Ch05 Developing security Program.docx

Chapter 5 Developing Security Programs Chapter Overview Chapter 5 will explore the various organizational approaches to information security and provide an explanation of the functional components of the information security program. Readers will learn how to plan and staff an organization’s information security program based on its size and other factors as well as how to evaluate the internal and external factors that influence the activities and organization of an information security program. As the topic of organizing the information security function is expanded upon, the reader will learn how to identify and describe the typical job titles and functions performed in the information security program. The chapter concludes with an exploration of the components of a security education, training, and awareness program and describes how organizations create and manage these programs. Chapter Objectives When you complete this chapter, you will be able to: Recognize and understand the organizational approaches to information security List and describe the functional components of the information security program Determine how to plan and staff an organization’s information security program based on its size Evaluate the internal and external factors that influence the activities and organization of an information security program List and describe the typical job titles and functions performed in the information security program Describe the components of a security education, training, and awareness program and understand how organizations create and manage these programs Set-up Notes This chapter could be completed in a single class session, if there is sufficient time to cover the material. Unless the students have not had the opportunity to read the material in advance (in some settings, the textbooks are not made available until the first class meeting), it may be prudent to have a general discussion of the topic, with detailed lecture to follow at the next class meeting. The subject matter can be covered in 1.25 to 2.5 hours. Lecture Notes and Teaching Tips with Quick Quizzes Introduction Some organizations use the term “security program” to describe the entire set of personnel, plans, policies, and initiatives related to information security. The term information security program is used here to describe the structure and organization of the effort that contains risks to the information assets of the organization. Organizing for Security Among the variables that determine how to structure an information security program are organizational culture size security personnel budget security capital budget “…as organizations get larger in size, their security departments are not keeping up with the demands of increasingly complex organizational infrastructures. Security spending per user and per machine declines exponentially as organizations grow, leaving most handcuffed when it comes to implementing effective security procedures.” Security in Large Organizations The large organization – 1,000 to 10,000 computers Information security departments in such organizations tend to form and re-form internal groups to meet long-term challenges even as they handle day-to-day security operations. Thus functions are likely to be split into groups in larger organizations; in contrast, smaller organizations typically create fewer groups, perhaps only having one general group representing the communities of interest. At this size the organization’s approach to security has matured, integrating planning and culture into policy, “80% of organizations say at least some security decisions are guided by them.” Unfortunately, the large organization does not put large amounts into security, with huge numbers of computers and users. They tend to spend substantially less on security (only about 5 percent of the total IT budget on average) creating issues across the organization, especially in the “people” areas. The very large organization – more than 10,000 computers Security budgets grow faster than IT budgets. Even with a huge multi-million dollar budget, the average amount per user is still smaller than any other type of organization. “Where small orgs spend more than $5,000 per user on security, very large organizations spend about 1/18th of that, roughly $300 per user” originating from 6 percent of the total IT budget. Does a better job in the policy and resource mgmt areas, although “only 1/3 of organizations handled incidents according to an IR plan.” One recommended approach is to separate the functions into four areas: Functions performed by non-technology business units outside of the information technology area of management control, such as: - Legal, - Training Functions performed by IT groups outside of the information security area of management control, such as: Systems security administration Network security administration Centralized authentication Functions performed within the information security department as a customer service to the organization and its external partners, such as Risk assessment Systems testing Incident response Planning Measurement Vulnerability assessment Functions performed within the information security department as a compliance enforcement obligation, such as Policy Compliance Risk management It remains the CISO’s responsibility to see that information security functions are adequately performed somewhere within the organization. The deployment of full-time security personnel depends on a number of factors, including sensitivity of the information to be protected, industry regulations and general profitability. The more money the company can dedicate to its personnel budget, the more likely it is to maintain a large information security staff. Security in Medium-Sized Organizations The medium sized organization - 100-1,000 computers - Has a smaller budget (about 11% of the IT budget) Has about the same sized security staff as the small org, but a larger need. The medium org’s security people must rely on help from IT staff for plans and practices. “Their ability to set policy, handle incidents in a regular manner and effectively allocate resources are, overall, worse than any other group. “Considering their size, the number of incidents they recognize is skyrocketing. “Some 70 percent of them had damages from security breaches, a 48 percent increase over small organizations.” These organizations may still be large enough to implement the multi-tiered approach to security described previously for large organizations, though perhaps with fewer dedicated groups and more functions assigned to each group. Medium-sized organizations tend to ignore some security functions—in particular, when the information security department cannot staff a certain function and the IT or other department is not encouraged or required to perform that function in its stead. Security in Small Organizations The small organization - 10-100 computers Has a simple, centralized IT organizational model. Spends disproportionately more on security, almost 20 percent of the total IT budget. The typical security staff in this organization is usually only one person. “… More than two-thirds say all or most of their security decisions are guided by management-approved policies, and 57 percent say that all or most of their responses to incidents were guided by a predefined IR plan.” Information security in the small org is often the responsibility of a single security administrator. Such organizations frequently have little in the way of formal policy, planning, or security measures, and they commonly outsource their Web presence or electronic commerce operations. Because resources in smaller organizations are often limited, the security admin may use freeware or ‘hackerware’ to lower the costs of assessing and implementing security. Security training and awareness is commonly conducted on a 1-on-1 basis, with the security admin providing advice to users as needed. Any policies are likely to be issue-specific policies. Formal planning is usually part of the IT planning conducted by the CIO. To their advantage, small organizations avoid some threats precisely because of their size. Threats from insiders are also less likely in an environment where every employee knows every other employee. Quick Quiz What are the variables that determine how to structure an information security program? ANSWER: organizational culture, size, security personnel budget, security capital budget. Teaching Tip Be sure to emphasize that most every information security group will be organized differently. The examples of relative size and headcounts given above are not hard and fast rules, rather they are observed examples. Placing Information Security within an Organization In large organizations InfoSec is often located within the information technology department, headed by the CISO who reports directly to the top computing executive, or CIO. By its very nature, an InfoSec program is sometimes at odds with the goals and objectives of the IT department as a whole. Because the goals and objectives of the CIO and the CISO may come in conflict, it is not difficult to understand the current movement to separate information security from the IT division. The challenge is to design a reporting structure for the InfoSec program that balances the needs of each of the communities of interest. “The ideal middle-level [security] manager should report directly to the CEO, or as high up on the organizational hierarchy as possible. “The manager’s organizational unit will also need a credible day-to-day relationship with, or a strategic tie-in with, the information security function.” Wood’s Other Options: Option 7: Internal Audit Option 8: Help Desk Option 9: Accounting and Finance through IT Option 10: Human Resources Option 11: Facilities Management Option 12: Operations Quick Quiz What is the challenge when designing a reporting structure for an InfoSec program? ANSWER: The challenge is to design a reporting structure for the InfoSec program that balances the needs of each of the communities of interest. Teaching Tip If you have access to the …Made Easy series of books from Charles Cresson Wood, they make excellent classroom examples both here and in the chapter that follows on policy. If available, bring them to class and hand them around as an example. Components of the Security Program The information security needs of any organization are unique to the culture, size, and budget of that organization. Determining what level the information security program operates on depends on the organization’s strategic plan, and in particular on the plan’s vision and mission statements. The CIO and CISO should use these two documents to formulate the mission statement for the information security program. Information Security Roles and Titles Information security positions can be classified into one of three types: those that define, those that build, and those that administer. “Definers provide the policies, guidelines, and standards […] They’re the people who do the consulting and the risk assessment, who develop the product and technical architectures. These are senior people with a lot of broad knowledge, but often not a lot of depth. Quick Quiz What two documents should be used by the CIO and CISO to formulate the mission statement for an InfoSec program? ANSWER: They should use the vision and missions statements of the org’s strategic plans. Teaching Tip A discussion of the three roles (definer, builder and administrator helps to clarify then kinds of jobs that are present for information security professionals. Many times, one individual will fill all the roles (especially in smaller organizations) but many of the more common job descriptions will tie to one of these three roles. Information Security Roles and Titles ”Then you have the builders. They’re the real techies, who create and install security solutions. “Finally, you have the people who operate and administrate the security tools, the security monitoring function, and the people who continuously improve the processes.” A typical organization has a number of individuals with information security responsibilities. While the titles used may be different, most of the job functions fit into one of the following: Chief Information Security Officer (CISO) Security managers Security administrators and analysts Security technicians Security staffer Integrating Security and the Help Desk An important part of the information security team is the help desk, which enhances the security team’s ability to identify potential problems. When a user calls the help desk with a complaint about his or her computer, the network, or an Internet connection, the user’s problem may turn out to be related to a bigger problem, such as a hacker, denial-of-service attack, or a virus. Because help desk technicians perform a specialized role in information security, they have a need for specialized training. Quick Quiz What general job functions belong to an InfoSec program? ANSWER: Chief Information, Security Officer (CISO), Security managers, Security administrators and analysts, Security technicians, and Security staffer. Teaching Tip Try to tie in some local organizational examples from your institution in a discussion of how security roles and titles are used. If some students are employed (or are interns) in the information security area, ask them to share their examples with the class. Implementing Security Education, Training, and Awareness Programs Once the InfoSec program’s place in the organization is established, planning for security education, training, and awareness (SETA) programs begins. The SETA program is designed to reduce the incidence of accidental security breaches by employees, contractors, consultants, vendors, and business partners. Awareness, training, and education programs offer two major benefits: They can improve employee behavior. They enable the organization to hold employees accountable for their actions. A SETA program consists of three elements: security education, security training, and security awareness. The purpose of SETA is to enhance security… By building in-depth knowledge, as needed, to design, implement, or operate security programs for organizations and systems By developing skills and knowledge so that computer users can perform their jobs while using IT systems more securely By improving awareness of the need to protect system resources Security Education Employees within the information security department, not prepared by their background or experience, may be encouraged to use a formal education method. A number of institutions of higher learning, including colleges and universities, provide formal coursework in information security. Unfortunately, a recent review of such institutions offering formal programs in information security or computer security found that the majority of those granting degrees (bachelor’s or master’s) were in reality, providing computer science or information systems degrees that included a course or two in information security. Developing Information Security Curricula Hybrid information technology/security programs have emerged to fill the gap created by the lack of guidance from established curricula bodies. Any institution designing a formal curriculum in information security must carefully map the expected learning outcomes of the planned curriculum to course learning objectives to establish the body of knowledge to be taught. This knowledge map, which can help potential students assess information security programs, identifies the skills and knowledge clusters obtained by the program’s graduates. Creating a knowledge map can be difficult because many academics are unaware of the numerous sub-disciplines within the field of information security, each of which may have different knowledge requirements. Depth of knowledge is indicated by a level of mastery using an established taxonomy of learning objectives or a simple scale such as “understanding ? accomplishment ? proficiency ? mastery.” Because many institutions have no frame of reference for which skills and knowledge are required for a particular job area, frequently they refer to the certifications offered in that field. Once the knowledge areas are identified, common knowledge areas are aggregated into teaching domains, from which individual courses can be created. Courses should be designed so that the student can obtain the required knowledge and skills upon completion of the program. The final step is to identify the prerequisite knowledge for each class. Security Training Security training involves providing members of the organization with detailed information and hands-on instruction to enable them to perform their duties securely. Management of information security can wither develop customized in-house training or outsource all or part of the training program. There are two methods for customizing training for users. The first is by functional background: General user Managerial user Technical user who can be further divided by Job category Job function Technology product The second is by skill level: Novice Intermediate Advanced Training Techniques Using the wrong method can actually hinder the transfer of knowledge and lead to unnecessary expense and frustrated, poorly trained employees. Good training programs, regardless of delivery method, take advantage of the latest learning technologies and best practices. Recent developments include less use of centralized public courses and more on-site training. “Training is often needed for one or a few individuals, not necessarily for a large group. “Waiting until there is a large-enough group for a class can cost companies lost productivity. “Other best practices include the increased use of short, task-oriented modules and training sessions, available during the normal work week, that are immediate and consistent.” Delivery Methods Selection of the training delivery method is not always based on the best outcome for the trainee. Often other factors — budget, scheduling, and needs of the organization —come first. One-on-One Formal Class Computer-Based Training (CBT) Distance Learning/Web Seminars User Support Group On-the-Job Training Self-Study (Noncomputerized) Selecting the Training Staff To provide employee training, an organization can use a local training program, a continuing education department, or another external training agency. Alternatively, it can hire a professional trainer, a consultant, or someone from an accredited institution to conduct on-site training. It can also organize and conduct training in-house using its own employees. Implementing Training While each organization develops its own strategy based on the techniques discussed above, the following seven-step methodology generally applies: Step 1: Identify program scope, goals, and objectives. Step 2: Identify training staff. Step 3: Identify target audiences. Step 4: Motivate management and employees. Step 5: Administer the program. Step 6: Maintain the program. Step 7: Evaluate the program. Security Awareness One of the least frequently implemented, but most effective security methods is the security awareness program. Security awareness programs: (1) set the stage for training by changing organizational attitudes to realize the importance of security and the adverse consequences of its failure; and (2) remind users of the procedures to be followed. When developing an awareness program, there are certain important ideas to keep in mind: Focus on people both as part of the problem and as part of the solution. Refrain from using technical jargon; speak the language the users understand. Use every available venue to access all users. Define at least one key learning objective, state it clearly, and provide sufficient detail and coverage to reinforce the learning of it. Keep things light; refrain from “preaching” to users. Don’t overload the users with too much detail or too great a volume of information. Help users understand their roles in InfoSec and how a breach in security can affect their jobs. Take advantage of in-house communications media to deliver messages. Make the awareness program formal; plan and document all actions. Provide good information early, rather than perfect information late. The Ten Commandments of InfoSec Awareness Training Information security is a people, rather than a technical, issue. If you want them to understand, speak their language. If they cannot see it, they will not learn it. Make your point so that you can identify it and so can they. Never lose your sense of humor. Make your point, support it, and conclude it. Always let the recipients know how the behavior that you request will affect them. Ride the tame horses. Formalize your training methodology. Always be timely, even if it means slipping schedules to include urgent information. Employee Behavior and Awareness Security awareness and security training are designed to modify any employee behavior that endangers the security of the organization’s information. Security training and awareness activities can be undermined, however, if management does not set a good example. Employee Accountability Effective training and awareness programs make employees accountable for their actions. Dissemination and enforcement of policy become easier when training and awareness programs are in place. Demonstrating due care and due diligence can help indemnify the institution against lawsuits. Awareness Techniques Awareness can take on different forms for particular audiences. A security awareness program can use many methods to deliver its message. Effective security awareness programs need to be designed with the recognition that people tend to practice a tuning out process (acclimation). For this reason, awareness techniques should be creative and frequently changed. Developing Security Awareness Components Many security awareness components are available at little or no cost. Others can be very expensive if purchased externally. Security awareness components include the following items: Videos Posters and banners Lectures and conferences Computer-based training Newsletters Brochures and flyers Trinkets (coffee cups, pens, pencils, T-shirts) Bulletin boards The Security Newsletter A security newsletter is the most cost-effective way to disseminate security information. Newsletters can be in the form of hard copy, e-mail, or intranet-based. Topics can include threats to the organization’s information assets, schedules for upcoming security classes, and the addition of new security personnel. The goal is to keep the idea of information security uppermost in users’ minds and to stimulate them to care about security. Newsletters might include: Summaries of key policies Summaries of key news articles A calendar of security events, including training sessions, presentations, and other activities Announcements relevant to information security How-To’s The Security Poster A security poster series can be a simple and inexpensive way to keep security on people’s minds. Professional posters can be quite expensive, so in-house development may be the best solution. Keys to a good poster series: Varying the content and keeping posters updated Keeping them simple, but visually interesting Making the message clear Providing information on reporting violations The Trinket Program Trinkets may not cost much on a per-unit basis, but they can be expensive to distribute throughout an organization. Several types of trinkets are commonly used: Pens and pencils Mouse pads Coffee mugs Plastic cups Hats T-shirts The messages trinket programs impart will be lost unless reinforced by other means. Information Security Awareness Web Site Organizations can establish Web pages or sites dedicated to promoting information security awareness. As with other SETA awareness methods, the challenge lies in updating the messages frequently enough to keep them fresh. The latest and archived newsletters can reside on the Web site, along with press releases, awards, and recognitions. Some tips on creating and maintaining an educational Web site are provided here: See what’s already out there. Plan ahead. Keep page loading time to a minimum. Seek feedback. Assume nothing and check everything. Spend time promoting your site. One final recommendation is to place your Web site on the intranet. Security Awareness Conference/Presentations Another means of renewing the information security message is to have a guest speaker or even a mini-conference dedicated to the topic—perhaps in association with Computer Security Day - November 30. Quick Quiz What is a SETA program? ANSWER: It is the Security Education Training and Awareness program. Teaching Tip Try to acquire example trinkets from SETA programs. These can often be found at trade shows, or by calling on local representatives of software and hardware vendors. If you can get a sufficient quantity for the members of the class, students usually get a great deal of enjoyment from ‘something for nothing’ and this can be used to emphasize the value of these types of programs. Your own campus may have such a program in place and be able to send a representative to your class to make a presentation. Discussion Topics Collectively write job descriptions for one or a few of the roles on an information security program for your institution. As a group, review the organization chart for your campus information security program (or if there is none, a local business organization). How is it similar to the examples in the text? How is it different? Key Terms Due care Due diligence Security education, training, and awareness (SETA) Security newsletter Security poster Trinket program