2010 06 gartner avoiding audit fatigue in nine steps 1d

Avoiding Audit Fatigue: Achieving Compliance In A Multi-Compliance World In Nine StepsGene Kim, CISA, TOCICO JonahCTO and Founder(Twitter: @RealGeneKim) Gartner 2010

Where Did The High Performers Come From?

AgendaThe problems of compliance du jour and the audit blame cycleHow did the high performing IT organizations make their “good to great” transformations?Nine practical steps overcome audit fatigueWhat does integration of security controls into daily operation feel like?Additional resourcesAuthorsGene Kim, Founder/CTO, Tripwire, Inc.Jennifer Bayuk, Cybersecurity Program Director, Stevens Institute of Technology

“Boss, We Are Ready For The Upcoming Audits…”

“OMG. OMG. The Auditors Are Coming When?!?”

“IT Operations Not Quite As Ready As They Thought…”

“Infosec Must Do Heroics, Generating Reports And Presentations From Scratch…”

“Despite Heroics, The Business Still Fails The Audit…”

“InfosecAs Professional Apologist…’”

Problems: AccountabilityInfosec often discovers too late that business and IT management were not as prepared for the audits as was representedBusiness, IT and infosec must perform heroics to generate proof of compliance, often requiring new documents and presentations from scratch in response to auditor questionsBusiness may fail an audit test, requiring remediation work, audit retests, fines, loss of auditor confidence in the infosecprogram, as well as loss of personal trust in the infosec managerA security breach may occur, and the business must now explain how it occurred despite passing the audit

Problem: OrganizationalInformation security is often organized and designed to minimally interfere with business and IT operations, but creates barriers to meeting compliance goalsInformation security is held accountable, but control effectiveness relies upon other business and IT management to be adequately prepared

Problems: The Real Business CostScheduled value-adding work and projects are delayed because of all the urgent and unplanned audit prep workBusiness continues to implement controls as a part of a one-time audit preparation project to achieve compliance, with little thought on how to maintain compliance over time Next time requires just as much effort, instead of integrating controls into daily business and IT operational processesThe business starts treating audit prep as a legitimate value-adding project, even charging time against itMultiple regulatory and contractual requirements result in IT controls being tested numerous times by numerous parties, requiring management to perform work multiple times

Information Security and Compliance RisksInformation security practitioners are always one change away from a security breachFront page newsRegulatory finesBrand damageHigh profile security failures are increasing external pressures for security and complianceSarbanes-Oxley (SOX) Act of 2002, the Gramm-Leach-Bliley Act, Health Insurance Portability and Accountability Act (HIPAA), emerging privacy laws, and the Payment Card Industry Data Security Standard (PCI DSS)

Desired Outcome: Create A Higher Performing, More Nimble and More Secure IT Organization10,0001000Best in Class Ops and Security100101020406080100120140Operations Metrics Benchmarks:Best in Class: Server/sysadmin ratiosHighest ratio of staff for pre-production processes

Lowest amount of unplanned work

Lowest cost of complianceSize of Operation# ServersEfficiency of OperationServer/sysadmin ratioSource: IT Process Institute (2001)

Higher Performing IT Organizations Are More Stable, Nimble, Compliant And Secure High performers maintain a posture of compliance

Fewest number of repeat audit findings

One-third amount of audit preparation effort

High performers find and fix security breaches faster

5 times more likely to detect breaches by automated control

5 times less likely to have breaches result in a loss event

When high performers implement changes…

One-half the change failure rate

One-quarter the first fix failure rate

10x fasterMTTR for Sev 1 outages

When high performers manage IT resources…

One-third the amount of unplanned work

8 times moreprojects and IT services

6 times moreapplicationsSource: IT Process Institute, May 2008

Visible Ops: Playbook of High PerformersThe IT Process Institute has been studying high-performing organizations since 1999What is common to all the high performers?What is different between them and average and low performers?How did they become great?Answers have been codified in the Visible Ops Methodology

Over Ten Years, We Benchmarked 1500+ IT OrgsSource: EMA (2009) Source: IT Process Institute (2008)

2007: Three Controls Predict 60% Of PerformanceTo what extent does an organization define, monitor and enforce the following?Standardized configuration strategyProcess disciplineControlled access to production systemsSource: IT Process Institute, May 2008

Nine Practical Steps To Overcome Audit Fatigue And The Blame Cycle

The Nine Steps To Avoid Audit FatigueStep 1: Align with tone at the topStep 2: Create a set of merged infosec and compliance/business goalsStep 3: Define ideal information security goal indicatorsStep 4: Gain an end-to-end understanding of the information flowStep 5: Agree upon control ownership, roles and responsibilitiesStep 6: Define the control tests so business process control owners will agree with the resultsStep 7: Schedule and conduct regular control testsStep 8: Organize metrics and remediation reportsStep 9: Detect and respond to significant changes to the control environment

Step 1: Align With Tone At The TopEnsure that compliance activity is clearly managed from the top down.

Step 2: Merge Information Security Into The Compliance/ Business GoalsDocument IT governance goals and the risks to achieving those goalsConfirm that information security and compliance helps achieve those goals.For instance:A manufacturing company must comply with a regulatory requirement that certain chemical toxins are never released into the atmosphere in amounts over 10 particles per second. The manufacturing control system has been designed to ensure that this toxin is released at a rate of only 1 particle per second.

Step 2: Merge Information Security Into The Compliance/ Business GoalsWhat is the business objective?Ensure smooth operation of the manufacturing process, in accordance to the business plan and all associated laws and regulations.What are the information security and compliance risks?The manufacturing control system could fail and release more than the allowed amount of the chemical toxin into the atmosphere.The measurement system may not detect this release. Also, the manufacturing control measurement data could be altered or lost, which would prevent management from validating emissions output compliance.What is my information security goal to address this risk?We must maintain integrity over the particle release measurement process and the measurement data.

Step 2: Merge Information Security Into The Compliance/ Business GoalsWhat control will we implement to meet this goal?An access and measurement testing control process will protect the toxin release measurement software against tampering. The control will alert operations when changes to access are detected and when abnormal variations in the toxin measurements occur. The alert response will include automated and manual procedures that verify that the algorithm installed in the production system is the same as the one that underwent rigorous pre-production system testing.What does plant management (the business process owner) need to do to support this goal?The control process would require the business process owner to configure the production system to minimize the access any given individual needs to change the algorithm and the corresponding data. The control process would also require the business process owner to minimize the job functions that require access to the algorithms and the measurement data.

Step 3: Define Ideal Information Security MeasuresDevelop theoretical ideal indicators that demonstrate that information security goals are being met.Examples# of access roles not validated by management% of accounts not matching management-defined roles% of configurations not pre-approved by management% of changes not approved by management% of systems with centralized logging

Step 4: Gain End-to-End UnderstandingDo an end-to-end business process walk-through to understand and document:Where does sensitive information enter, transit, get stored, and exit the organization?What are the risks to organizational goals and information flow?Where is reliance placed on technology to prevent and detect control failures?

Step 4: Gain End-to-End UnderstandingA merchant has a business process that supports a customer loyalty program. The program includes issuing branded credit cards. The consumer credit information flow starts with a customer filling out an online application form, which is…Sent to the credit calculation application, is then…Sent to a sales application, and…Ends up in an application that runs on the desktop of every customer service representative. What is the business goal?To ensure that customers approved for the credit card services are capable of meeting their obligations, so that any credit extended to the customer is likely to be repaid.

Step 4: Gain End-to-End UnderstandingWhat are the business, information security and compliance risks?Customer information is inaccurateCustomer information is inadvertently disclosed, violating regulatory requirementsThrough what applications does the information flow?The online application form is delivered through a third-party vendor, The credit calculation is done on cloud computing resourcesThe sales application is run internally by IT operationsThe customer service application is run by a combination of internally developed server software and desktop software on the customer service desktops.

Step 5: Agree Upon Control Ownership, Roles And ResponsibilitiesClearly define roles and responsibilities for audit compliance activities at the process owner level.

Step 6: Define The Control Tests So Control Owners Will Agree With The ResultsMake sure that evidence that demonstrates compliance goals have been met can be generated in an automated manner, upon demand.This will mirror the accountability spreadsheet that the auditors will likely constructThis is what enables information security to not be left holding the bag when IT operations is disorganized or unprepared.

2010 06 gartner avoiding audit fatigue in nine steps 1d

More Related Content

What's hot (20)

Viewers also liked (17)

Similar to 2010 06 gartner avoiding audit fatigue in nine steps 1d (20)

More from Gene Kim (20)

Recently uploaded (20)

2010 06 gartner avoiding audit fatigue in nine steps 1d

Editor's Notes