If you think of assurance as a guarantee your cyber security is fit for purpose and working perfectly then there are a few other things you’re going to need: governance, risk management, policies, operational procedures, audit trails, personnel, effective training and awareness, security testing, oh and not forgetting the software and hardware underneath all that. In fact that’s a very concise and condensed list which doesn’t begin to cover everything but I’m trying to give the overall picture here not send you to sleep or bamboozle you.
First question: how do all these different items work together to give you that warm fuzzy feeling of assurance about your cyber security?
To have governance, just like government, you need someone or something in control to maintain oversight of the cohesive efforts being made. This person or persons will of necessity be senior personnel who have the understanding and viewpoint required to see what’s happening across the business, to make decisions and the authority to have those decisions acted upon.
We’re talking operational risk management specifically, a concept I’ve heard described as an emotional process – a statement I do understand and have some sympathy with as it’s a discipline requiring a lot of subjective thinking. Many people view operational risk management as a potential minefield inside a nightmare, but it’s not that hard to do and there are sources of information out there which can help you, although some are so badly written they can fry your brain if you’re not careful. For the moment I’ll just pare it down to bite-sized chunks of bare essentials for you by outlining an easy way I’ve used in the past to tackle it. … For the next stage you need to look at what makes these threats more or less likely to happen. Here’s an example: there’s a threat that some malcontent might break a window in your office, climb in and steal something, but if you have bars over the windows then this is less likely to happen. Ah, so they can’t come through a window but how strong are the doors? You need to consider all possible – or at the very least all you can think of – ways the vulnerabilities in the situation could turn the threats into reality. On to stage three where you’ll look at what the impact would be if something happened. Say you had strong doors and barred windows except for one which only allowed access to that old storeroom with nothing in it; that would have a lower impact than if it allowed access to the computer room. Along with the impact remember to think about the value of whatever could get lost or destroyed; that’s not just the capital cost by the way, it should also encompass the value of your brand, your reputation and anything else it’ll be expensive to get back, these are your company’s assets. … The next stage is to look at what you can do to reduce the likelihood and the cost of that incident. In many cases it can be something very simple such as putting in place a procedure to ensure the last person to leave shuts and locks all the windows; it doesn’t need to be a monstrously expensive piece of software that will automatically seal off the building at 6pm sharp. … Of course someone will need to define what the acceptable level is but we know whose job that is, governance. Last stage now, where the risk is not acceptable you’ll need to come up with a plan on how to deal with it. This might be further investment in equipment or staff, or it may be possible to devise a plan that removes the risk entirely, for example by moving valuable assets to another more secure location. These plans will be reported up to the governance level whose role is to agree to them, provide what you need to get them done and to monitor progress.
You’d be surprised how many organisations are completely missing the two items described above, although most have all the rest but they’re not much good on their own.
They don’t have to be long and wordy, in fact the shorter and punchier they are the better; they need to have impact.
Unlike policies these need to have more detail in there, they need to cater for when things go wrong as well as right and how to deal with that. They show the governance layer that procedures are being followed correctly and can be used in the risk management process to identify potential issues. If your organisation undergoes audits you’ll know auditors love nothing more than evidence; it’s the only thing that proves you’re doing what you say you do.
It’s a natural human attribute to be helpful and friendly, I’ll just see if that stranger over there needs help with carrying that suspiciously large box down to his van (that’s based on a true incident folks). It’s not easy to measure if all this investment in security is working; until someone tries to break it you’ll never know if it works or not. … The idea is you pay another company a load of money to test your security and they produce a nice big report for you in return. … Some tests need specialist skills and equipment so those you are stuck with coughing up for, but many tests can be conducted by you or your friends and colleagues. Go round the building and check doors are locked, no confidential paperwork is left out on a desk, PCs aren’t left logged in. Get a friend to see if they can get inside past reception without an appointment, tell them to carry a box and say they’ve got equipment to install in the computer room. … All these tests will go towards proving the governance is in place and working, the risks are being managed effectively and the policies are being adhered to. The only caveat to this advice is where you’ll be audited and the results of the tests are offered as evidence; I find auditors aren’t keen to accept a handwritten note from uncle Joe saying he tried but he couldn’t break in as sufficient for their needs.
They’re still important and getting the right tool will save you a lot of pain and sorrow further down the road but don’t think they’re the whole answer.
Security should be seen as a continuous circle where the outputs are constantly fed back as input and the circle revolves again, each time improving and refining the process; you need all the spokes of the wheel in place if your organisation is going to successfully move forward with a mature and effective security stance.
Link: http://www.daftblogger.com/assurance-does-not-come-in-a-box/