Security Risk Management Practice Areas

Practice Areas in Security Risk Management (SRM)

• Five practice areas inform security risk management: security, physical, people, information, and Information and Community Technology (ICT) security.

Security Management

• Provides a framework for asset protection and enables all areas of SRM to work individually and collectively.
• Encourages an SRM culture within organizations.
• Outlines a skill set for SRM practitioners.
• Integrates physical, people, ICT, and information security practices.
• Equated with protective security, encompassing conceptual, virtual, and procedural asset protection.
• Consists of risk management, threat assessments, intelligence, investigations, root cause analysis, administrative controls, and governance arrangements.

Physical Security

• Protects personnel, hardware, property, networks, and data from burglary, theft, vandalism, and terrorism.
• Traditional elements like guns, guards, and gates (3Gs) are only a small part of physical security.
• Security plans must encompass physical security.
• Security measures to implement include access control systems, executive protection with background checks, security staff, and integration of physical safety issues.
• Emergency response systems and fire prevention measures are important.
• Physical security needs an understanding of both the internal and external environment.
• Physical barriers like fences, bollards, doors, and screens protect assets.
• Physical barriers can define perimeters, control access, detect unauthorized entry, and delay intrusion.
• Barriers can be natural and structural; structural barriers can deter attacks.
• Barriers should reduce the need for costly security measures (human/technological).
• Organizations need restricted access, accompanied access, and group access areas.
• Hospitals: group access areas in grounds & waiting rooms, accompanied access in emergency treatment, restricted access in pharmacy.

People Security

• Two main goals: protecting people (staff, family, visitors) from harm and protecting organizations from security threats controlled by people (vetting, protective measures).
• Embodies duty of care to staff and visitors and recognizes this group can pose a security threat.
• Vital to an organization’s internal/external operational security and business continuity.
• Considers sociopolitical issues, human security, recruitment, vetting, fraud control, coercion, and corruption.
• Aims to protect against security risks from staff, contractors, visitors and the public.
• Encompasses:
  • Human Security: Protection of individuals.
  • Personnel Security: Security-related management of employees/contractors: security clearances, employment screening, assessment.
  • Identity Security: Addresses identity fraud, biometrics, privacy, and protection of sensitive information.
  • Personal Protective Practices: Physical, procedural and conceptual activities for individual security, like close protection, travel, and residential security.
  • Human Factors: Behaviors are the main determinant of security outcomes, and need good judgement for SRM.
• Personnel Security: A process for ensuring only suitable people can access sensitive resources.
• Effective management includes responsibilities of staff, management, recruitment, and colleagues.
• Evaluate trustworthiness before placing someone in a position of trust.
• Screening alone is not enough.
• Employment checking must include character references and checking CV and qualifications.
• Ongoing psychological evaluations for high-stress roles are also mandatory.
• Maintenance involves access control, records, admin for staff, volunteers, visitors, and contractors.
• Record keeping includes security items (keys, codes, badges, passwords).
• Must safeguard information system assets (laptops, software).
• Revoke access privileges and retrieve sensitive material/hardware upon termination or transfer.
• Provide security awareness and training on policies/procedures for data privacy and data security.
• Large orgs should issue staff with authorization codes and ID.

ICT Security

• The security of information systems critical for a knowledge-based economy.
• Information systems (email, data warehouses, search engines, servers) are vulnerable.
• SRM principles extend to protecting IT and communications.
• All areas are interdependent, especially encryption for ICT security.
• Confidentiality of ICT systems compromised without adequate protection, and security systems may not prevent breaches if infrastructure is poorly secured.
• Threats include network-aware attacks, system misuse, rogue software, ICT staff unavailability.
• Automated attacks from viruses, worms, trojans result in data destruction, theft, and loss of productivity.
• Misuse causes damage to ICT systems and company reputation.
• Uncontrolled software causes instability and data corruption.
• Shortage of ICT staff makes organizations vulnerable.
• Equipment obsolescence is a potential vulnerability.
• Plan software upgrades and acquire interoperable equipment.

Information Security

• Protecting information is an increasing challenge.
• Patent laws do have some level of protection
• Applies for electronic and hard copy info
• Hard copy are more susceptible to damage
• Involves confidentiality, integrity, availability, utility, authenticity, and control/possession.

The Information Security Life Cycle

• Information goes through processes, from creation/acquisition to destruction/acquittal.
• Stages:
  • Creation/Acquisition: Information is made/acquired, and developer marks it.
  • Distribution: Access granted only to authorized people. Methods of transfer risk incorrect or accidental access.
  • Use: Information is used, and personnel must guard against compromise.
  • Storage: When information becomes redundant, it is stored using archiving and electronic storage.
  • Destruction: Information is permanently removed from storage media. Destruction is vital when dealing with national security information or third-party contracts.
  • Acquittal: Records of destruction/transfer are kept, especially for third-party information. Records are a basis for information owners and management.

Business Continuity Management (BCM)

• BCM involves resilience through practices to prepare for disruptions and restore.
• Includes:
  • Business impact analysis: Assessment of the effect a business disruption event may have on business operations performed by the organization
  • Preparation and execution of recovery plans
  • Alternate facilities and sites
  • Restoration or replacement of facilities
• Planning identifies critical functions and minimizes service loss.
• Strategies involve third-party data centers and alternate workspaces.
• It is a continuous activity throughout the organizational lifecycle.
• Addresses extended restoration after immediate responses.
• Ensures business continuity with more than IT solutions.
• Plans are comprehensive pre/post disaster, designed for the worst and should also be flexible when things are more easy to manage (power outage, server errors)
• BCM provides structure, regularity, recovery and benefits such as compliance, improved marketing, and competitive advantage.
• Mandatory requirements are becoming more apparent in some industries which prevent heavy fines.
• BCM demonstrates contingency to potential clients.
• Effective BCM can demonstrate risk management and provide recover to underwriters during insurance claims.