Information Security Planning

• IS planning includes information security governance, policies, standards, guidelines, and procedures

Information Security Governance

• Governance involves responsibilities and practices by the board and executive management
• The goal of governance is to provide strategic direction, set objectives, and measure progress
• Governance validates the appropriateness of risk management practices and proper asset use
• ISG outcomes include strategic alignment (SA), risk management (RM), resource management (PM), value delivery (VD) and performance measurement

Policies, Standards, Guidelines and Procedures

• Policies should be based on management from communities of interest for IS planning, design, and deployment
• Policies direct how to address issues and use technologies
• Policies should never contradict the law, must be able to stand up in court and must be properly administered
• Security policies are the least expensive but most difficult controls to implement

Policy

• Functions as organizational law defining acceptable and unacceptable behavior
• Policies are sanctioned by management
• An example of such a policy is employees using strong passwords, changing them regularly, and protecting them against disclosure

Standard

• Comprises more detailed statements for policy compliance
• Includes detailed minimum specifications for compliance
• An example of a standard is passwords being at least 18 characters long and changed every 90 days

Guideline

• Effectively explains how to comply with policy
• Gives recommendations for compliance
• For example, using diceware to help generate a passprase

Procedure

• Provides step-by-step instructions for compliance
• For example, "click on... then click on... then click on save" within Windows

Criteria for Effective Policy

• Development (industry-accepted)
• Dissemination (distribution)
• Review (reading)
• Compliance (agreement)
• Comprehension (understanding)
• Uniform enforcement (fairness in application)

Types of Policies

Enterprise Information Security Policy (EISP)

• A high-level security policy that sets the overall security direction for the entire organization
• Sets strategic direction, scope, and tone for all security efforts
• Executive-level document drafted by or with the CIO
• Addresses general compliance for meeting requirements, establishing programs, and assigning responsibilities
• Addresses use of specific penalties and disciplinary actions
• Elements should include an overview of corporate security philosophy, information on the structure of the organization, articulated responsibilities for all members of the organization and unique elements for each role in the organization

Information System Security Policy (ISSP)

• Addresses specific security issues within the organization
• Addresses specific areas of technology
• Requires frequent updates and contains a statement on the organization's position on specific issues
• Common Approaches include; creating several independent ISSPs, creating a single comprehensive ISSP or a modular ISSP.

System Specific Security Policy (SysSP)

• These are technical policies designed for specific systems or devices
• Can operate as the standards or procedures used when configuring or maintaining systems
• Are divided into two groups: managerial guidance (separation of duties, etc.) and technical specifications
• Functions as a minimum configuration setting in a system
• Typically does not require organizational-wide approval

Policy Management

• Policies must be managed and updated, to remain viable
• A responsible manager, a schedule of reviews, a method for making recommendations for review and automated policy management are needed
• Policies must have a policy issuance and revision date