The Story of Security Governance
By: Xing, Teddy
Tags: Cybersecurity, Framework, Information Technology, Governance, Information Security

Within the information field, security professionals must keep in mind that they perform a supporting service to the organization. Every organization has its own unique business objective and mission.

The tale of two hats

Security professionals often wear two different hats. Certainly, they are the subjective matter experts on information security and are tasked with securing the IT infrastructure, respond to security incidents, and the protection of value assets, they also have to remember the other hat they often have to wear: the business hat. Security professionals must understand the primary mission of the organization and both the strategic and tactical objectives to support the organizational mission. This includes short-term and long-term goals, how security controls impact business efficiency, and design a control environment that balance both security and business needs. This is a task security professionals often struggle with. A business case is a tool security professionals can incorporate to justify the investment of time and money in new security controls by providing a solid case on the impact to organization assets in a language management can understand.

Information security as a business function

As a business function, information security must align with other business functions and the governance processes within the organization. The governance process can take place at the different levels. This can be in form of committees such as risk management committee consist of senior level executives and with publicly traded companies including independent board of directors and other governing bodies. Despite the difference in governance structure, security professional must determine the best way to incorporate information security into the process to ensure responsible bodies understand the security risks facing the organization and the controls that are in place to manage those risks. Governing bodies should also be included in the incident response process and be informed when security incidents take place at applicable severity levels and be provided with regular audit reports to review the current security posture of the organization. There is certainly no one size fits all in security governance as every organization is unique. Security professional need to considering additional scenarios such as acquisition and divestitures as well as they happen often within the business world. It’s important to access the compatibility between systems, eliminate any redundancies, and ensure additional risk factors are not carried over during the process such as inadequate controls, insecure systems, and etc.

Role and responsibilities of security professional in Security Governance

While roles and responsibilities of security professionals can differ based on organization size and structure, the Chief Information Security Officer (CISO) is usually the individual bearing the responsibility of information security and is considered the senior information security leader within the organization. Under the CISO is the information security team that is composed of security professional with broad backgrounds in information security as well as subject matter experts in areas such as incident response, network security, identity and access management, and security awareness. Regardless of responsibilities, all information security professionals must also exercise both due care and due diligence.

Due care — The principle of due care states that information security professionals must fulfill the legal responsibilities of the organization as well as professional standards of information security.

Due diligence — The principle of due diligence states that security professionals should take reasonable measures to investigate the risks associated with a situation.

As you can see, security professionals have a wide variety of responsibilities within the organization ranging from the design, implementation, and management of various controls to protect confidentiality, integrity, and availability. It’s important to ensure adequate controls are in place to protect and cover the organization against a wide range of risks that exist today. This can be seen as a formidable task. Fortunately, there are several existing security control frameworks out there today that can assist with establishing an effective security program. These include COBIT, ISO 27001/27002, NIST 800–53 just to name a few.

COBIT

The Control Objectives for Information Technology, also known as COBIT, is a security control framework developed by the Information Systems Audit and Control Association. COBIT is a detailed framework covering six different principles: meeting stakeholder needs, enabling a holistic approach, creating a dynamic governance system, separating governance from management, tailoring the governance system to enterprise needs and covering the enterprise end to end. COBIT also offer implementation guidance to assist organization in implementing the framework within the organization.

ISO 27001/27002

The International Organization for Standardization, also known as ISO, also publishes a series of control frameworks centering around security and privacy. ISO 27001 covers information security management systems and provides generalized control objectives. ISO 27002 provides additional details on specific controls and implementation to meet organizational goals.

NIST 800–53

While specially designed for federal information systems, the NIST 800–53 published by the National Institute of Standard and Technology is widely adapted by non-federal agencies and organizations as well. It covers the fundamentals of information security with multi-tiered risk management, security control structures, baselines and designations, the use of external service providers, and how to assess assurance and trustworthiness for information systems. The 492-page publication goes into detail on the process of implementing security and privacy controls, selecting appropriate security control baseline, tailoring the baseline to the specific needs of the organization, and creating a process to document the control selection process for both new and legacy systems.