Information Security and Assurance

1
Planning for Security

Planning for Security

Learning Objectives

At the end of the module the student is expected to:

1. Recognize the importance of planning and describe the principal

components of organizational planning.

2. Know and understand the principal components of information security

system implementation planning as it functions within the organizational

planning scheme.

Introduction

A successful organization trusts on proper organizational planning.

in an environment where continues threats are visible organization must rely

on, human, financial, good planning. Planning groups of people in the

organization composes of internal and external entities which includes

employees, management, stockholders, other outside stakeholders, the

physical environment, the political and legal environment, the competitive

environment, and the technological environment.

Components of Planning

The components of a strategic plan include the vision statement,

mission statement, strategy, and a series of hierarchical and

departmental plans.
Course Module
 Developing the organizational plan for information security depends

upon the direction of the organization.

Since the information security community of interest seeks to influence

the broader community in which it operates, the effective information security

planner should know how the organizational planning process works so that

participation in the process can yield meaningful results.

Planning is the enumeration of a sequence of action steps intended to

achieve specific goals, and then controlling the implementation of these steps.

Planning provides direction for the organization’s future. Organizational

planning should be undertaken using a top-down process in which the

organization’s leaders choose the direction and initiatives that the entire

organization should pursue.

The primary goal of the organizational planning process is the

creation of detailed plans: systematic directions on how to meet the

organization’s objectives. This is accomplished with a process that begins

with the general end ends with the specific.

Components of Organizational Planning

Mission

The mission statement explicitly declares the business of the

organization, as well as its intended areas of operations. It is, in a sense, the

organization’s identity card.

 Information Security and Assurance
3
Planning for Security

Vision

Mission statement, which expresses what the organization is, the vision

statement expresses what the organization wants to become. Vision

statements therefore should be ambitious; after all, they are meant to express

the aspirations of the organization and to serve as a means for visualizing its

future.

Values

By establishing a formal set of organizational principles, standards, and

qualities in a values statement, as well as benchmarks for measuring behavior

against these published values, an organization makes its conduct and

performance standards clear to its employees and the public.

Strategy

Strategy, or strategic planning, is the basis for long-term direction for

the organization. Strategic planning in general guides organizational efforts,

and focuses resources toward specific, clearly defined goals, in the midst of an

ever-changing environment.

Strategic planning is a disciplined effort to produce fundamental

decisions and actions that shape and guide what an organization is, what it

does, and why it does it, with a focus on the future.”

Course Module
 Top-Down Strategic planning for IS

Planning for the Organization

After an organization develops a general strategy, it creates an overall

strategic plan by executing the general strategy

Planning for the organization

 Information Security and Assurance
5
Planning for Security

Planning Levels

Once the organization’s overall strategic plan is translated into

strategic goals the next step is to translate these strategies into tasks with

specific, measurable, achievable and time-bound objectives.

Strategic planning then begins a transformation from general,

sweeping statements toward more specific and applied objectives.

Tactical planning has a shorter focus than strategic planning, usually

one to three years. Tactical planning breaks down each applicable strategic

goal into a series of incremental objectives. Managers and employees use the

operational plans, which are derived from the tactical plans, to organize the

ongoing, day-to-day performance of tasks.

The operational plan includes clearly identified coordination

activities across department boundaries, communications requirements,

weekly meetings, summaries, progress reports, and associated tasks.

Planning levels

Course Module
 Planning and the CISO

The first priority of the CISO and information security manager should

be the structure of a strategic plan.

While each organization may have its own format for the design and

distribution of a strategic plan, the fundamental elements of planning are the

same.

Elements of a strategic plan

 Introduction by the President of the Board or CEO

 Executive Summary
 Mission Statement and Vision Statement
 Organizational Profile and History
 Strategic Issues and Core Values
 Program Goals and Objectives
 Management/Operations Goals and Objectives
 Appendices (optional) (strengths, weaknesses, opportunities and threats
(SWOT) analyses, surveys, budgets etc).”

Some additional tips for planning include:

 Create a compelling vision statement that frames the evolving plan, and
acts as a magnet for people who want to make a difference.
 Embrace the use of a balanced scorecard approach, which demands the use
of a balanced set of measures and cause & effect thinking.
 Deploy a draft high level plan early, and ask for input from stakeholders in
the organization.
 Make the evolving plan visible.
 Make the process invigorating for everyone.
 Be persistent.
 Make the process continuous.
 Provide meaning.
 Be yourself.
 Lighten up and have some fun.
 Information Security and Assurance
7
Planning for Security

Planning for Information Security Implementation

The CIO and CISO play important roles in translating overall strategic

planning into tactical and operational information security plans information

security.

The CISO plays a more active role in the development of the planning

details than does the CIO.

The job description for the Information Security Department Manager from

Information Security Roles and Responsibilities Made Easy is:

 Creates a strategic information security plan with a vision for the future of

information security at Company X (utilizing evolving information security

technology, this vision meets a variety of objectives such as management's

fiduciary and legal responsibilities, customer expectations for secure

modern business practices, and the competitive requirements of the

marketplace)

 Understands the fundamental business activities performed by Company

X, and based on this understanding, suggests appropriate information

security solutions that uniquely protect these activities

 Develops action plans, schedules, budgets, status reports and other top

management communications intended to improve the status of

information security at Company X

Course Module
 Once the organization’s overall strategic plan has been translated into

IT and information security departmental objectives by the CIO, and then

further translated into tactical and operational plans by the CISO, the

implementation of information security can begin.

Implementation of information security can be accomplished in two ways:

bottom-up or top-down.

Approaches to security implementation

The bottom-up approach can begin as a grass-roots effort in which

systems administrators attempt to improve the security of their systems.

The key advantage to this approach is the technical expertise of the

individual administrators, since they work with information systems on a

daily basis.

This approach seldom works, as it lacks a number of critical features,

such as coordinated planning from upper management, coordination between

departments, and the provision of sufficient resources.

 Information Security and Assurance
9
Planning for Security

The top-down approach, in contrast, has strong upper management

support, a dedicated champion, usually assured funding, a clear planning and

implementation process, and the ability to influence organizational culture.

High-level managers provide resources, give direction, issue policies,

procedures and processes, dictate the goals and expected outcomes of the

project, and determine who is accountable for each of the required actions.

The most successful top-down approach also involves a formal

development strategy referred to as the systems development life cycle.

For any top-down approach to succeed, however, high-level

management must buy into the effort and provide all departments with their

full support.

Such an initiative must have a champion—ideally, an executive with

sufficient influence to move the project forward, ensure that it is properly

managed, and push for acceptance throughout the organization.

Involvement and support of the end users is also critical to the success

of this type of effort.

Introduction to the SECSDLC

The general systems development life cycle (SDLC) is a methodology

for the design and implementation of an information system in an organization

widely used in IT organizations.

Course Module
 A methodology is a formal approach to solving a problem based on a

structured sequence of procedures. Using a methodology ensures a rigorous

process, and increases the likelihood of achieving the desired final objective.

SDLC-based project may be event-driven, that is, started in response to

some event in the business community, inside the organization, or within the

ranks of employees, customers or other stakeholders. Or it could be plan-

driven, that is, the result of a carefully developed planning strategy.

At the end of each phase, a structured review or reality check takes

place, during which the team and its management-level reviewers determine

if the project should be continued, discontinued, outsourced, or postponed

until additional expertise or organizational knowledge is acquired.

The SDLC mention in this module is a modified methodology as

compared in the previous module, it includes six phases as compare to five

from the previous module.

Investigation

It identifies the problem that the system being developed is to solve.

Beginning with an examination of the event or plan that initiates the process,

the objectives, constraints, and scope of the project are specified.

 Information Security and Assurance
11
Planning for Security

A preliminary cost/benefit analysis is developed to evaluate the

perceived benefits and the appropriate costs for those benefits.

Analysis

The analysis phase begins with the information learned during the

investigation phase. This phase assesses the organization’s readiness, its

current systems status, and its capability to implement and then support the

proposed systems.

Analysts determine what the new system is expected to do, and how it

will interact with existing systems.

Logical Design

In the logical design phase, the information obtained during the

analysis phase is used to create a proposed system-based solution for the

business problem.

Course Module
 Based on the business need, the team selects systems and/or

applications capable of providing the needed services.

Finally, based on all of the above, the team selects specific types of

technical controls that might prove useful when implemented as a physical

solution.

The logical design is the implementation independent blueprint for the

desired solution.

Physical Design

During the physical design phase, the team selects specific technologies

that support the alternatives identified and evaluated in the logical design.

The selected components are evaluated further as a make-or-buy

decision, then a final design is chosen that integrates the various required

components and technologies.

Implementation

In the implementation phase, the organization’s software engineers

develop any software that is not to be purchased, and take steps to create

integration modules.

These customized elements are tested and documented. Users are

trained and supporting documentation is created. Once all components have

been tested individually, they are installed and tested.

 Information Security and Assurance
13
Planning for Security

Maintenance

This phase consists of the tasks necessary to support and modify the

system for the remainder of its useful life cycle. Periodically, the system is

tested for compliance, and the feasibility of continuance versus

discontinuance is evaluated.

Upgrades, updates, and patches are managed.

When the current system can no longer support the changed mission of

the organization, it is terminated and a new systems development project is

undertaken.

The Security Systems Development Life Cycle (SecSDLC)

The security systems development life cycle (SecSDLC), may differ in

several specific activities, but the overall methodology is the same.

Course Module
 The SecSDLC process involves the identification of specific threats and

the risks that they represent, and the subsequent design and implementation

of specific controls to counter those threats and assist in the management of

the risk.

Investigation in the SecSDLC

The investigation phase of the SecSDLC begins with a directive from

upper management specifying the process, outcomes, and goals of the project,

as well as its budget and other constraints.

Frequently, this phase begins with the affirmation or creation of

security policies on which the security program of the organization is or will

be founded.

Teams of managers, employees, and contractors are assembled to

analyze problems, define their scope, specify goals and objectives, and identify

any additional constraints not covered in the enterprise security policy.

Finally, an organizational feasibility analysis determines whether the

organization has the resources and commitment to conduct a successful

security analysis and design.

Analysis in the SecSDLC

The development team created during the investigation phase

conducts a preliminary analysis of existing security policies or programs,

along with documented current threats and associated controls.

This phase also includes an analysis of relevant legal issues that could

affect the design of the security solution.

The risk management task also begins in this stage.

 Information Security and Assurance
15
Planning for Security

Risk Management is the process of identifying, assessing, and

evaluating the levels of risk facing the organization, specifically the threats to

the organization’s security and to the information stored and processed by the

organization.

To better understand the analysis phase of the SecSDLC, you should

know something about the kinds of threats facing organizations in the modern,

connected world of information technology (or IT).

In this context, a threat is an object, person, or other entity that represents a

constant danger to an asset.

Threats to Information Security:

Course Module
 An attack is a deliberate act that exploits a vulnerability. It is

accomplished by a threat agent that damages or steals an organization’s

information or physical asset.

An exploit is a technique or mechanism used to compromise a system.

A vulnerability is an identified weakness of a controlled system in which

necessary controls are not present or are no longer effective.

An attack is the use of an exploit to achieve the compromise of a

controlled system.

Common attacks include:

 Malicious code.
 Hoaxes .
 Back doors.
 Password crack.
 Brute force.
 Dictionary.
 Denial-of-service (DoS) and distributed denial-of-service (DDoS).
 Spoofing.
 Man-in-the-middle
 Spam.
 Mail bombing.
 Sniffer.
 Social engineering.
 Buffer overflow
 Timing.

The last step in knowing the enemy is to find some method of prioritizing

the risk posed by each category of threat and its related methods of attack.

This can be done by adopting threat levels from an existing study of

threats, or by creating your own categorization of threats for your

environment based on scenario analyses.

 Information Security and Assurance
17
Planning for Security

To manage risk, you must identify and assess the value of your information

assets.

This iterative process must include a classification and categorization of all

of the elements of an organization’s systems: people, procedures, data and

information, software, hardware and networking elements.

The next challenge in the analysis phase is to review each information asset

for each threat it faces and create a list of the vulnerabilities. As the analysis

phase continues, the next task is to assess the relative risk for each of the

information assets. We accomplish this by a process called risk assessment or

risk analysis.

Risk assessment assigns a comparative risk rating or score to each specific

information asset. Risk management is the part of the analysis phase that

identifies vulnerabilities in an organization’s information systems and takes

carefully reasoned steps to assure the confidentiality, integrity, and

availability of all the components in the organization’s information system.

Design in the SecSDLC

The design phase actually consists of two distinct phases, the logical

design and the physical design.

Course Module
 In the logical design phase, team members create and develop the

blueprint for security, and examine and implement key policies that influence

later decisions.

In the physical design phase, team members evaluate the technology

needed to support the security blueprint, generate alternative solutions, and

agree upon a final design.

Between the of logical and physical design phases, a security manager

may seek to use established security models to guide the design process.

Security models provide frameworks for ensuring that all areas of

security are addressed; organizations can adapt or adopt a framework to meet

their own information security needs.

One of the design elements of the information security program is the

information security policy of the organization.

Management must define three types of security policy:

1) General or security program policy,

2) Issue-specific security policies and
3) Systems-specific security policies.

Another integral part of the information security program to be designed

is the security education and training (SETA) program.

The SETA program consists of three elements: security education, security

training, and security awareness.

The purpose of SETA is to enhance security by

1) Improving awareness of the need to protect system resources;

2) developing skills and knowledge so computer users can perform their jobs
more securely and
 Information Security and Assurance
19
Planning for Security

3) building in-depth knowledge, as needed, to design, implement, or operate

security programs for organizations and systems.”

As the design phase continues, attention turns to the design of the controls

and safeguards used to protect information from attacks by threats.

There are three categories of controls:

 Managerial controls address the design and implementation of the security

planning process and security program management. Management

controls also addresses risk management and security controls reviews.

 Operational Controls cover management functions and lower level

planning, such as disaster recovery and incident response planning.

Operational controls also address personnel security, physical security and

the protection of production inputs and outputs.

 Technical Controls address those tactical and technical issues related to

designing and implementing security in the organization. Here the

technologies necessary to protect information are examined and selected.

Another element of the design phase is the creation of essential

preparedness documents.

 Contingency planning (CP) is the entire planning conducted by the

organization to prepare for, react to and recover from events that threaten

the security of information and information assets in the organization, and

the subsequent restoration to normal business operations.

Course Module
  Incident response planning (IRP) is the planning process associated with

the identification, classification, response, and recovery from an incident.

 Disaster recovery planning (DRP) is the planning process associated with

the preparation for and recovery from a disaster, whether natural or man-

made.

 Business continuity planning (BCP) is the planning process associated with

ensuring that critical business functions continue if a catastrophic incident

or disaster occurs.

As the design phase progresses, attention now focuses on physical security,

which addresses the design, implementation, and maintenance of

countermeasures that protect the physical resources of an organization.

Physical resources include people, hardware, and the supporting system

elements and resources associated with the management of information in all

its states, transmission, storage, and processing.

Implementation in the SecSDLC

The security solutions are acquired, tested, implemented, and tested

again. Personnel issues are evaluated and specific training and education

programs conducted.

Perhaps the most important element of the implementation phase is

the management of the project plan.

The major steps in executing the project plan are

1) planning the project,

2) supervising the tasks and action steps within the project plan, and
3) wrapping up the project plan.
 Information Security and Assurance
21
Planning for Security

Information security is a field with a vast array of technical and non-

technical requirements.

The project team should consist of a number of individuals who are

experienced in one or multiple requirements of both the technical and non-

technical areas.

 The champion
 The team leader
 Security policy developers
 Risk assessment specialists
 Security professionals
 Systems administrators
 End users.

Just as each potential employee and potential employer look for the best

fit, each organization should examine the options possible for staffing of the

information security function.

 First, the entire organization must decide how to position and name the

security function within the organization.

 Second, the information security community of interest must plan for the

proper staffing (or adjustments to the staffing plan) for the information

security function.

 Third, the IT community of interest must understand the impact of

information security across every role in the IT function and adjust job

descriptions and documented practices accordingly.

Course Module
  Finally, the general management community of interest must work with

the information security professionals to integrate solid information

security concepts into the personnel management practices of the

organization.

It takes a wide range of professionals to support a diverse information

security program

 Chief Information Officer (CIO)

 Chief Information Security Officer (CISO)
 Security Managers
 Security Technicians
 Data Owners
 Data Custodians
 Data Users

Many organizations seek professional certification so that they can more

easily identify the proficiency of job applicants:

 CISSP
 SSCP
 GIAC
 SCP
 ICSA
 Security +
 CISM

Maintenance and Change in the SecSDLC

Once the information security program is implemented, it must be

operated, properly managed, and kept up to date by means of established

procedures.

If the program is not adjusting adequately to the changes in the internal

or external environment, it may be necessary to begin the cycle again.

 Information Security and Assurance
23
Planning for Security

While a systems management models is designed to manage and operate

systems, a maintenance model is intended to complement a systems

management model and focus organizational effort on system maintenance.

 External monitoring.

 Internal monitoring. .

 Planning and risk assessment.

 Vulnerability assessment and remediation

 Readiness and review.

 Vulnerability assessment

One of the maintenance issues that must be planned in the SecSDLC is the

systems management model that will be used. The ISO management model is

a five-area approach that provides structure to the administration and

management of networks and systems. These five areas are:

 Fault management

 Configuration and name management

 Accounting management

 Performance management

 Security management

Course Module
 Fault Management. Involves identifying and addressing faults in the

applied information security profile and then addressing them. Also, the

monitoring and resolution of user complaints.

Configuration and Change Management. The administration of various

components involved in the security program as well as changes in the

strategy, operation, or components of the information security program.

Accounting and Auditing Management involves chargeback accounting,

and systems monitoring.

 Information Security and Assurance
25
Planning for Security

Chargeback accounting happens when organizations internally charge

their departments for system use. While chargebacks are seldom used today,

certain kinds of resource usage are commonly tracked—such as those on a

computing system (like a server or a desktop computer) or human effort-

hours—to recover IT costs from non-IT units of the organization. Accounting

management involves monitoring the use of a particular component of a

system. In networking, this monitoring may simply determine which users are

using which resources. However, in security, it may be easy to track which

resources are being used but difficult to determine who is using them, at which

point, accounting management begins to overlap with performance

management, which is addressed in the next section. With accounting

management you begin to determine optimal points of systems use as

indicators for upgrade and improvement. Auditing is the process of reviewing

the use of a system, not to determine its performance, but to determine if

misuse or malfeasance has occurred.

Course Module
 Performance Management. Because many information security technical

controls are implemented on common IT processors, they are affected by the

same factors as most computer-based technologies. It is therefore important

to monitor the performance of security systems and their underlying IT

infrastructure to determine if they are effectively and efficiently doing the job

they were implemented to do. Some information security control systems,

such as Internet usage monitors that look for inappropriate use of Internet

resources, operate as pass-by devices.

Security Program Management. Once an information security program is

functional it must be operated and managed. The ISO five-area framework

provides some structure for a management model; however, it focuses on

ensuring that various areas are addressed, rather than guiding the actual

conduct of management. In order to assist in the actual management of

information security programs, a formal management standard can provide

some insight into the processes and procedures needed. This could be based

on the BS7799/ISO17799 model or the NIST models described earlier.

 Information Security and Assurance
27
Planning for Security

Comparing the SDLC and the SecSDLC

Course Module