Implementing security

Editor's Notes

• #3: LEARNING OBJECTIVES: Upon completion of this material you should be able to: Understand how the organization’s security blueprint becomes a project plan Identify the main components of a project using the work breakdown structure (WBS) method Grasp the significant role and importance of the project manger in the success of an information security project Understand the need for professional project management for complex projects Identify the key elements of the bull’s-eye method as presented in this chapter Grasp the problems that organizations face in times of rapid change
• #4: LEARNING OBJECTIVES: Upon completion of this material you should be able to: Understand how the organization’s security blueprint becomes a project plan Identify the main components of a project using the work breakdown structure (WBS) method Grasp the significant role and importance of the project manger in the success of an information security project Understand the need for professional project management for complex projects Identify the key elements of the bull’s-eye method as presented in this chapter Grasp the problems that organizations face in times of rapid change
• #6: In general the implementation phase is accomplished by changing the configuration and operation of the organization’s information systems to make them more secure. It includes changes to: Procedures (through policy) People (through training) Hardware (through firewalls) Software (through encryption) Data (perhaps through classification)
• #7: During the implementation phase, the organization translates its blueprint for information security into a concrete project plan The project plan delivers instructions to the individuals who are executing the implementation
• #8: These instructions focus on the security control changes needed to the hardware, software, procedures, data, and people that make up the organization’s information systems But before a project plan can be developed, management should have articulated and coordinated the information security vision and objectives involved in the execution of the plan
• #9: Introduction Implementation is accomplished through translating its blueprint into a concrete project plan including changes to: Procedures (through policy) People (through training) Hardware (through firewalls) Software (through encryption) Data (perhaps through classification) But before a project plan can be developed, management should have articulated and coordinated the information security vision and objectives involved in the execution of the plan
• #10: Project Management In the Implementation Phase Once the organization’s vision and objectives are documented and understood, the processes for translating the blueprint into a project plan can be defined. Organizational change is not easily accomplished. The major steps in executing the project plan are: Planning the project Supervising tasks and action steps within the project plan Wrapping up the project plan The project plan can be developed in any number of ways. Each organization has to determine its own project management methodology for IT and information security projects. Whenever possible, information security projects should follow the organizational practices of project management. If your organization does not have clearly defined project management practices, the following general guidelines on project management practices can be applied.
• #11: The project plan can be developed in any number of ways Each organization has to determine its own project management methodology for IT and information security projects
• #12: Whenever possible, information security projects should follow the organizational practices of project management. If your organization does not have clearly defined project management practices, the following general guidelines on project management practices can be applied
• #13: Developing the Project Plan Planning for the implementation phase involves the creation of a detailed project plan. The creation of the project plan can be accomplished using a simple planning tool, such as the work breakdown structure (WBS). Common task attributes are: Work to be accomplished (activities and deliverables) Individuals (or skills set) assigned to perform the task Start and end dates for the task (when known) Amount of effort required for completion in hours or work days Estimated capital expenses for the task Estimated non-capital expenses for the task Other tasks on which the task depends Each major task is then further divided into either smaller tasks or specific action steps. Key components of the project plan are: Identify Work To Be Accomplished. Describe the skill set or individual person needed to accomplish the task. Focus on determining only completion dates for major milestones. Estimate the expected capital expenses for the completion of this task, subtask, or action item. Estimate the expected non-capital expenses for the completion of the task, subtask, or action item. Note wherever possible the dependencies of other tasks or action steps on the task or action step at hand.
• #14: Project Planning Considerations As the project plan is developed, adding detail to the plan is not always straightforward. Special considerations include: financial, priority, time, staff, scope, procurement, organizational feasibility, training and indoctrination and change control and technology governance
• #17: Financial Considerations No matter what information security needs exist in the organization, the amount of effort that can be expended depends on the funds available. A cost-benefit analysis prepared earlier in the life cycle, must be verified prior to development of the project plan. In many organizations, the information security budget is a subsection of the overall IT budget. In others, information security is a separate budget category that may have parity with the IT budget.
• #18: Both public and private organizations have budgetary constraints, albeit of a different nature. To justify an amount budgeted for a security project at either public or for-profit organizations, it may be useful to benchmark expenses of similar organizations.
• #19: Priority Considerations In general, the most important information security controls should be scheduled first. The implementation of controls is guided by the prioritization of threats and the value of the information assets threatened. A control that costs a little more and is a little lower on the prioritization list but addresses many more specific vulnerabilities and threats have higher priority than a less expensive, higher priority component that only addresses one particular vulnerability.
• #20: Time and Scheduling Considerations Time is another constraint that has a broad impact on the development of the project plan. Time can impacts dozens of points in the development of a project plan including the following: time to order and receive a security control due to backlogs of the vendor or manufacturer; time to install and configure the control; time to train the users; and time to realize the return on investment of the control.
• #21: Staffing Considerations The lack of enough qualified, trained, and available personnel also constrains the project plan. Experienced staff is often needed to implement available technologies and to develop and implement policies and training programs. If no staff members are trained to configure a firewall that is being purchased, someone must be trained, or someone must be hired who is experienced with that particular technology.
• #22: Scope Considerations It is unrealistic for an organization to install all information security components at once. The project plan should not attempt to implement the entire security system at one time. In addition to the constraints of handling so many complex tasks at one time, there are the problems of interrelated conflicts between the installation of information security controls and the daily operations of the organization. The installation of new information security controls may also conflict with existing controls.
• #23: Procurement Considerations All IT and information security planners must consider the acquisition of goods and services. There are a number of constraints on the selection process for equipment and services in most organizations, specifically in the selection of certain service vendors or products from manufacturers and suppliers. These constraints may change the specifics of a particular technology or even eliminate it from the realm of possibilities.
• #24: Organizational Feasibility Considerations Policies require time to develop and new technologies require time to be installed, configured, and tested. Employees need to understand how a new infosec program impacts their working lives. The goal of the project plan is to avoid new security components from directly impacting the day-to-day operations of the individual employees. This means that changes should be transparent to systems users, unless the new technology causes changes to procedures, such as requiring additional authentication or verification.
• #26: Training and Indoctrination Considerations The size of the organization and the normal conduct of business may preclude a single large training program on security procedures or technologies. As a result, the organization should conduct a phased in or pilot approach to implementation, such as “roll-out” training for one department at a time.
• #27: In the case of policies, it may be sufficient to brief all supervisors on new policy and then have the supervisors update end users in normal meetings. Ensure that compliance documents are also distributed, requiring all employees to read, understand, and agree to the new policies.
• #28: Change Control and Technology Governance Considerations In organizations that have IT infrastructures of significant size, the change control and technology governance issues become essential.
• #29: The Need for Project Management Project management requires a unique set of skills and a thorough understanding of a broad body of specialized knowledge. It is a realistic assumption that most information security projects require a trained project manager, CISO, or skilled IT manager versed in project management techniques to oversee the project.
• #30: In addition, when selecting advanced or integrated technologies or outsourced services even experienced project managers are advised to seek expert assistance when engaging in a formal bidding process.
• #31: Supervising Implementation Some organizations may designate a champion from general management to supervise the implementation of the project plan for security information. An alternative is to designate a senior IT manager or the CIO of the organization to lead the implementation.
• #32: The optimal solution is to designate a suitable person from the information security community of interest, since the inherent focus is on the information security needs of the organization. In the final analysis, it is up to each organization to find the leadership for a successful project implementation that best suits its specific needs and the personalities and politics of the organizational culture.
• #33: Executing the Plan Once a project is underway, it is managed to completion using a process known as a negative feedback loop or cybernetic loop, which ensures that progress is measured periodically. The measured results are compared against expected results. When significant deviation occurs, corrective action is taken to bring the task that is deviating from plan back into compliance with the projection, or else the estimate is revised in light of new information. When corrective action is required, there are two basic situations: either the estimate was flawed or performance has lagged.
• #34: When an estimate is flawed, for example a faulty estimate for effort hours is discovered, the plan should be corrected and downstream tasks updated to reflect the change. When performance has lagged, for example due to high turnover of skilled employees, correction is required by adding resources, lengthening the schedule, or by reducing the quality or quantity of the deliverable. The decisions are usually expressed in terms of trade-offs. Often a project manager can adjust one of the three planning parameters for the task being corrected: 1.Effort and money allocated 2.Elapsed time or scheduling impact 3.Quality or quantity of the deliverable
• #38: Technical Topics Of Implementation Some parts of the implementation process are technical in nature, dealing with the application of technology, while others are not, dealing instead with the human interface to technical systems.
• #40: Wrap-up Project wrap-up is usually handled as a procedural task assigned to a mid-level IT or information security manager. These managers collect documentation, finalize status reports, and deliver a final report and a presentation at a wrap-up meeting. The goal of the wrap-up is to resolve any pending issues, critique the overall effort of the project, and draw conclusions about how to improve the process for the future.
• #41: Conversion Strategies As the components of the new security system are planned, provisions must be made for the changeover from the previous method of performing a task to the new methods. 1. Direct changeover: Also known as going “cold turkey,” involves stopping the old method and beginning the new. 2. Phase implementation: the most common approach, involves rolling out a piece of the system across the entire organization. 3. Pilot implementation: involves implementing all security improvements in a single office, department, or division, and resolving issues within that group before expanding to the rest of the organization. 4. Parallel operations: involve running the new methods alongside the old methods.
• #45: The Bull’s-eye Model for InfoSec Project Planning By reviewing the information security blueprint and the current state of the organization’s information security efforts in terms of the four layers of the bulls-eye model, project planners can find guidance about where to lobby for expanded information security capabilities. This approach relies on a process of evaluating project plans in a progression through four layers: policy, network, systems and applications. The bull’s-eye model can be used to evaluate the sequence of steps taken to integrate parts of the information security blueprint into a project plan, meaning that: Until sound and useable IT and information security policy is developed, communicated, and enforced, no additional resources should be spent on other controls. Until effective network controls are designed and deployed, all resources should be spent to achieve that goal. After policy and network controls are implemented, implementation should focus on the information, process, and manufacturing systems of the organization. Once there is assurance that policy is in place, networks are secure, and systems are safe, attention should move to the assessment and remediation of the security of the organization’s applications.
• #47: To Outsource or Not Just as some organizations outsource IT operations, so too can organizations outsource part of or all of their information security programs. When an organization has outsourced IT services, information security should be part of the contract arrangement with the outsourcer. Because of the complex nature of outsourcing, the best advice is to hire the best outsourcing specialists, and then have the best attorney possible negotiate and verify the legal and technical intricacies of the outsourcing contract.
• #51: Non-Technical Topics Of Implementation Other parts of the implementation process are not technical in nature, dealing with the human interface to technical systems. These include the topics of creating a culture of change management as well as a some considerations for organizations facing change.
• #52: The Culture of Change Management In any major project, the prospect of change, the familiar shifting to the unfamiliar, can cause employees to unconsciously or consciously resist. Even when employees embrace changes, the stress of making changes and adjusting to the new procedures can increase the probability of mistakes or create vulnerabilities in the system. By understanding and applying some of the basic tenets of change management, the resistance to change can be lowered, and you can even build resilience for changes, making ongoing change more palatable to the entire organization.
• #53: One of the oldest models of making change is the Lewin change model , which consists of: Unfreezing: “thawing out” hard and fast habits and established procedures. Moving: the transition between the old way and the new. Refreezing: the integration of the new methods into the organizational culture, by creating an atmosphere in which the changes are accepted as the preferred way of accomplishing the requisite tasks.
• #54: Considerations for Organizational Change In order to make an organization more amenable to change, some steps can be taken. This includes reducing resistance to change fro the beginning of the planning process and steps taken to modify the organization to be more accepting of change.
• #55: Reducing Resistance to Change from the Start The level of resistance to change impacts the ease with which an organization works through the process described. The more ingrained the previous methods and behaviors, the more difficult the change. The primary mechanism used to overcome this resistance to change is to improve the interaction between the affected members of the organization and the project planners in the earlier phases of the SecSDLC. The guideline to improve this interaction is a three-step process: communicate, educate, and involve.
• #56: Reducing Resistance to Change from the Start The level of resistance to change impacts the ease with which an organization works through the process described. The more ingrained the previous methods and behaviors, the more difficult the change. The primary mechanism used to overcome this resistance to change is to improve the interaction between the affected members of the organization and the project planners in the earlier phases of the SecSDLC. The guideline to improve this interaction is a three-step process: communicate, educate, and involve.