Cobit 5 for information security
- 1. COBIT 5 Information Security November 2012 Robert E Stroud CGEIT CRISC Vice President Strategy & Innovation ISACA Strategic Advisory Council
- 2. Robert E Stroud CRISC CGEIT Vice President, Strategy & Innovation Cloud Computing, Service Management & Governance Evangelist — Vice President Strategy & Innovation — Immediate Past International Vice President ISACAITGI — ISACA Strategic Advisory Council — 15 years Banking Experience — Contributor COBIT, VALIT and RISK IT — Immediate Past Executive Board itSMF Intl. Treasurer and Director Audit Standards & compliance — Former Board Member USA itSMF — Author, Public Speaker & Industry GeeK
- 4. One small step for man... “In 1969 NASA launched a man to the moon” “In 2012 Launching unhappy birds into pigs”
- 5. Facebook 9 months 1 million users ”Draw Something” 9 days Launched Feb 2012 50 million users in 50 days ! Sold: $180M - 6 weeks 5
- 7. Crowding Out 7 Crowdsourcing Value = Mass Collaboration
- 8. Mobile is Dead (Long Live Mobile) 8
- 9. termination of email…. Facebook has more than 600 million active users LinkedIn has more than 100 million registered users, spanning more than 200 countries Twitter has 200 million users, generating 65 million tweets a day "Social media has played a crucial role in the unrest in Egypt, with many of the protests organized through Facebook." — BBC News
- 11. “cybercrime”
- 12. “cyber terrorism” Sydney Morning Herald – March 5, 2011
- 13. COBIT 5: Information Security
- 14. How much security is enough?
- 15. Information! Information is a key resource for all enterprises. Information is created, used, retained, disclosed and destroyed. Technology plays a key role in these actions. Technology is becoming pervasive in all aspects of business and personal life. What benefits do information and technology bring to enterprises?
- 16. COBIT 5 Product Family Source: COBIT® 5 for Information Security, figure 1. © 2012 ISACA® All rights reserved.
- 17. COBIT 5 for Information Security — Extended view of COBIT5 — Explains each component from info security perspective
- 18. What does COBIT for Information Security contain? Guidance on drivers, benefits Principles from infosec perspective Enablers for support Alignment with standards
- 19. Drivers 1. The need to describe information security in an enterprise context 2. An increasing need for enterprises to: Keep risk at acceptable levels. Maintain availability to systems and services. Comply with relevant laws and regulation. 3. The need to connect to and align with other major standards and frameworks 4. The need to link together all major ISACA research, frameworks and guidance
- 20. Benefits • Reduced complexity and increased cost-effectiveness due to improved and easier integration of information security standards • Increased user satisfaction with information security arrangements and outcomes • Improved integration of information security in the enterprise • Informed risk decisions and risk awareness • Improved prevention, detection and recovery • Reduced impact of security incidents • Enhanced support for innovation and competitiveness • Improved management of costs related to the information security function • Better understanding of information security
- 21. Information Security Defined —ISACA defines information security as something that: Ensures that within the enterprise, information is protected against disclosure to unauthorized users (confidentiality), improper modification (integrity) and non-access when required (availability).
- 22. Using COBIT 5 Enablers for Implementing Information Security COBIT 5 for Information Security provides specific guidance related to all enablers 1. Information security policies, principles, and frameworks 2. Processes, including information security-specific details and activities 3. Information security-specific organisational structures 4. In terms of culture, ethics and behaviour, factors determining the success of information security governance and management 5. Information security-specific information types 6. Service capabilities required to provide information security functions to an enterprise 7. People, skills and competencies specific for information security
- 23. Enabler: Principles, Policies & Frameworks Principles, policies and frameworks refer to the communication mechanisms put in place to convey the direction and instructions of the governing bodies and management, including: • Principles, policies and framework model • Information security principles • Information security policies • Adapting policies to the enterprises environment • Policy life cycle
- 24. Enabler: Principles, Policies & Frameworks Policy Framework Information Security Principles Information Security Policy Input Mandatory Information Security Standards, Frameworks and Models Specific Information Security Policies Information Security Procedures Information Security Requirements and Documentation Generic Information Security Standards, Frameworks and Models Source: COBIT 5 for Information Security, figure 10. © 2012 ISACA® All rights reserved
- 25. Information Security Principles Information security principles communicate the rules of the enterprise. These principles need to be: • Limited in number • Expressed in simple language In 2010 ISACA, ISF and ISC2 worked together to create 12 principles* that will help information security professionals add value to their organisations. The principles support 3 tasks: • Support the business. • Defend the business. • Promote responsible information security behaviour. * Principles are covered in COBIT 5 for Information Security and can also be located at www.isaca.org/standards
- 26. Information Security Policies Policies provide more detailed guidance on how to put principles into practice. Some enterprises may include policies such as: • Information security policy • Access control policy • Personnel information security policy • Incident management policy • Asset management policy COBIT 5 for Information Security describes the following attributes of each policy: • Scope • Validity • Goals
- 27. Enabler: Processes —The COBIT 5 process reference model subdivides the ITrelated practices and activities of the enterprise into two main areas—governance and management—with management further divided into domains of processes: − The Governance domain contains five governance processes; within each process, evaluate, direct and monitor (EDM) practices are defined. − The four Management domains are in line with the responsibility areas of plan, build, run and monitor (PBRM). − COBIT 5 for Information Security examines each of the processes from an information security perspective.
- 28. Enabler: Processes (cont.) Source: COBIT 5 for Information Security, figure 7. © 2012 ISACA® All rights reserved
- 29. INSERT THE FOLLOWING GRAPHICS FROM APPENDIX B — EDM03 – PAGE 75 — APO 13 MANAGE SECURITY PAGE 113 AND 114 — BAI 06 MANAGE CHANGE 131 AND 132 — DSS05 MANAGE SECURITY SERVICES 151 AND 152 29
- 30. APPENDIX B Appendix B – EDM03 Ensure Risk Optomisation DETAILED GUIDANCE: PROCESSES ENABLER Area: G overnance Domain: E valuate, Direct and Monitor E DM03 E nsure Risk O ptimisation CO 5 Process Description BIT E nsure that the enterprise’s risk appetite and tolerance are understood, articulated and communicated, and that risk to enterprise value related to the use of IT is identified and managed. CO 5 Process Purpose Statement BIT E nsure that IT -related enterprise risk does not exceed risk appetite and risk tolerance, the impact of IT risk to enterprise value is identified and managed, and the potential for compliance failures is minimised. E DM03 Security-specific Process G oals and Metrics Security-specific Process G oals Related Metrics 1. Information risk management is part of overall enterprise risk management (E M). R information security controls E DM03 Security-specific Process Practices, Inputs/O utputs and Activities Security-specific Inputs (in Addition to CO 5 Inputs) BIT G overnance Practice From E DM03.01 E valuate risk management. C ontinually examine and make judgement on the effect of risk on the current and future use of IT in the enterprise. C onsider whether the enterprise’s risk appetite is appropriate and that risk to enterprise value related to the use of IT is identified and managed. O utside C BIT 5 O for Information Security Security-specific O utputs (in Addition to CO 5 O BIT utputs) Description indicators (KR Is) guidance Description Alignment of enterprise KR with information Is security KR Is E DM03.02 Information security risk acceptable level E DM03.02 E DM03.03 Security-specific Activities (in Addition to CO 5 Activities) BIT Page 75 – COBIT for Information Security 1. Determine the enterprise risk appetite at the board level. T o
- 31. Security-specific Process G oals Related Metrics Appendix B – EDM03 Ensure Risk Optomisation 1. Information risk management is part of overall enterprise risk management (E M). R information security controls E DM03 Security-specific Process Practices, Inputs/O utputs and Activities Security-specific Inputs (in Addition to CO 5 Inputs) BIT G overnance Practice From E DM03.01 E valuate risk management. C ontinually examine and make judgement on the effect of risk on the current and future use of IT in the enterprise. C onsider whether the enterprise’s risk appetite is appropriate and that risk to enterprise value related to the use of IT is identified and managed. O utside C BIT 5 O for Information Security Security-specific O utputs (in Addition to CO 5 O BIT utputs) Description indicators (KR Is) guidance Description T o Alignment of enterprise KR with information Is security KR Is E DM03.02 Information security risk acceptable level E DM03.02 E DM03.03 Security-specific Activities (in Addition to CO 5 Activities) BIT 1. Determine the enterprise risk appetite at the board level. 2. Measure the level of integration of information risk management with the overall E M model. R Security-specific Inputs (in Addition to CO 5 Inputs) BIT G overnance Practice From E DM03.02 Direct risk management. Direct the establishment of risk management practices to provide reasonable assurance that IT risk management practices are appropriate to ensure that the actual IT risk does not exceed the board’s risk appetite. Security-specific O utputs (in Addition to CO 5 O BIT utputs) Description E DM03.01 KR with information Is security KR Is Description U pdated risk management policies T o Internal acceptable level Security-specific Activities (in Addition to CO 5 Activities) BIT 1. Integrate information risk management within the overall E M model. R Security-specific Inputs (in Addition to CO 5 Inputs) BIT G overnance Practice From E DM03.03 Monitor risk management. Monitor the key goals and metrics of the risk management processes and establish how deviations or problems will be identified, tracked and reported for remediation. Security-specific O utputs (in Addition to CO 5 O BIT utputs) Description E DM03.01 Information security risk acceptable level AP 01.03 O Information security and related policies Description R emedial actions to address risk management deviations Security-specific Activities (in Addition to CO 5 Activities) BIT 1. Monitor the enterprise information risk profile or risk appetite to achieve optimal balance between business risk and opportunities. 2. Include outcomes of information risk management processes as inputs to the overall business risk dashboard. For more information regarding the related enablers, please consult: Page 75 – COBIT for Information Security T o Internal
- 32. APPENDIX B DETAILED GUIDANCE: PROCESSES ENABLER Appendix B – APO 13 MANAGE SECURITY Area: Management Domain: Align, Plan and O rganise APO Manage Security 13 CO 5 Process Description BIT Define, operate and monitor a system for information security management. CO 5 Process Purpose Statement BIT Keep the impact and occurrence of information security incidents within the enterprise’s risk appetite levels. APO Security-specific Process G 13 oals and Metrics Security-specific Process G oals Related Metrics 1. A system is in place that considers and effectively addresses enterprise information security requirements. 2. A security plan has been established, accepted and communicated throughout the enterprise. the enterprise Align, Plan and O rganise 3. Information security solutions are implemented and operated consistently throughout the enterprise. security plan security plan APO Security-specific Process Practices, Inputs/O 13 utputs and Activities Security-specific Inputs (in Addition to CO 5 Inputs) BIT Management Practice From APO 13.01 E stablish and maintain an information security management system (ISMS). E stablish and maintain an ISMS that provides a standard, formal and continuous approach to security management for information, enabling secure technology and business processes that are aligned with business requirements and enterprise security management. Security-specific O utputs (in Addition to CO 5 O BIT utputs) Description O utside C BIT 5 E O nterprise security for Information approach Security Description T o ISMS scope statement AP 01.02 O DSS06.03 ISMS policy Internal Security-specific Activities (in Addition to CO 5 Activities) BIT 1. Define the scope and boundaries of the ISMS in terms of the characteristics of the enterprise, the organisation, its location, assets and technology. Include details of, and justification for, any exclusions from the scope. 2. Define an ISMS in accordance with enterprise policy and aligned with the enterprise, the organisation, its location, assets and technology. 3. Align the ISMS with the overall enterprise approach to the management of security. 4. O btain management authorisation to implement and operate or change the ISMS. 5. Prepare and maintain a statement of applicability that describes the scope of the ISMS. 6. Define and communicate information security management roles and responsibilities. 7. C ommunicate the ISMS approach. COBIT for Information Security - APO 13 MANAGE SECURITY PAGE 113
- 33. Appendix B – APO 13 MANAGE SECURITY FOR I NFORMATION SECURITY APO Security-specific Process Practices, Inputs/O 13 utputs and Activities (cont.) Security-specific Inputs (in Addition to CO 5 Inputs) BIT Align, Plan and O rganise Management Practice From APO 13.02 Define and manage an information AP 02.04 O security risk treatment plan. Maintain an information security plan that describes how information security risk is to be managed and AP 03.02 O aligned with the enterprise strategy and enterprise architecture. E nsure that recommendations for implementing security improvements are based on approved business cases and implemented as an AP 12.05 O integral part of services and solutions development, then operated as an integral part of business operation. Security-specific O utputs (in Addition to CO 5 O BIT utputs) Description T o G to be closed and aps Information security changes required to realise business cases target capability Description AP 02.05 O Baseline domain descriptions and architecture definition P roject proposals for reducing risk Security-specific Activities (in Addition to CO 5 Activities) BIT 1. F ormulate and maintain an information security risk treatment plan aligned with strategic objectives and the enterprise architecture. E nsure that the plan identifies the appropriate and optimal management practices and security solutions, with associated resources, responsibilities and priorities for managing identified information security risk. 2. Maintain, as part of the enterprise architecture, an inventory of solution components that are in place to manage security-related risk. 3. Develop proposals to implement the information security risk treatment plan, supported by suitable business cases, which include consideration of funding and allocation of roles and responsibilities. 4. Provide input to the design and development of management practices and solutions selected from the information security risk treatment plan. 5. Define how to measure the effectiveness of the selected management practices and specify how these measurements are to be used to assess effectiveness to produce comparable and reproducible results. 6. R ecommend information security training and awareness programmes. 7. Integrate the planning, design, implementation and monitoring of information security procedures and other controls capable of enabling prevention, and prompt detection of security events, and response to security incidents. Security-specific Inputs (in Addition to CO 5 Inputs) BIT Management Practice From APO 13.03 Monitor and review the ISMS. Maintain and regularly communicate the need for, and benefits of, continuous information security improvement. C ollect and analyse data about the ISMS, and improve the effectiveness of the ISMS. C orrect non-conformities to prevent recurrence. Promote a culture of security and continual improvement. DSS02.02 Security-specific O utputs (in Addition to CO 5 O BIT utputs) Description C lassified and prioritised incidents and service requests Description T o R ecommendations for improving the ISMS Internal ISMS audit reports ME A02.01 Security-specific Activities (in Addition to CO 5 Activities) BIT 1. U ndertake regular reviews of the effectiveness of the ISMS, including meeting ISMS policy and objectives, and review of security practices. T into ake account results of security audits, incidents, results from effectiveness measurements, suggestions and feedback from all interested parties. 2. C onduct internal ISMS audits at planned intervals. 3. U ndertake a management review of the ISMS on a regular basis to ensure that the scope remains adequate and improvements in the ISMS process are identified. 4. P rovide input to the maintenance of the security plans to take into account the findings of monitoring and review activities. 5. R ecord actions and events that could have an impact on the effectiveness or performance of the ISMS. COBIT for Information Security - APO 13 MANAGE SECURITY PAGE 114
- 34. Enabler: Organisational Structures COBIT 5 examines the organisational structures model from an information security perspective. It defines information security roles and structures and also examines accountability over information security, providing examples of specific roles and structures and what their mandate is, and also looks at potential paths for information security reporting and the different advantages and disadvantages of each possibility.
- 35. Enabler: Culture, Ethics and Behaviour Examines the culture, ethics and behaviour model from an information security perspective providing detailed security specific examples of: 1.The Culture Life Cycle –measuring behaviours over time to benchmark the security culture –some behaviours may include: − Strength of passwords − Lack of approach to security − Adherence to change management practices 2.Leadership and Champions –need these people to set examples and help influence culture: − Risk managers − Security professionals − C-level executives 3.Desirable Behaviour –a number of behaviours have been identified that will help positively influence security culture: − Information security is practiced in daily operations. − Stakeholders are aware of how to respond to threats. − Executive management recognises the business value of security.
- 36. Enabler: Information Information is not only the main subject of information security but is also a key enabler. 1. Information types are examined and reveal types of relevant security information which can include: Information security strategy Information security budget Policies Awareness material Etc. 2. Information stakeholders as well as the information life cycle are also identified and detailed from a security perspective. Details specific to security such as information storage, sharing, use and disposal are all discussed.
- 37. Enabler: Services, Infrastructure and Applications — The services, infrastructure and applications model identifies the services capabilities that are required to provide information security and related functions to an enterprise. The following list contains examples of potential security-related services that could appear in a security service catalogue: • Provide a security architecture. • Provide security awareness. • Provide security assessments. • Provide adequate incident response. • Provide adequate protection against malware, external attacks and intrusion attempts. • Provide monitoring and alert services for security related events.
- 38. Enabler: People, Skills and Competencies To effectively operate an information security function within an enterprise, individuals with appropriate knowledge and experience must exercise that function. Some typical security-related skills and competencies listed are: • Information security governance • Information risk management • Information security operations COBIT 5 for Information Security defines the following attributes for each of the skills and competencies: • Skill definition • Goals • Related enablers
- 39. Chapter 2: Implementing Information Security Initiatives Considering the enterprise information security context: COBIT 5 for Information Security advises that every enterprise needs to define and implement its own information security enablers depending on factors within the enterprise’s environment such as: —Ethics and culture relating to information security —Applicable laws, regulations and policies —Existing policies and practices —Information security capabilities and available resources
- 40. Chapter 2: Implementing Information Security Initiatives (cont.) —Additionally, the enterprise’s information security requirements need to be defined based on: −Business plan and strategic intentions −Management style −Information risk profile −Risk appetite —The approach for implementing information security initiatives will be different for every enterprise and the context needs to be understood to adapt COBIT 5 for Information Security effectively.
- 41. Chapter 2: Implementing Information Security Initiatives (cont.) Other key areas of importance when implementing COBIT 5 for Information Security are: • Creating the appropriate environment • Recognising pain points and trigger events • Enabling change • Understanding that implementing information security practices is not a one time event but is a life cycle
- 42. Chapter 3: Using COBIT 5 for Information Security to Connect Other Frameworks, Models, Practices & Standards — COBIT 5 for Information Security aims to be an umbrella framework to connect to other information security frameworks, good practices and standards. — COBIT 5 for Information Security describes the pervasiveness of information security throughout the enterprise and provides an overarching framework of enablers, but the others can be helpful as well because they may elaborate on specific topics. Examples include: − − − − − Business Model for Information Security (BMIS)–ISACA Standard of Good Practice for Information Security (ISF) ISO/IEC 27000 Series NIST SP 800-53a PCI-DSS
- 43. High-level RACI chart—RACI charts link process activities to organisational structures and/or individual roles in the enterprise. They describe the level of involvement of each role for each process practice: accountab le, responsible, consulted or infor med. Inputs/Outputs—A structure requires inputs (typicall y information) before it can tak e informed decisions, and it produces outputs such as decisions, other infor mation or requests for additional inputs. Appendix C – Detailed organisational structure C.1 Chief Information Security Officer Mandate, Operating Principles, Span of Control and Authority Level Figure 25 lists the characteristics of the CISO. Figure 25—C : Mandate, O ISO perating Principles, Span of C ontrol and Authority Level Area Characteristic Mandate The overall responsibility of the enterprise information security programme O perating principles Depending on a variety factors within the enterprise, the C may report to the C O C O C , C Oor other senior ISO E , O , IO R executive management. The C is the liaison between executive management and the information security programme. The C should also ISO ISO communicate and co-ordinate closely with key business stakeholders to address information protection needs. The C must: ISO Span of control The C is responsible for: ISO Authority level/decision rights The C is responsible for implementing and maintaining the information security strategy. ISO Accountability (and sign-off of important decisions) resides in the function to which the C reports, for example, ISO senior executive management team member or the ISSC . Delegation rights The C should delegate tasks to information security managers and business people. ISO E scalation path The C should escalate key information risk-related issues to his/her direct supervisor and/or the ISSC ISO . COBIT for Information Security - Appendix C Detailed Organisational Structure Page 169
- 45. thank you Robert E Stroud CGEIT CRISC Robert.Stroud@ca.com Twitter @robertestroud Blogs http://community.ca.com/blogs/ITIL http://community.ca.com/blogs/ppm
- 46. COBIT 5 Information Security August 2012 Robert E Stroud CGEIT CRISC Vice President Strategy & Innovation ISACA Strategic Advisory Council