Information Security Governance and ISSC

Information Security Steering Committee (ISSC)

• The ISSC is a crucial component of an organization's information security governance structure.
• Membership should be tailored to the organization's context and control objectives, with representatives from senior management, each line of business, corporate departments (like HR and finance), and the IT department
• The ISSC's responsibilities should be defined in a formal charter, with members having the authority to make decisions within their respective areas.
• The ISSC should not become involved in routine IT operations.
• The ISSC has a number of primary functions, which include reviewing long- and short-range IT plans, major hardware and software acquisitions, and IS projects, as well as approving sourcing strategies, resource allocation decisions, and information security management programs.
• The ISSC should ensure the alignment of IT activities with corporate objectives, and report on IS activities to the board of directors.

IT Steering Committee

• The IT steering committee provides oversight of the IT function and its activities.
• It should have members who understand the risks and issues associated with IT and who can ensure alignment with the corporate mission and objectives.
• Membership should include representatives from senior management, each line of business, corporate departments, such as HR and finance, and the IT department.
• The IT steering committee should have a formal charter defining its duties and responsibilities.
• Members should be knowledgeable about IT department policies, procedures, and practices.
• The IT steering committee typically acts as a review board for major IT projects.

Matrix of Outcomes and Responsibilities

• The matrix displays the relationships between the outcomes of effective security governance and management responsibilities.
• The matrix is intended to illustrate some primary tasks and the management level responsible for them.
• It emphasizes that the roles and responsibilities should exist, even if different labels are used for management titles in various organizations.

Security Administration

• Security administration is a critical function that begins with management commitment.
• Management must understand and evaluate security risks, and develop and enforce a written security policy that outlines standards and procedures.
• The duties of the security administrator should be defined in the policy.
• The security administrator should ideally be a full-time employee who reports directly to the infrastructure director.
• The security administrator ensures that users comply with the corporate security policy, and oversees access to company assets.
• The security administrator's responsibilities include maintaining access rules, ensuring the security of user IDs and passwords, monitoring security violations, reviewing and evaluating the security policy, preparing and monitoring security awareness programs, testing the security architecture, and collaborating with compliance, risk management, and audit functions.

Database Administration

• The database administrator (DBA) is responsible for defining and maintaining the data structures within the corporate database system.
• The DBA must understand the organization's data requirements, user data, and data relationships.
• The DBA is responsible for the security of the shared data stored on database systems.

System Security Engineer

• The system security engineer provides technical information system security engineering support to the organization.
• The system security engineer contributes to project life cycles, organizational activities, and interactions with other disciplines, and works with other organizations on activities like acquisition, system management, and certification.

Applications Development and Maintenance

• Applications staff are responsible for developing and maintaining applications, including developing new code and modifying existing application configurations.
• Management must ensure that staff cannot modify production programs or data, as development occurs in a test-only environment.
• Development work must be transferred to another group for deployment into the production environment.

Infrastructure Development and Maintenance

• Infrastructure staff are responsible for maintaining the systems software, including the operating system.
• This function requires staff to have broad access to the entire system, requiring close management monitoring through electronic logs to capture and prevent alteration of activity records.
• Infrastructure staff should have access limited to the system libraries of the specific software they maintain.
• The use of domain administration and superuser accounts should be tightly controlled and monitored.

Network Management

• Network administrators are responsible for key network infrastructure components, such as routers, switches, firewalls, network segmentation, performance management, and remote access.
• The geographic dispersion of networks often requires dedicated administrators for each local area network (LAN).
• Network administrators may report to the director of the information processing facility (IPF) or, in decentralized operations, to the end-user manager, with a dotted line reporting relationship to the IPF director recommended.
• The network administrator controls the LAN technically and administratively, ensuring transmission link functionality, system backups, authorized software and hardware purchases, and proper installation.
• In smaller settings, the network administrator may also be responsible for LAN security administration.
• The LAN administrator should typically avoid application programming responsibilities but may have some involvement in systems programming and end-user tasks.

Segregation of Duties (SoD) Within IT

• Adequate SoD is crucial for preventing errors, misappropriations, and fraudulent activities.
• SoD involves separating critical functions to prevent a single person from controlling multiple aspects of a process that could lead to undetectable errors or misappropriations.
• Duties that should be segregated include custody of assets, authorization, and recording transactions.
• The lack of SoD can lead to misappropriation of assets, misstated financial statements, and inaccurate financial documentation.

This quiz covers the role and responsibilities of the Information Security Steering Committee (ISSC) in an organization's governance structure. It emphasizes the importance of tailored membership, formal charters, and alignment of IT activities with corporate objectives. Test your knowledge on the key functions and considerations involved in overseeing information security.