Duncan hine input2_ irm_and_outsourcing
0 likes522 views
This document describes a case study of outsourcing IT operations for a defense organization while managing information security risks. The organization wanted to reduce costs by moving back-office functions offshore but was concerned about security risks. By analyzing potential threats, exploits, and mitigations, security experts were able to identify controls to reduce risks to an acceptable level and allow some functions to be moved, while scrambling sensitive data and keeping it secured in an UK enclave. This achieved savings for the organization while strengthening security and partnerships.
Duncan hine input2_ irm_and_outsourcing
- 1. Information Security Risk Management IT operation outsourcing A case study
- 3. Based on a real project Identities protected and altered – does not affect the process that was used A sensitive defence organisation needs to be more cost effective Already has long term outsource partner Mid contract break point drives improvement Perception that security experts will say no This is based on current policy
- 5. Research and advice across defence sector Many highly sensitive contracts and relationships Key target for traditional and cyber attack Already outsourced support in many areas but all delivered from inside UK Urgent need to make more savings Concept is to move back office processing and support to a low cost labour country
- 6. Use the process to establish threats and exploits Look at sensitivity of assets affected See if controls and mitigations can reduce these to acceptable levels Stop or go ahead and accepts residual risks Sounds simple but only works if you understand how the exploits will happen
- 7. Move offshore : No classified material at all Human resource basic records Travel expenses fulfilment Purchase order ledger Order generation Payment of suppliers
- 8. Agree some risks to privacy sensitive records No classified material included so low risk Bulk data sets to be protected no copying or transport in country Staff in country to be vetted Buildings to be secured to higher level Subcontract suppliers to be vetted Extra monitoring to be established
- 9. Threats from individuals, petty criminals and other low grade threat actors Opportunistic not organised No strategic goal Security first response is NO Little explanation but just a risk we don’t need to take
- 10. Leadership want to make the savings Security role to establish the REAL risks Then find ways of reducing them Explain the result to leaders so they can decide if the residual risks are acceptable Key is to find a way we can all say yes to a desirable initiative not find reasons to say no!
- 11. Threat sources FIS, competitors and sophisticated activist groups Want to reverse engineer size of cyber defences on new order for sensitive web hosting contract Purchase order ledger is moved offshore Use open source to establish likely timing of orders for components and services Penetrate data centre offshore via traditional human methods or cyber attack Collect and analyse project identifiers in database Collect orders and establish scale of servers and defences Mobilise denial of service resources now known to be able to destroy hosting at will
- 12. Threat actors FIS, crime, competitors want to identify targets for corruption related to specific contracts HR and travel expenses moved offshore Use open source material to identify timing of contract negotiation and award Target country is known - penetrate data centre or create and remove copy (could acquire rotating backups) Mine travel expenses to find all trips to target country in window and create long list Qualify list with HR system look for expensive life, large family, lower bonus etc Go back to expenses to find detailed behaviours, bar bills, timing, phone call duration .......... Short list targets and move to more traditional methods
- 13. Open source used to index low grade bulk data Structure of data is as valuable as the data itself Mining and profiling used to enrich data Traditional methods still needed but this improves chance of success significantly Access to data set or actual system is assumed in target country despite countermeasures Attacks are cyber used to enhance traditional approaches
- 14. Scramble data before off shoring Remove structure from orders Reassemble in UK Anonymous HR records with numeric identifiers and address data and other pointers removed Scramble travel expenses and make claim to index number not person Other similar methods to scramble data and remove structure All reinserted in secure enclave in UK
- 15. Off shoring can go ahead with residual risk lower than original solution Savings reduced by about 20% to pay for enclave in UK Information asset owners much more aware of real high impact risks Partnership with outsource provider strengthened Partner takes security function into other customers as expert adviser and secures new business
- 16. Threats from sophisticated sources not well understood by asset owners Assumption that security will say NO! Savings reduced but project still went ahead and delivered a large net saving After solution risks were lower than original solution Ready for next break point off shoring can now go to any country even very high risk/low cost environments