Chapter 13 Legal Issues ISO/IEC 27004:2016 and Information Security

Information Security Governance

• Information security governance (ISG) alongside information security policies are discussed.
• An organization's governance structure is crucial to its security program.
• Governance focuses on protecting resources and data, and supports business needs while ensuring security.
• Strong governance leads to successful security programs.
• Organizations use policies, standards, guidelines, and procedures to build their security program.
• Documentation helps guide employee behavior, define rules for securing IT resources, and protect against legal liability.

Chapter 13 Topics

• Key topic covered includes what information security governance is, what information security governance documents are, recommended information security policies, and case studies.

Chapter 13 Goals

• Main goals are to describe key concepts and terms related to security governance, goals of security governance documents, and the different types of security policies.

What is ISG?

• Data is a valuable asset for organizations.
• Over 50% of large corporations do not treat data as a business asset.
• Organizations must balance using data for business goals with protecting it.
• Failing to balance data use and protection can harm organizational goals.
• Executive management is responsible for governing the organization and its information security.
• ISG ensures the executive team protects information assets by making it a business decision.
• ISG aligns security objectives with business needs, moving security beyond technical concerns to strategic importance.
• Security goals of confidentiality, integrity, and availability are known as the C-I-A triad or the A-I-C triad.
• Organizations use ISG to improve their business.
• ISG ensures that information security concepts are applied in a way that helps meet business goals.
• ISG ensures accountability and oversight.

Information Security Governance Planning

• ISG is executive management's responsibility for strategic direction, oversight, and accountability in securing data and IT resources.
• The main task is ensuring the information security strategy supports business goals, including profitability.
• Strategic planning is long-term, focusing on new approaches, products, technologies, and processes.
• Tactical planning has a short- to medium-term outlook, enabling organizations to respond to market conditions and unexpected opportunities, typically within six months.
• Operational planning focuses on daily operations and immediate issues.

Information Security Needs

• Organizations determine how data meets business goals and how security can support this.
• Organizations must know their regulatory landscape, especially data protection laws.
• Organizations must adopt a risk management approach, identifying and prioritizing security risks.
• Organizations are to consider the impact of security failures like breaches, malware, or unavailable data, which can lead to lawsuits, costs, and loss of customers.
• A 2019 survey revealed the average cost of a data breach in the U.S. is almost $4 million.

ISG Strategic Roles

• ISG roles include board of directors, chief information officer, chief information security officer, and information security managers.
• The board of directors (BOD) is the top governance group, required by law to act with due care and in the organization's best interests.
• The BOD plans strategic direction, decides business goals, makes sure resources are used effectively, ensures legal compliance, determines how to reduce information security risk, issues high-level security policies, and delegates tactical activities.
• The chief information officer (CIO) is the senior IT official focusing on strategic IT issues and defining the IT mission.
• The CIO advises the BOD on IT issues, is strategic and tactical in nature, and delegates information security management (ISM) to a CISO.
• The CIO focuses on internal IT systems, while the chief technology officer (CTO) focuses on externally- geared technology products.
• The chief information security officer (CISO) is the senior information security official, responsible for information security strategy and tactical planning.
• The CISO ensures the CIO and BOD understand security threats, suggests security policy, determines security safeguards, and delegates operational tasks.
• Information security managers handle the functional management of the security program, implement controls set by the CISO, create security standards and guidelines, participate in risk assessments, and manage security infrastructure.
• Higher-level roles are for governance decisions while lower-level roles handle ISM and operational tasks.

ISG vs ISM

• ISG and ISM, though often used interchangeably, have a subtle distinction.
• Many organizations use one or both terms to refer to all governance and management activities.
• ISG, handled by the BOD, CIO, and CISO, ensures security supports business goals, offers oversight and accountability, and directs security activities.
• ISM refers to day-to-day security operations and implements ISG policies, maintaining the organization's security posture.

Creating an ISG program

• The International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) offer guidance for creating an ISG program.
• The standard uses the term ISM system to refer to both ISG and ISM activities.
• The standard creates a risk-based ISM system, reviewing how to operate, monitor, review, maintain, and improve it, outlining processes at each step, and can be used by organizations of all sizes.
• The ISO/IEC 27002:2013 standard known as “Information Technology-Security Techniques—Code of Practice for Information Security Controls," works with the standard.
• Organizations regularly review their ISM systems measuring their effectiveness, which is guided in "ISO/IEC 27004:2016 Information Technology-Security Techniques—Information Security Management—Monitoring, Measurement, Analysis, and Evaluation."
• ISM, the organization's day-to-day security operations, is the visible part of ISG and ensures ISG policies are put into practice.

The Federal Government's ISG

• Congress created the Federal Information Security Modernization Act (FISMA) to protect federal data and IT resources.
• Federal agencies must comply with FISMA, developing an information security program, naming a CISO, assessing security risk, reducing risk, providing security training, and reporting compliance to the Government Accountability Office (GAO).
• Since 1997, the GAO has designated protecting national information systems and cyber infrastructure vulnerable to fraud, waste, abuse, or mismanagement as “high risk”, updating the list every 2 years.

Information Security Governance Documents

• ISG documents establish the foundation for the security program.
• Documents address information security goals, how the organization protects its data and the data of others, compliance with regulations, employee responsibilities, and consequences for failing to meet responsibilities.
• Organizations use policies, standards, guidelines, and procedures to create their security program to support information security goals.
• A formal policy is the highest-level document, followed by standards, procedures, and guidelines.
• Guidelines provide security advice and move from broad policies to specific procedures.
• Policies and ISG Documents, is often used in a generic way to describe the entire suite of ISG documents.
• ISG documents are administrative safeguards.

Policy Statements

• A formal policy is executive management's high-level statement of security direction and goals.
• High-level governance documents help minimize risk by establishing the organization's security strategy and are approved by an organization’s BOD.
• The BOD uses policies to establish security goals and compliance expectations.
• Organizations develop policies by assessing their regulatory landscape, size, complexity, IT systems, and how security can meet business goals.
• Policies should include a policy statement, exclusions, rationale, definitions, affected parties, responsible parties, compliance language, related documents, contact information, and history.
• High-level policies should be clear, concise, and understandable by all, focusing on expectations rather than detailed instructions.

Understanding Standards

• Standards support high-level policies by detailing the activities and actions needed to meet policy goals.
• Are below policies in the ISG documents hierarchy.
• More specific than policies and may require actions or behaviors to comply with a policy, this is referred to as a baseline
• Technology neutral referring to safeguards and do not refer to safeguards and controls organizations need to protect data/IT resources.
• Created at the CIO/CISO level with input from security managers.

Understanding Procedures and Guidelines

• Procedures are the lowest ISG level documents.
• Provide step-by-step checklists on how to meet security goals or conduct security-related activities and are tailored to specific technologies or departments.
• Guidelines are the most flexible ISG document issued to encourage good security practices, educate, and promote action.
• Organizations might create a guideline to help employees learn how to avoid social engineering attacks.

Characteristics of Information Security Policies

• Each type of ISG document has a different role and focus, with each directed at different audiences.
• All must be easy to understand, have a clear scope, be regularly reviewed, and be communicated to all employees.
• An organization should create a structured ISG document development process, potentially with a "policy on policies".
• The formal process is to allow units, departments, and stakeholders an opportunity to comment on policies.

Policy Development

• The ISG development process includes development, stakeholder review, management approval, employee communication, compliance documentation, awareness activities, and maintenance/review.
• Legal counsel, risk management, and audit teams must ensure the document meets regulatory needs and protects the organization.
• The BOD must sign high-level policies, with the executive's authority signing lower-level documents.
• Effective is required for employees to find the resources needed to follow policy, which can be achieved through newsletters, memos, or company-wide emails.
• Organizations must measure policy compliance by documenting approval, communication, departmental actions, and deviations with formal policy exception review processes.

Enacting Corrective Action

• Policy exception requests weakens an organization's overall security posture.
• They are granted only when the policy negatively affects business objectives or the cost of compliance exceeds the cost of noncompliance.
• The development process requires ongoing employee education, security training, and regular ISG document reviews to reflect current business and security goals.
• A BOD demonstrates reasonable care when it regularly reviews its policies.

Types of Recommended Infomation Security Policies

• Security policies vary among organizations due to different goals, needs, and cultures.
• Organizations should address acceptable use, anti-harassment, workplace privacy/monitoring, data retention/destruction, intellectual property, authentication/password, and security awareness/training.
• These policies address IT resource use and data, often involving collaboration between information security and HR departments.

Acceptable Use Policy (AUP)

• Companies use AUP's, which are used to tell employees how to properly use organizational IT resources.
• AUP's are important because It resources are expensive and contain data that is valuable to the organization.
• AUPs can prevent costly issues, such as information security compromises, malware on IT systems, or unintentional loss of data.
• AUP is a code of conduct that states permitted uses of IT resources, prohibited actions, and consequences for violations.
• Legal departments use AUPs to meet regulatory responsibilities and limit legal liability.
• Information security departments use to make employees aware of the consequences of improper use of IT services, which can include consequences such as consuming network bandwidth, consuming network storage space, or introducing malware onto IT systems.

AUP Terminology

• General terms found in organization AUP's include: IT resources for business use only, Employees shouldn't tamper with IT resources, no personal use of organizational IT resources, and IT resources to be monitored for employee compliance.
• Many AUP's include terminology and guidance for email, internet, and mobile device use.

AUP Enforcement

• Enforcement on the the AUP may include suspension of access to IT resources, employee reprimand, employment suspension, and referral to law enforcement.

Anti-Harassment Policies

• Harassment includes unwanted verbal/physical conduct that demeans or threatens a person.
• Workplace harassment can violate federal law, specifically Title VII of the 1964 Civil Rights Act, which prohibits discrimination based on race, sex, religion, disability, and ethnicity.
• Anti-harassment policies are used to limit liability for workplace harassment and typically include defining harassment, reporting procedures, investigation protocols, and retaliation prohibitions.
• The law allows victims to recover damages from their harassers who were not stopped by their employer.

Workplace Privacy and Monitoring Policies

• Workplace privacy is a controversial issue, because employees do not want to have their activitiesmonitored/creates distrust in the workplace.
• U.S. employees have few privacy rights when using an organizations IT resources.
• Allows an organization to monitor emails if there is legitimate business reason for it which can include: assessing employee productivity, monitoring operational use of IT resources, monitoring the use of an organization's intellectual property.

Combining Workplace Privacy and Monitoring Policies

• Informs employees that IS services are not private and may be monitored, even if the organization does not actively do so.

Data Retention and Destruction Policies

• Organizations are using data retention policies state on how data is controlled throughout its life cycle. Laws and Organizational Policies, and data destruction to determine retention parameters.
• Organization must have policies for how to handle storing data, what to do with it when it is no longer needed, and have a backup primary storage systems.
• Involves destroying it in a way that cannot be recovered, which means the organization must employee awareness to make employees aware of requirements and properly file/maintain data.

Data Retention Policies

• Helps manage competing concerns from business purposes, product marketing, data disasters, and legal and fiscal concerns.
• A cross-functional team helps review/determine the requirements such as what type of data and where it is stored legally.

Data Destruction Policies

• Ensures the destruction of appropriate policies and data such as identification for destruction, methods of that data, and validation procedures for that destruction.
• Legal Requirements influence on data destruction such as the (GLBA) which states that paper documents holding customer's information must be destroyed, as well as federal regulations that require electronic data to be destroyed as well.

State Law Data Destruction Requirements

• Some states require some form of data destruction such as The State of Indiana that requires information to be disposed of in a way that makes it unusable through specific methods.

Intellectual Property Policies

• Intellectual property laws protect people or organizations' ownership rights in their creative ideas.
• Protect an organizations assets, such as the company's electronic proprietary and trade secret data,
• An organization also must take precautions to not violate others' copyrights.

Authentication and Password Policies

• Authentication such as (username/passwords) controls are among the most basic types of information security controls that should be implemented to protect IT resources.
• Multifactor authentication can also be used when employees use 2 or more different types of credentials to access the IT resources.
• Other common password policies include: ensuring passwords aren't written down, they contain complexity requirements, and they expire after a certain amount of time.

Security Awareness and Training

• 88% of employees surveyed in 2016 did not know about security policies.
• This means training and awareness is important because employees have a large role to play in meeting information security goals.
• A high-level awareness and training policy/statement ensures that employees know that The BOD supports info security education and in most times these are stand-alone policies.

Components of an IS Awareness and Training Program

• IS Awareness programs should implement components that discuss why security and training are important, who has overall responsibility for the policy. such can provide training/awareness and often training should take place.

Acceptable Use Case Study

• Employee handbooks provided by Autoliv stated general rules of conduct and anti-harassment policies for its employees working at Autoliv.

Quiz covering Information Security Governance (ISG) and Management (ISM). Questions focus on compliance, roles, responsibilities, and continuous monitoring as emphasized by ISO/IEC 27004:2016. Explore key differences between ISG and ISM.