Security Governance Principles
Security Governance is an important principle that every organization should follow. An organization with security governance focuses on the security of their assets by establishing a framework which ensures the appropriate decisions for securing assets. Security governance & accountability framework aligned the process of an organization with the strategies directs and deploy the standards and policies, manages the responsibilities. Third-party governance organizations such as the National Institute of Standards & Technology provide frameworks used for best practice by organizations.
“The key goal of information security is to reduce adverse impacts on the organisation to an acceptable level.”
Following are some other security management framework & methodologies to for security professionals which includes development standards, security architect, security controls, governance methods & management process:
· ISO/IEC 17799:2005 Information technology - Security techniques - Code of practice for information security management
· ISO/IEC 27000 Series family of Information Security Management Systems
· ISO/IEC 27001 Information Security Management
· ISO/IEC 27002 Information technology -- Security techniques -- Code of practice for information security controls
· Common Criteria (CC) or ISO/IEC 15408
· Information Technology Infrastructure Library (ITIL)
Governance framework includes the assignment of roles and responsibilities, authorities, budgets & resources. At the beginning of an organization, it does not possess enough valuable information but as an organization develops, valuable information increases which require a proper framework of governance. Security Governance framework established a security framework containing well-defined security policies and process, risk assessment, risk management, documented policies & contracts between the employee, employees, and third-parties. Monitoring of all these activities, violations, and taking remediation actions also includes in the governance framework. Following are the basic scope & goals of IT security governance frameworks:
· Risks and threats to an enterprise are always a danger and could have a significant impact on the reputation & stability.
· Reputational & Financial impact can be considerable.
· Effective information security enforcement requires coordinated and integrated actions from the top down.
· Rules, Policies and Priorities need to be defined and enforced effectively.
To understand the processes of an organization, consider the following process:
The acquisition process is when two organizations decide to merge into a single organization or when an organization purchases another one. This scenario brings the security professionals to consider the management processes to ensure the organizational security does not affect from this merger. The merger may bring either modern technology which creates compatibility issues whereas older technology creates security issues. Similarly, the merger of two organization may require security upgrade if the merging organization has more valuable assets.
Another important consideration for security professionals is awareness of rules, regulations, policies, and security awareness training. There might be a possibility that employees of merging organization are not well-aware of security policies & infrastructure.
A final consideration in an acquisition is to develop and deploy new rules, regulations, and policies for new organizations. Renewal of contracts to third-parties, relationships should be reviewed.
The divestiture is a process when a part of an organization is sold or separated. It is a challenge for a security professional to ensure the security. As divestiture impacts the personnel, the possibility of data leakage rises. To mitigate, only existing employees should have access to the resources & the access & privileges of those employees who are the part of this divestiture should be removed or restricted.
Governance Committees of an organization has authority to manage the governance. Committee can recruit, authorize, and take decisions. Security professional has to explain to them the risks to an organization and their security measures.
Organizational Roles and Responsibilities
In an organization, the most important and focus area for the management is the division of roles and responsibilities. Before the division of responsibilities to the individuals, it is necessary to understand the organizational structure and hierarchy. The hierarchy and structure are fundamental to the development of any organization. Structure of an organization is a chain of hierarchy which divide the different roles, responsibilities, levels, and authorities among individuals associated with the organization.
Efficient division of organizational roles & responsibilities will benefit in terms of:
§ Facilitates achievement of the objectives
§ Coordination of all activities
§ Reduces the overall conflicts
§ Eliminates overlapping of processes.
§ Better Communication at every level of organizational structure.
Board of Directors is a committee of directors which are ultimately accountable for governing the corporate. Management division and information security divisions are the integral domains of this governance. Exclusive responsibilities are delegated to the executive directors led by Chief Executive Officer (CEO).
Executive Directors are responsible for approving overall strategic plans and mandates the security principles. Executive Directors are working with Security Committees (SC), Chief Security officers, ISM, Auditors and others to ensure the suitable policies are enforced.
Chief Security Officer (CSO)
Following are the most common and major responsibilities of Chief Security Officer (SCO).
· CSO is responsible for monitoring, motivation and directing the security committees.
· Take the lead in information governance.
· Provide overall strategic directions, supports and monitor processes.
· Monitors & manage Information Security Management (ISM).
Information Security Management (ISM)
The Information Security Management (ISM) is responsible for:
· Responsible for maintaining Technical and non-technical information security standards, procedures and guidelines.
· Reviewing and monitoring compliance with the policy statements.
· Contributing to the Internal Audit and Control Self-Assessment (CSA) processes.
· Supporting IAOs and managers in the implementation of controls, processes and supporting tools.
· Responsible for supporting IAOs in the investigation and remediation of information security incidents or other policy violations.
· Collecting, and analyzing information security metrics and incidents.
· Responsible for other information security-related responsibilities.
Managers are responsible for:
· Enforcing information security policies as per the security manual approved.
· Ensuring the effectiveness, strength of implemented technical & physical security controls.
· Ensuring that all policies are being followed by employees.
· Informing the employees about corporate policies, providing awareness and training.
· Updating or reporting Information Security Management .
· Timely informing ISM about any policy violation.
· Responsible for evaluation of compliance.
· Conducting CSA Processes & Internal Audits.
Information Asset Owners (IAOs)
Information Asset Owners (IAOs) are those individuals, usually managers, who are responsible for the protection of information assetsand protect from hacking. They are accountable for this security by the Security Committee (SC) or local Security Committee (LSC). Major responsibilities of IOAs are:
· Classification and Protection of information assets.
· Managing Proactive Controls
· Authorizing access to information assets as per requirement
· Monitoring compliance with protection requirements affecting their assets
End-Users responsibilities are as follows:
· Responsible for complying with all security requirements & policies of an organization.
· Responsible for complying with contractual requirements (such as non-disclosure agreements and Service Level Agreements).
· Moral Responsibility of secure organizational sensitive information and information assets.
· Participating in information security training and awareness efforts.
· Reporting any suspicious activity, security violations, security problems, or security concerns to appropriate personnel.
Security governance is a set of principles that has used by the certified information security officer (CISO) and managers to set out strategic goals. It should also ensure effective fulfillment of information security targets. Moreover, there is a need to ensure that risks have managed properly and that a company’s resources have used responsibly.
