# Presentation: 735840

## Writing an Operational Security Plan

- E. Jane Powanda
- FISSEA 2005 Conference
- March 22, 2005
- _[jpowanda@itsc.org](mailto:jpowanda@itsc.org)_
- 301 513-0143

## The Operational Security Plan

- Roadmap for Management and Operations

## Why Have a Security Plan

- Documents implemented security measures
- Documents planned security measures
- Documents security goals based on threats and risk
- Documents security roles and responsibilities for staff
- Identifies security requirements for inclusion in formal agreements with partners and other organizations that may provide application services

**Documents security decisions made by management**

## Security Plan in the Security Framework

- Special Features

- Procedures

- Standards/Guidelines

- Plans

- Security
-  Implementation

## Writing the Security Plan

**Demonstrates **
**due diligence!**

**Changes with**
** ****technology**

**Based on **
**policy **

**Dessert?**

**Will justify our**
** ****security budget**

## Resources

**NIST SP 800-18  - **Guide for Developing Security Plans for Information Technology Systems, December, 1998.
- Other resources at http://csrc.nist.gov
- ISO 17799  - Information Technology - Code of practice for information security management
- CIO Council – experience of other agencies

## Writing the Security Plan

- Introduction
- The Application and its Environment
- Roles and Responsibilities
- Operational Security Controls
- Other Optional Topics
- Glossary

## Introduction

- Scope
- Purpose
- Intended audience
- Plan maintenance
- Points of contact
- Relevant policies and guidelines
- Document organization

- The introduction provides the basis for both the plan and the document, and addresses some management aspects of the planning process

## Scope

- Sets the bounds for the plan
- Is this a new system or an addition to the current system?
- Is this for a single application or a general use system?
- What is not included in the plan?

## Purpose

- Why the Plan exists
- Provides a compendium of security measures currently implemented
- Documents measures taken by management to demonstrate due diligence with respect to security

## Intended Audience

- Who might be reading this document?
- Program management
- IT management
- Program operational staff
- IT staff
- Program partners
- Auditors

## Plan Maintenance

- Who updates this plan?
- How often is it updated?
- Who reviews and authorizes updates to the plan?

## Point of Contact

- Name or position of person who can provide more information about the plan
- Phone number or e-mail address

## Relevant Policies and Guidelines

- Federal legislation or guidelines on which plan is based
- State legislation or guidelines on which plan is based
- Internal policies or guidelines

## Document Organization

- Description of each of the sections of the plan

## The System and its Environment

- Functional description of the application or system
- Program orgnization
- Hardware
- Software
- Operational environment
- Data sensitivity
- Threats to the system
- Security goals

- This section provides information about the system and the environment in which it operates.  It sets the stage for the plan.

## System Functional Description

- Hours of operation
- End user interfaces
- Paper
- Web
- E-mail
- IVR
- The services provided to users
- Internal staff
- External clients

- Identify what the system does from a layman’s point of view.

## Hardware

- List the hardware elements that belong to this system
- Mainframe
- Servers
- Storage devices
- Workstations
- Firewalls

## Software

- List software elements
- Operating system
- Network software if applicable
- Application software
- Language written in
- Size and complexity of software
- Architecture or how organized
- Mainframe
- Client / server
- Web based

## IT Operational Environment

- Describe the infrastructure
- Firewalls
- Subnets
- Connecting networks
- External interfaces
- Dial in access
- Provide a drawing that shows the different parts of the system on a network diagram

## Data Sensitivity

- Business need for sharing or restricting information
- Business impact of failure to protect sensitive data
- What kind of information is considered sensitive?
- Are privacy laws and regulations applicable?
- Describe the different categories or types of sensitive data
- Describe implications of sensitivity with respect to
- Confidentiality
- Integrity
- Availability

## Threats

- Major threats and security concerns
- Examples
- Hacker attacks
- Insider fraud
- External fraud
- Physical attack
- Employee discontent

## Security Goals

- Discuss security objectives with respect to each of the following
- Availability of service
- Confidentiality of client information
- Accountability of actions
- Integrity of data operations
- Rate the goals in order of importance

## Security Operational Controls

- Assignment of roles and responsibilities
- Management controls
- Operational controls
- Technical controls

## Roles and Responsibilities

- Program organization
- Business staff
- Technical staff
- Management staff
- Operational staff
- The IT organization
- Other agency organizations that provide services
- Data sharing partners
- Internet application system users
- Examples of security functional responsibilities
- Who does the backups
- Who does security training
- Who authorizes system access
- Who sets policy
- Who maintains this plan

## Management Controls

- Risk management
- Incident handling
- Contingency plans

## Risk Management

- Has there ever been a security assessment performed on the system?
- When was it done, by whom, how extensive?
- Generally describe the methods used for resolving security problems identified
- What management procedures are in place to periodically review and contain security risk?
- Update the plan when new controls are implemented or planned

- Never document security vulnerabilities in the plan

## Incident Handling

- What is considered to be a “security incident”?
- Identify procedures in place to deal with a security incident
- Detection
- Reporting
- Resolution
- What actions are taken to ensure that staff can recognize and respond to a security incident?

## Contingency Plans

- Business continuity plan
- How will the business continue to operate in spite of disaster?
- Who is responsible the plan and its execution?
- When was the last time it was updated and tested?
- When will it be tested again?
- Disaster recovery plan
- How will IT operations be brought back to normal?
- Who is responsible for the plan?
- When was the last time it was updated and tested?
- When will it be tested again?

## Operational Controls

- Application maintenance
- Access to system and privileges
- Authentication of users
- Audits
- Backup and recovery
- Disposal of information and equipment
- Security training
- Integrity controls
- Physical security
- Personnel security

## Application Maintenance

- Software maintenance
- Describe the change management process
- Who writes code, tests it, approves it, installs it on the production system?
- Is security testing performed?
- How is configuration control maintained?
- Source code
- Executable code
- Hardware maintenance
- How much downtime can be tolerated?
- What measures are taken to ensure hardware availability?

## Access to System and Privileges

- Identify who authorizes access to systems and software
- Describe how new access authorizations get implemented
- Identify who makes the changes on the system
- What procedures are in place to terminate access for those that no longer need it?

## Audit Data

- What activities will be audited?
- Selected staff actions
- All administrator actions
- Partner access and/or modification of data
- Customer actions
- How long is audit data kept? Is it stored in a safe place?
- How is it protected from viewing and modification?
- Is enough buffer space allocated for audit data to prevent overwrite?
- Is someone assigned to review audit data on a regular basis?

## Backup and Recovery

- Enterprise data backup
- Identify what data is backed up by the system and considered recoverable
- Identify how often data is backed up
- Discuss existence of offsite backup and how long it would take to retrieve it in the event of an emergency
- What is the tape rotation schedule – how many tapes or other media are used?
- Personal backup
- What backup responsibilities do users have?
- Restoration
- How will data be restored and how long will it take?
- When was the last time a successful recovery from a backup was demonstrated?

## Handling of Information & Equipment

- Security markings on information and equipment
- Equipment disposal
- Computers
- Workstations
- Storage media
- Equipment Maintenance
- Outside repair
- In-house repair
- Information disposal
- What information must be disposed of securely?
- Procedures for destroying information on paper with sensitive information
- Procedures for destroying floppy disks or CDs containing sensitive information

## Security Training

- How is security awareness conveyed to staff?
- Annual security awareness training
- Monthly security bulletins
- Security posters
- How is security training provided for IT staff and programmers?
- Prevent web coding flaws
- Firewalls and network architecture
- How is security training provided to administrators
- Locking down servers
- Reviewing audit information
- Performing vulnerability scans including wireless
- Patch management
- Other specific role or job based security training

## Integrity Controls

- Identify features implemented to ensure that the system has not been modified without authorization
- Software checksums or signatures
- Other security software
- Identify the virus software and vulnerability scans used on the system, how often they run, and how often they are updated
- Patch management documented plan
- Who monitors for new patch releases and installs them?
- How often are patches installed?
- Number of vendors to monitor

## Physical Security

**Facility security**
- Describe the personnel entry system and how access rules are enforced for building access, building protections
**Computer room security**
- Describe the personnel entry system and possible contingency entry in event of emergency
**Communications room security**
- Describe the personnel entry system and possible contingency entry in event of emergency
**Other locked areas** (storage of software, blank checks, etc.)
- Describe the personnel entry system and possible contingency entry in event of emergency
**Workstation Security**
- Use of UPS to prevent damage during power interruption
- Preventing laptop theft
**Computer room environmental controls**

## Personnel Security

- Staff background checks
- Staff security requirements
- Badges
- Reporting suspicious activity
- Visitor control
- Sign in log
- Escort requirements
- Maintenance staff
- After hours activity – preventing theft and disclosure of sensitive information
- Confidentiality agreements
- Expected behavior agreements

## Technical Controls

- Identification and Authentication
- Access Control
- Audit
- Encryption

- Addresses technology used to implement these controls

## Identification & Authentication 

- User IDs
- Describe how staff are authenticated
- Biometrics – fingerprint
- Password
- Tokens
- Describe how authorized non-staff are authenticated for both web access and direct system access
- Describe how customers/clients are authenticated when accessing the system over the web

## Logical Access Controls

- Mainframe access controls
- Client server access controls
- Web transaction access controls

## Audit

- What automated audit features are provided?
- Operating system based
- Application based
- Other
- What automated analysis tools are used?

## Encryption

- Usage
- Network transmissions
- Web transactions
- Database
- Passwords
- Algorithms used
- Products used within the organization

## Other Optional Topics

- Personnel Safety
- Rules of Behavior
- Others?

## Personnel Safety

- Evacuation plan in event of emergency
- Evacuating and accounting for personnel in building
- After hours activity
- Identify special measures for after hours activity in work areas including escorts to parking lot
- Protection of personal property
- Who to notify for suspected theft
- Fire extinguishers
- Location and plan to ensure readiness
- Emergency phone numbers
- Both during and after work hours
- Medical emergency
- Phone numbers and identification of trained medical professionals in building

## Security Plan Closing Thoughts

- It is not necessary, or even desirable, to actually have all the topics fully covered in the plan (300 pound books are difficult to carry around).  A reference to the information documented elsewhere is sufficient.
- The list of topics presented here is not all-inclusive, definitive or mandatory.
- If a topic not covered here is important – Add it
- If a topic covered here is irrelevant – Drop it
- Build a plan to fit YOUR needs.
- Keep it brief

## Contact Information:

- Jane Powanda	_[jpowanda@mitretek.org](mailto:jpowanda@mitretek.org)_
- 				_[jpowanda@itsc.org](mailto:jpowanda@itsc.org)_
- 				301 513-0143