Stories from the trenches: Designing a good security policy
26
Stories from the trenches: Designing a good security policy Jean-Michel Lamby Architect Microsoft & Security Solutions
description
Stories from the trenches: Designing a good security policy. Jean-Michel Lamby Architect Microsoft & Security Solutions. Risk is the mirror image of opportunity. Agenda. Presentation Objectives Some questions… Information security policy Information security & the business - PowerPoint PPT Presentation
Transcript of Stories from the trenches: Designing a good security policy
Stories from the trenches:Designing a good security policy
Jean-Michel Lamby
Architect
Microsoft & Security Solutions
Risk
is the mirror image of
opportunity
Agenda.Presentation Objectives
Some questions…
Information security policy
Information security & the business
Information security & ICT
Managing information security
A framework for managing operations
ICT Operations: Management Framework
Tracks for quick wins…
Where are you today?
To provide high level guidance for the process of developping a good information security policy
To identify tracks for « quick wins »
Objectives
Stories from the trenchesI once was an infosec manager
Real life experiences....
Some questions...Just a few questions...
Easy ones...
Some questions... (Ctd)
Are you in control?
Some questions... (Ctd)
Is information a strategic and valuable asset for your company?
Do your employees know it?
Do they know it is considered as such by the management?
Do they know who’s in charge?
Do they care?
Some questions... (Ctd)
The human being is weak and we all make mistakes from time to time... But
When it comes about information security, do your employees know what their responsibilities are?
Is this somehow integrated in the work regulation?
Are they aware of the risks?
Do they know where to find guidelines and procedures?
Do they know how to react in case of an incident?
Do they know they are controlled?
Do you comply with the legislation about privacy protection?
Some questions...(Ctd)
Do your employees know how to manage sensitive data?
What about removable storage media?
What about outdated backup tapes?
What about crashed disks?
What about laptops.
What about e-mail attachment?
What about « 3rd party webmail »?
What about data transfer?
More questions...A critical business process is down.....because of the unavailability of an ICT service....
Was your service delivery in line with the business requirements?
Business what?
Where does your responsibility start?
Where does your responsibility end?
More questions... (ctd)
Do you know whether your systems are securely configured?
Are you sure of this?
When was it controlled for the last time?
What was the results of the control?
Any corrective action?
Implemented?
How many changes implemented since then?
How many new vulnerabilities since then?
And do you exclusively expose services required by the business?
Stop with these questions!!!Ok
Stop with these questions!!!Still in control?
Information security policyAimed at providing a complete and consistent reference framework for the management of information security
Will cleraly state the respective roles and responsibilities
Will ensure your security posture is appropriate for your business
Will ensure the level of achieved security is maintained and controlable.
Will help maintain awareness and involvement
Information Security & the BusinessSecuring the busines process by protecting
Information, Service and SystemConfidentiality, Integrity and Availability
Information security & ICT
Information Security is a global business issue…
ICT is part of the Busines…
ICT to participate to the collaborative effort aimed at protecting the business
Information is a strategic asset…
Managing Information Security
Managing Information Security
Information SecurityStrategy
Information SecurityStrategy
CorporateInformation Security Policy
Visibility Credibility Direction
Commitment Responsibilities
Information Security Program
Scope and objectives Sponsorship
CorporateInformation Security Policy
Visibility Credibility Direction
Commitment Responsibilities
Information Security Program
Scope and objectives Sponsorship
Security AwarenessSecurity Awareness
Legal RequirementsLegal Requirements
Regulatory RequirementsRegulatory Requirements
Standard RequirementsStandard Requirements
Assets IdentificationAssets Identification
Business Impact AnalysisBusiness Impact Analysis
Risk AssessmentRisk Assessment
Risk ManagementRisk Management
Managing Information Security
Standard and Best Practice Requirements:ISO/IEC 17799
ISO13335BS7799
ITIL Security ManagementFIRM
WebTrustX9.79
TS101456…
Standard and Best Practice Requirements:ISO/IEC 17799
ISO13335BS7799
ITIL Security ManagementFIRM
WebTrustX9.79
TS101456…
Security ManagementFramework
Security ManagementFramework
TailoredSecurity Management
Framework:Policies
StandardsProcedures
Controls
CISPSecurity Organization
Asset Classification and ControlPersonnel Security
Physical and Environmental Security
Operations and Communications Management
Access ControlSystem Development
and MaintenanceBusiness Continuity
Compliance
TailoredSecurity Management
Framework:Policies
StandardsProcedures
Controls
CISPSecurity Organization
Asset Classification and ControlPersonnel Security
Physical and Environmental Security
Operations and Communications Management
Access ControlSystem Development
and MaintenanceBusiness Continuity
Compliance
Legal RequirementsLegal Requirements
Regulatory RequirementsRegulatory Requirements
Certification RequirementsCertification Requirements
Assets IdentificationAssets Identification
Business Impact AnalysisBusiness Impact Analysis
Risk AssessmentRisk Assessment
Policies, standards & proceduresNot litterature!
Operational documents!
Policies: recognition of a problematic and high level statements about the intentions of the management
Standards:What you are going to do about this problematic.
Procedures:How you are going to do it (auditability)
Technology: to support specific controls
A framework for managing operationsInformation security is not an additional layer
It is to be integrated within daily business
And for ICT it is to be integrated in the management of daily operations (MOF, ITIL, TOM, eTOM...)
ICT Operations: Mgt Framework
Tracks for Quick WinsCISP
SAD program
Personnel security
E-Mail and Internet acceptable use
Malicious software protection
System & Svc Management (including patch mgt and fw mgt)
Network management
Business continuity: crisis mgt framework
Where are you today?Initiate Security Management
Stage 1:Initiation
Stage 2:Requirements and Strategy
Stage 3:Implementation
Stage 4:Operational Management
Maturity LevelMaturity Level
Assets Identification
Business Impact Analysis
Risk Assessment
Strategy
Develop Policies Develop InfoSec Plans Implement Risk Mitigation
Organization and Implementation Planning
Develop and Implement Standards and procedures
Initial Testing
Assurance
Educationand awareness
ReviewTesting Change
Control
Training
1
2
3
4
5
6
Freely adapted from the ITIL BCM Maturity Model
Thank youIf you have any question or request for information feel free to contact me at:
![[WSO2Con EU 2017] From the Trenches: IoT Customer Stories](https://static.fdocuments.in/doc/165x107/5a648ff87f8b9a31568b540d/wso2con-eu-2017-from-the-trenches-iot-customer-stories.jpg)
