I
In my last article, we explored A Simplified Policy Framework to create effective management documents to set direction and measure compliance to control objectives regarding security. The Process was a centerpiece to the discussion. In this article, we’ll take it a step further to see the double dividend in taking a process-centric approach.
Security is all about due diligence – ensuring proper alignment to the depth and breadth of enterprise and business-specific controls managing the confidentiality, integrity, and availability of information, systems, and processing facilities. The analysis can be exhausting – especially if you have to do it all at once while your Agile release train flies by.
In my world, we have help – at three levels of the organization: business process, security sub-process, and security service. A time-driven information risk management approach would quickly assess the impact to change to these three levels and engage the principals assigned to those areas.
At the Initial state of Information Security program development, unacceptable business risk surfaces due to the lack of a security program, causing a designated owner to be assigned and Information Security Management process to be created. A new business process owner arrives at the table.
Lack of frameworks for policy, control, classification, and risk management would also result in this highest level of process impact. Decisions in each of these areas impacts all business processes equally. Strategies for all must be done in the initial phase of Information Security program development. Senior managers should be appointed to an Information Security Steering Committee and tasked with dealing with this change in strategy.
Experts say the Information Security Management process defines sub-processes closely aligned to the Code of Practice for Information Security Management (ISO 27002). Each would have a manager assigned. Security practices include: Information Security Policies, Organization of Information Security, Human Resource Security, Asset Management, Access Control, Cryptography, Physical and Environmental Security, Operation Security, Communication Security, System Development, Supplier Information Security Incident Management Business Continuity Management, and Compliance. If a single owner is not possible, allow for several to partner in the stewardship of the sub-process.
At an early stage of maturity, security services may not be defined and service levels enforced. A risk assessment may trigger the need for service formalization and measurement as part of the action plan, or ad-hoc service design and construction may persist.
In summary, new rapid development, Agile methodologies create a greater dependency on a top-down, process-centric, multi-layered methodology to identify, assess, treat, and manage risk to information, systems, and processing facilities. Security due diligence becomes a cross-functional, organizational strategy, empowering direct and in-direct resources to work together to manage change.