RFC, Ethics and the Internet, the Computer Ethics Institute’s Ten Commandments of Computer Ethics, and The (ISC)2® Code of Ethics. The CISSP® exam will, no doubt, emphasize the Code of Ethics proffered by (ISC)2®, which presents an ordered set of four canons that attend to matters of the public, the individual’s behavior, the provision of competent service, and the profession as a whole.

Decentralized Governance

In decentralized information security governance structures, the authority, responsibility, and decision-making power are vested in and delegated to individual subordinate organizations within the parent organization (e.g., bureaus/components within an executive department of the federal government or business units within a corporation). Subordinate organizations establish their own policies, procedures, and processes for ensuring (sub) organization-wide involvement in the development and implementation of risk management and information security strategies, risk and information security decisions, and the creation of mechanisms to communicate within the organization. A decentralized approach to information security governance accommodates subordinate organizations with divergent mission/business needs and operating environments at the cost of consistency throughout the organization as a whole. The effectiveness of this approach is greatly increased by the sharing of risk-related information among subordinate organizations so that no subordinate organization is able to transfer risk to another without the latter’s informed consent. It is also important to share risk-related information with parent organizations as the risk decisions by subordinate organizations may have an effect on the organization as a whole.

Product security governance

The capability Product Security Governance is responsible for ensuring that the MDM has the proper people, process, and technology to support the design, execution, and maintenance of all other cybersecurity capabilities. Specifically, it is responsible for discharging the following responsibilities:

Ensuring that requirements that follow from regulations, regulatory guidance, and cybersecurity standards are captured in the Quality Management System (QMS). This activity consists of ingesting new cybersecurity regulations, guidance, and standards, distilling regulatory guidance down to a set of technical and procedural controls (examples of such procedural and technical control catalogs have been provided in Chapters 4 and 7Chapter 4Chapter 7, respectively), assessing gaps between regulatory requirements and the current state of the QMS, and creating a Quality Plan to bring the QMS in compliance with the new regulations, guidance, and standards.

Oversight over developing capabilities: This activity consists of managing the execution of cybersecurity capability development through a Quality Plan.

Ensuring that capabilities are being executed and maintained properly: This activity provides oversight over capability execution, i.e., to ensure that processes are being properly followed, resources are properly allocated with properly trained personnel executing processes they have the training and skills to execute, and that tools are available that facilitate process execution and productivity of personnel.

Defining roles and responsibilities and information flows between organizational functions as well the external world: This activity consists of defining roles and responsibilities for cross-functional cybersecurity activities. For instance, who needs to be informed when a cybersecurity incident on a medical device is detected? Between the functions Research and Development (R&D), Information Technology (IT), and Quality, how is responsibility for patching manufacturing and other nonproduct software divvied up? In many large MDMs, there is a corporate PCO with provides corporate-level oversight. This can either be an independent function by itself or be housed within corporate's Global Quality office. How then are roles and responsibilities for cybersecurity allocated between the corporate PCO and the PCO at the divisional level? These and similar questions need to be answered by the Product Security Governance capability.

The capability Product Security Governance itself is responsible for defining, executing, and maintaining the following procedural controls.

COBIT

COBIT is a control framework for employing information security governance best practices within an organization. COBIT was developed by the ISACA (Information Systems Audit and Control Association, see http://www.isaca.org).

COBIT has four domains: Plan and Organize, Acquire and Implement, Deliver and Support, and Monitor and Evaluate. There are 34 IT processes across the 4 domains. More information about COBIT is available at: http://www.isaca.org/Knowledge-Center/COBIT/Pages/Overview.aspx. Version 5 was released in Apr. 2012.

Abstract

This chapter presents a fundamental domain tested on the CISSP, Domain 3: Information Security Governance and Risk Management. Key terms, concepts, and formulas related to risk management are presented within this chapter. Risk, threat, and vulnerability are basic terms that must be understood to prove successful with this domain. Understanding how to perform calculations using Annualized Loss Expectancy (ALE), Single Loss Expectancy (SLE), Annualized Rate of Occurrence (ARO), and Exposure Factor (EF) is highlighted as part of quantitative risk analysis. Important concepts related to information security governance such as privacy, due care, due diligence, certification, and accreditation are also a focus of this chapter.