Perform 7 Steps To Information Protection

18/03/2010 11:17:14 Perform 7 steps to information protection 1

Perform 7 steps to information protectionDocument created: 18/03/2010 11:17:14


Table of Contents

1 Perform 7 steps to information protection............................................................................................. 41.1 Meet Compliancy regulations....................................................................................................... 51.2 Maximize Data security............................................................................................................... 51.3 Safeguard Intellectual property.................................................................................................... 51.1 Assess information Loss & compromise risks.................................................................................. 5

1.1.1 Determine info protection Strategy approach & priorities..........................................................51.1.1.1 Conduct a Risk assessment and survey.......................................................................... 6

1.1.1.1.1 Identify which Info should be protected.................................................................. 71.1.1.1.2 Distinguish Types of confidential information...........................................................7

1.1.1.1.2.1 Apply Classifications.....................................................................................71.1.1.1.3 Determine Perceived risks.................................................................................... 71.1.1.1.4 Identify Existing info protection............................................................................. 7

1.1.1.1.4.1 Identify Policies........................................................................................... 81.1.1.1.4.2 Identify Procedures...................................................................................... 81.1.1.1.4.3 Identify Practices......................................................................................... 8

1.1.1.1.5 Identify high risk Business processes..................................................................... 91.1.1.1.6 Determine awareness of Incidents of info vulnerability............................................. 91.1.1.1.7 Understand the Organizations risk tolerance........................................................... 91.1.1.1.8 Understand companies related Priorities & preferences............................................. 91.1.1.1.9 Quantify & qualify the risk of Confidential information loss...................................... 10

1.1.1.2 Implement software to identify Technical risk................................................................101.1.1.2.1 Locate Confidential data on network.....................................................................111.1.1.2.2 Determine who has Access..................................................................................111.1.1.2.3 Demonstrate Internal information flow................................................................. 111.1.1.2.4 Collate evidence of Unauthorized info transfer....................................................... 111.1.1.2.5 Identify High risk business processes................................................................... 111.1.1.2.6 Document At-risk confidential data...................................................................... 121.1.1.2.7 Quantify Risk of non-compliance.......................................................................... 121.1.1.2.8 Provide a record of Internal / external info flow..................................................... 12

1.2 Identify & classify Confidential information...................................................................................121.2.1 Define Confidential information........................................................................................... 13

1.2.1.1 Use best practices to update Information classifications..................................................131.2.1.2 Identify Confidential information................................................................................. 131.2.1.3 Apply Classifications.................................................................................................. 13

1.2.2 Assign Levels of protection................................................................................................. 141.2.2.1 Use Classifications..................................................................................................... 14

1.3 Develop Policies & procedures.................................................................................................... 141.3.1 Define Responsibilities for protection................................................................................... 14

1.3.1.1 Compare existing Policies to best practices................................................................... 141.3.1.2 Develop Policy updates.............................................................................................. 15

1.3.1.2.1 Base them on Best-in-class models...................................................................... 151.4 Deploy technologies that enable Policy compliance & enforcement...................................................15

1.4.1 Review Compliance technology........................................................................................... 151.4.1.1 Compare Tecnology solutions......................................................................................16

1.4.1.1.1 Assess the Costs............................................................................................... 161.4.1.1.2 Assess the Benefits............................................................................................ 16

1.4.2 Adopt & deploy Policy compliance technology....................................................................... 161.4.2.1 Choose technology with Automatic enforcement............................................................ 17

1.5 Communicate & educate a Compliance culture..............................................................................17


1.5.1 Inform people of their Information responsibilities................................................................. 171.5.1.1 Draft Key messages...................................................................................................171.5.1.2 Develop Training....................................................................................................... 18

1.5.2 Motivate Information protection behaviour........................................................................... 181.5.2.1 Establish an ongoing Communication campaign............................................................. 18

1.6 Integrate practices into Business processes..................................................................................181.6.1 Identify Key Processes where info is at risk.......................................................................... 191.6.2 Develop a plan to integrate Info policy into those processes................................................... 19

1.7 Audit to ensure Stakeholder accountability...................................................................................191.7.1 Examine current Practices & remediate deficiencies............................................................... 19

1.7.1.1 Establish Audit parameters & methodology................................................................... 201.7.1.2 Conduct Audit........................................................................................................... 20

1.7.1.2.1 Assess Compliance with info policies.....................................................................20


1 Perform 7 steps to information protection

From: http://eval.symantec.com/mktginfo/enterprise/white_papers/b-whitepaper_vontu_7_steps_to_information_protection_01-2009.en-us.pdf

"Vulnerability, risk, and information protection challenges

Every organization is at risk of confidential information loss. Billions of dollars worth ofprofits, competitive advantage, reputation, and market share are at stake. Today’shighly competitive business environment intensifies the vulnerability and risk. Globaloperations, with outsourced and off-shored business functions, spread the vulnerability.Tools for accessing and distributing information, such as the Internet and mobilecomputing devices, exacerbate the risk.

Information vulnerability and risk come from both malicious and unintentionaldisclosures by employees and partners; unintentional disclosures are usually the largerproblem. Reducing these risks and vulnerabilities is now both a business imperative anda legal mandate as recent regulations impose obligations on organizations to protectcertain types of information.

Global corporations and government organizations require more than network securityand access control to guard their confidential data. They must protect the informationitself, inform the behavior of those carrying the information, have visibility regardingwhere their confidential data resides on their network, have influence over where thatdata is going, and implement a policy for managing it. A strategy that balances theorganization’s legal and business needs to protect information with the competinginterests to share it is vital.

7 steps to information protection

Information protection strategy best practices involve a cross-functional team that:

1. Assesses risks

2. Identifies and classifies confidential information

3. Develops information protection policies and procedures

4. Deploys technologies that enable policy compliance and enforcement

5. Communicates and educates stakeholders to create a compliance culture

6. Integrates information protection practices into businesses processes

7. Audits so that stakeholders are held accountable."

Perform7 steps to information

WHY

MeetCompliancy regulations

And

MaximizeData security

And

SafeguardIntellectual property

HOW

Assess informationLoss & compromise risks

And

Identify & classifyConfidential information

And

DevelopPolicies & procedures

And

Deploy technologies thatenablePolicy compliance & enforc...

And

Communicate & educate aCompliance culture

And

Integrate practices intoBusiness processes

And

Audit to ensureStakeholder accountability


1.1 Meet Compliancy regulations

[The author has not attached any text yet.]

MeetCompliancy regulations

HOW


1.2 Maximize Data security


MaximizeData security

HOW


1.3 Safeguard Intellectual property


SafeguardIntellectual property

HOW


1.1 Assess information Loss & compromise risksAssess information Loss & compromise risks


WHY


HOW

Determine info protectionStrategy approach & priorities

1.1.1 Determine info protection Strategy approach &priorities




WHY


HOW

Conduct aRisk assessment and survey

And

Implement software to identifyTechnical risk

1.1.1.1 Conduct a Risk assessment and survey



WHY


HOW

Identify whichInfo should be protected

And

DistinguishTypes of confidential informa...

And

DeterminePerceived risks

And

IdentifyExisting info protection

And

Identify high riskBusiness processes

And

Determine awareness ofIncidents of info vulnerability

And

Understand theOrganizations risk tolerance

And

Understand companies relatedPriorities & preferences

And

Quantify & qualify the risk ofConfidential information loss


1.1.1.1.1 Identify which Info should be protected


Identify whichInfo should be protected

WHY


1.1.1.1.2 Distinguish Types of confidentialinformation



WHY


HOW

ApplyClassifications

1.1.1.1.2.1 Apply Classifications



WHY


1.1.1.1.3 Determine Perceived risks


DeterminePerceived risks

WHY


1.1.1.1.4 Identify Existing info protection




WHY


HOW

IdentifyPolicies

And

IdentifyProcedures

And

IdentifyPractices

1.1.1.1.4.1 Identify Policies


IdentifyPolicies

WHY


1.1.1.1.4.2 Identify Procedures


IdentifyProcedures

WHY


1.1.1.1.4.3 Identify Practices


IdentifyPractices

WHY



1.1.1.1.5 Identify high risk Business processes


Identify high riskBusiness processes

WHY


1.1.1.1.6 Determine awareness of Incidents of infovulnerability


Determine awareness ofIncidents of info vulnerability

WHY


1.1.1.1.7 Understand the Organizations risktolerance


Understand theOrganizations risk tolerance

WHY


1.1.1.1.8 Understand companies related Priorities &preferences


Understand companies relatedPriorities & preferences

WHY



1.1.1.1.9 Quantify & qualify the risk of Confidentialinformation loss


Quantify & qualify the risk ofConfidential information loss

WHY


1.1.1.2 Implement software to identify Technical risk



WHY


HOW

LocateConfidential data on network

And

Determine who hasAccess

And

DemonstrateInternal information flow

And

Collate evidence ofUnauthorized info transfer

And

IdentifyHigh risk business processes

And

DocumentAt-risk confidential data

And

QuantifyRisk of non-compliance

And

Provide a record ofInternal / external info flow


1.1.1.2.1 Locate Confidential data on network


LocateConfidential data on network

WHY


1.1.1.2.2 Determine who has Access


Determine who hasAccess

WHY


1.1.1.2.3 Demonstrate Internal information flow


DemonstrateInternal information flow

WHY


1.1.1.2.4 Collate evidence of Unauthorized infotransfer


Collate evidence ofUnauthorized info transfer

WHY


1.1.1.2.5 Identify High risk business processes



IdentifyHigh risk business processes

WHY


1.1.1.2.6 Document At-risk confidential data


DocumentAt-risk confidential data

WHY


1.1.1.2.7 Quantify Risk of non-compliance


QuantifyRisk of non-compliance

WHY


1.1.1.2.8 Provide a record of Internal / external infoflow


Provide a record ofInternal / external info flow

WHY


1.2 Identify & classify Confidential information



WHY


HOW

DefineConfidential information

And

AssignLevels of protection


1.2.1 Define Confidential information



WHY


HOW

Use best practices to updateInformation classifications

And

IdentifyConfidential information

And


1.2.1.1 Use best practices to update Informationclassifications


Use best practices to updateInformation classifications

WHY


1.2.1.2 Identify Confidential information


IdentifyConfidential information

WHY


1.2.1.3 Apply Classifications



WHY



1.2.2 Assign Levels of protection



WHY


HOW

UseClassifications

1.2.2.1 Use Classifications


UseClassifications

WHY


1.3 Develop Policies & procedures



WHY


HOW

DefineResponsibilities for protection

1.3.1 Define Responsibilities for protection



WHY


HOW

Compare existingPolicies to best practices

And

DevelopPolicy updates

1.3.1.1 Compare existing Policies to best practices


[The author has not attached any text yet.] Compare existingPolicies to best practices

WHY


1.3.1.2 Develop Policy updates



WHY


HOW

Base them onBest-in-class models

1.3.1.2.1 Base them on Best-in-class models


Base them onBest-in-class models

WHY


1.4 Deploy technologies that enable Policycompliance & enforcement


Deploy technologies thatenablePolicy compliance & enforc...WHY


HOW

ReviewCompliance technology

And

Adopt & deployPolicy compliance technology

1.4.1 Review Compliance technology



WHY

Deploy technologies thatenablePolicy compliance & enforc... HOW

CompareTecnology solutions


1.4.1.1 Compare Tecnology solutions



WHY


HOW

Assess theCosts

And

Assess theBenefits

1.4.1.1.1 Assess the Costs


Assess theCosts

WHY


1.4.1.1.2 Assess the Benefits


Assess theBenefits

WHY


1.4.2 Adopt & deploy Policy compliance technology



WHY

Deploy technologies thatenablePolicy compliance & enforc... HOW

Choose technology withAutomatic enforcement

1.4.2.1 Choose technology with Automaticenforcement


[The author has not attached any text yet.]Choose technology withAutomatic enforcement

WHY


1.5 Communicate & educate a Compliance culture



WHY


HOW

Inform people of theirInformation responsibilities

And

MotivateInformation protection behav...

1.5.1 Inform people of their Informationresponsibilities



WHY


HOW

DraftKey messages

And

DevelopTraining

1.5.1.1 Draft Key messages


DraftKey messages

WHY



1.5.1.2 Develop Training


DevelopTraining

WHY


1.5.2 Motivate Information protection behaviour



WHY


HOW

Establish an ongoingCommunication campaign

1.5.2.1 Establish an ongoing Communicationcampaign


Establish an ongoingCommunication campaign

WHY


1.6 Integrate practices into Business processes



WHY


HOW

Identify KeyProcesses where info is at risk

And

Develop a plan to integrateInfo policy into those processes


1.6.1 Identify Key Processes where info is at risk


Identify KeyProcesses where info is at risk

WHY


1.6.2 Develop a plan to integrate Info policy intothose processes


Develop a plan to integrateInfo policy into those processes

WHY


1.7 Audit to ensure Stakeholder accountability



WHY


HOW

Examine currentPractices & remediate defici...

1.7.1 Examine current Practices & remediatedeficiencies



WHY


HOW

EstablishAudit parameters & methodo...

And

ConductAudit


1.7.1.1 Establish Audit parameters & methodology


EstablishAudit parameters & methodo...

WHY


1.7.1.2 Conduct Audit


ConductAudit

WHY


HOW

AssessCompliance with info policies

1.7.1.2.1 Assess Compliance with info policies


AssessCompliance with info policies

WHY

ConductAudit

Perform 7 Steps To Information Protection

Technology

Transcript of Perform 7 Steps To Information Protection